How to adopt AI at work

Almost every company is trying to use AI right now. That isn’t news, and it isn’t that interesting. What is interesting is how few companies are doing it well. Some blame the technology, others say it’s amazing. What I see day to day is a handful of people using it well, a lot of people trying to catch up, and plenty who don’t know where to start.

Companies have three choices when it comes to AI.

1. Do nothing

Some employees will use AI, others won’t, and everyone picks their own tools. Sensitive documents end up in consumer-grade LLMs, often on consumer plans where that data can be used to train the model. You have no visibility, no control, and no way to switch it off when someone leaves.

2. Ban it

Tell people it isn’t permitted. You’ll lose good people and you’ll lose your creative edge. People will use it anyway, just quietly, and sensitive documents still end up in consumer LLMs.

3. Adopt it together

This is the approach I recommend, and it’s how I’ve had success with several companies. There are four parts to it.

Pick sanctioned tools. Choose one or more, get a team or enterprise plan, set it up securely and link it to your identity provider so access is managed and can be removed; then give people access.

Write a policy. One page is enough to start; it needs to say what people can and can’t do and what is acceptable to put into an LLM. Make sure people also know how to suggest other tools or request a license. I’ve written separately about how to create an AI usage policy.

Create a forum. Find the people who are interested and give them a regular meeting or a Slack channel; use it to collect ideas and work on them together.

Solve real problems. As a group, pick business problems that are real, measurable and worth solving, then work out how AI can help; you’ll surface training needs and ideas you hadn’t thought of, and pull people out of their silos instead of leaving everyone to run side projects.

Add a show and tell

The most useful thing in those forums is a regular show and tell. People share the smart things they’ve done with AI, at work and at home. You’ll quickly find your natural power users, and they’re usually happy to teach others.

What this looks like in practice

One client I work with had no AI policy. Someone in the business was enthusiastic about AI, had no security or development background, and built a small system that answered questions over company documents they had copied off the internal SharePoint site. It all ran on personal accounts and was hosted in a personal Cloudflare account. They asked me to review it.

When I did, the person who built it couldn’t fully explain what they had built or how it worked. They had followed whatever the LLM told them to do, and it worked, so they kept going. Every safeguard the company had around that data was gone the moment it left SharePoint. And they hadn’t done anything wrong, because nobody had told them what the rules were.

I gave a high-level assessment and said what I’d say to anyone: it’s great to have people this enthusiastic, and you want to learn from them, but it has to be done securely. They chose to close the project down, paid the employee a bonus for the initiative, and changed direction.

They set up a company LLM on a corporate account, wrote an AI policy and shared it with the whole company, and started a weekly AI working group, which I’m part of, with training materials for everyone else. That group has since built agents that save the company time, all with a human in the loop, and it keeps bringing new use cases to the business.

Do this and you’re not just adopting the technology. You’re building an AI culture, and doing it securely and in a controlled fashion, instead of spinning up pilots for the sake of it.

This is the work I do under AI Security & Governance. If you want to talk it through, or need help getting started, get in touch.