Is your team already using AI tools you haven't approved?

Ask most business owners whether their firm uses AI, and you’ll often hear the same answer: “Not really. Not yet.”

Then ask the team.

One person drafts tricky client emails with ChatGPT. Another summarizes long meeting notes with a free AI tool. Someone else installed a browser extension that rewrites documents in seconds. Nobody made a decision to adopt AI. It simply arrived.

You’re not alone if that sounds familiar. In Microsoft and LinkedIn’s 2024 Work Trend Index, a survey of 31,000 people in 31 countries, 75% of knowledge workers said they already use AI at work, and 78% of those users said they bring their own AI tools rather than waiting for their employer to provide them.

How does AI get in without anyone deciding?

Most business software goes through some kind of buying process. A new accounting package gets discussed, priced and approved. A new document management system gets a proper rollout.

AI tools skip all of that. They’re free or cheap, they run in a browser, and they help on the first try. Someone finds one on a busy afternoon, it saves them twenty minutes, and it quietly becomes part of how they work.

By the time the business gets around to thinking about an AI policy, people already have favourite tools and habits built around them.

So where does the risk come in?

Picture this. A staff member gets a long, detailed email from a client and pastes it into a public AI tool to help draft a reply. It works brilliantly. The next day they do it again. A week later they upload a draft proposal to get a summary. A month later a colleague is using a different tool to analyze a spreadsheet of client billing.

Nobody feels like they’re doing anything wrong. They’re trying to be efficient. That’s exactly the problem.

Client details, financial figures and internal documents are now sitting in services your business never reviewed. Depending on the tool and its settings, what’s typed in may be stored, seen by the provider or used to train future models. And you have no record of any of it.

For law firms, accounting practices and other professional offices, that matters. You’re responsible for protecting personal information under PIPEDA, and lawyers have confidentiality duties to the Law Society of Ontario. “I didn’t know the team was using that” isn’t a comfortable conversation to have with a client.

Why not just ban AI tools?

It’s tempting. But a blanket ban usually backfires.

If someone believes a tool helps them do better work, being told to stop without an explanation feels like being told to work slower. Some people will comply. Others will keep going quietly, on personal accounts and personal phones, where you have even less visibility.

The better approach is to bring AI into the open. Your team gets the benefits, and you get to decide where the boundaries are.

So what should you actually do?

Start here:

• Ask your team, without judgment, which AI tools they use and what they use them for

• Make a simple list of approved tools, ideally business versions signed in with work accounts, so there’s a safe option to use

• Write down what should never go into an AI tool: client names, financial records, passwords and anything confidential

• Remove browser extensions and add-ons nobody has vetted

• Revisit the list every few months, because new tools appear constantly

None of this needs to be complicated. A one-page policy and an honest conversation go a long way.

If you’ve never asked your team which AI tools they’re using, the answers might surprise you. That’s a good thing. It means you can put sensible guardrails in place now, before a well-meaning shortcut turns into a real problem.

Want help finding out which AI tools are in use across your firm, and setting rules that make sense? Book a free consultation.

Source: Microsoft and LinkedIn, 2024 Work Trend Index (May 8, 2024) — news.microsoft.com