Your employees are already using AI

Imagine discovering that employees use a public AI service to summarise documents because the approved process takes too long. The immediate concern is what information may have been shared. The longer-term question is why the organisation offered no workable route to meet the need.

A response has to address both. A prohibition that employees cannot apply to their daily work will be difficult to sustain. Unrestricted experimentation leaves important decisions about information and business risk to individual users.

Establish what is happening

Ask teams which tools they use, for which tasks and with what information. Include AI features already embedded in purchased software. Make the purpose of the review clear so that staff know how to report uncertainty or a mistake.

Where a suspected disclosure or other incident is identified, use the organisation's response process and involve the relevant specialists. Preserve the information needed to assess what happened without circulating sensitive material more widely.

Separately, identify recurring business needs. Drafting routine material, finding internal information and analysing documents may require different solutions. A single enterprise licence may not answer all of them.

Give employees rules they can use

Explain which tools and accounts are approved, what information may be entered and what actions require authorisation. Distinguish drafting assistance from decisions or communications that carry consequences for customers, employees or the company.

Show staff how to check an output in the context of their role. A general instruction to verify everything is difficult to apply if people lack access to the relevant source or expertise. Provide examples of when to stop and ask for help.

Managers also need guidance. They should understand the permitted uses, the limitations of the tools and how to handle a report of a mistake. Requiring unrealistic productivity gains can undermine otherwise sensible safeguards.

Offer an approved route for a useful idea

Create a straightforward way to propose a use and obtain an answer. Ask for the task, expected benefit, information involved and proposed users. The assessment should be proportionate to the consequences of the use.

Give the applicant a decision, conditions or a reason the idea cannot proceed. Where preparation is required, identify the work and owner rather than leaving the proposal in a queue indefinitely.

Review whether approved uses work as intended. Record significant changes in users, information access or permissions so they can receive appropriate review.

The NIST AI Risk Management Framework provides a voluntary reference for organising responsibilities and risk work around AI systems. [1] The organisation still has to turn that work into instructions people understand.

Start with one common employee task. A clear answer about how to perform it safely will reveal more about the usefulness of the policy than another broad statement of principles.

[1] NIST AI Risk Management Framework Read the source

Nasaq Partners works with a network of experts on governance, strategy and execution. Explore our advisory services.