AI can improve productivity, but unmanaged use can expose confidential information and weaken accountability.
Artificial intelligence is rapidly changing the way people work. Staff can use AI tools to draft emails, summarise documents, analyse data, write code, prepare reports and support research. This creates real productivity opportunities. However, many organisations are discovering that AI use is already happening informally, often without policies, approved tools, training or monitoring.
The risk is not that employees are interested in AI. The risk is that confidential information, personal information, client documents, source code or internal strategy may be uploaded into tools that have not been assessed. AI outputs may also be inaccurate, incomplete or inappropriate if they are accepted without human review.
Why this matters
AI is both an innovation issue and a governance issue. Management should create guardrails that enable responsible use, rather than ignoring the reality that staff will experiment with AI tools. A controlled approach protects data, improves consistency and reduces the risk of shadow AI across the organisation.
What management should consider
- Approve which AI tools may be used for business purposes.
- Define what information may not be uploaded into public or unapproved AI platforms.
- Require human review of AI-generated outputs before they are used externally.
- Consider intellectual property, confidentiality and client data implications.
- Train staff on practical AI risks, including hallucinations and data leakage.
- Monitor emerging AI-enabled fraud risks such as deepfake calls and synthetic emails.
- Assign ownership for AI governance, policy and exception approval.
Common pitfalls to avoid
Allowing unapproved AI tools without data rules.; Accepting AI outputs without human review.; Focusing only on productivity while ignoring confidentiality and accountability..
Key takeaway
The right question is not whether employees should use AI. The better question is how the organisation can allow responsible, secure and controlled AI use.
Practical first step
Issue a short interim AI acceptable-use notice while a fuller policy is developed. Focus first on what information may not be uploaded into public tools.
How Nexia SAB&T can assist
Nexia SAB&T can assist with AI governance readiness reviews, AI acceptable-use policy support, AI risk assessments and data leakage control reviews.
Author details: Rob Galetti | IT Audit and Cybersecurity | Nexia SAB&T
Date: 22 July 2026
