Your team is already using AI. Start with an amnesty, not a ban.

Whether or not you have an AI strategy, your organization has AI usage. Staff are drafting emails, summarizing documents, and analyzing spreadsheets with whatever tool they found, often on personal accounts whose terms permit the provider to learn from what's typed in.

The instinct is to ban it. That rarely works. Usage goes quieter, not away, and you lose the visibility you need to manage the risk.

Step 1: Find out what's actually happening

Start with an inventory under an explicit amnesty: the goal is to understand, not to punish, and no individual usage is reported by name. In rough order of yield:

• A short anonymous staff survey: which tools, how often, what kinds of data
• A scan of expenses for AI subscriptions, including personal reimbursements
• Aggregate network data, if your IT provider has it, as corroboration, not surveillance
• One question in leadership and staff conversations: "What do you use that IT doesn't know about?"

If you discover regulated or confidential data flowing into unapproved tools, that's not a reason to panic. It's a reason to put an interim policy in place immediately.

Step 2: A policy that fits on four pages

An acceptable-use policy should enable adoption, not prevent it. For most organizations it fits in three or four pages and covers:

• Approved tools. Enterprise accounts only. Personal and free accounts are out for work use.
• What may be shared. A simple classification: public, internal, confidential, regulated. Each level says which tools are allowed. When in doubt, treat it as confidential and ask.
• Human responsibility. You own what you ship. Verify facts, figures, and anything about law or policy. Human review is mandatory before AI-assisted work goes external or affects a person.
• Prohibited uses. Regulated data in unapproved tools, automated decisions about people without review, and using AI to sidestep other policies.
• Fast, safe reporting. Good-faith mistakes get coaching. Reporting a possible exposure quickly is always treated better than having it discovered.

Pair it with a 30-minute all-staff briefing and a signed acknowledgment. A policy nobody has read is a document, not a control.

Step 3: Pick a first use case designed to succeed

When choosing where to apply AI first, weigh feasibility above value. Is the data accessible and trusted? Is the process defined well enough that "correct output" can be specified? Is the cost of an error embarrassing rather than harmful?

The first use case's job is to succeed. A modest, measurable win builds the confidence, skills, and governance habits that make the ambitious projects possible. A flashy failure sets the whole program back a year.

Step 4: Answer the question nobody asks out loud

Every AI conversation has an unspoken question underneath it: what does this mean for my job? Leadership should answer it directly, in its own committed words. Adoption stalls silently when that anxiety goes unaddressed.

The bottom line

Safe AI adoption isn't a technology project. It's inventory, policy, a well-chosen first win, and honest communication, in that order. Organizations that start with an amnesty end up with better visibility, faster adoption, and fewer surprises than those that start with a ban.