Have a look around your office and you’ll probably find it already. Someone writing emails with ChatGPT. Someone summarising a report in Copilot. Someone pasting a client spreadsheet into an AI tool to “just tidy it up quickly”.
None of it is malicious. Most of it doesn’t even break a policy, because most businesses don’t have one yet.
That’s where a lot of businesses are right now. AI didn’t wait for a rollout plan. It came in through browser tabs and personal accounts, one handy shortcut at a time. It’s often called Shadow AI, and I think it’s the biggest AI risk most businesses don’t know they’re carrying.
The problem isn’t that your people are using AI. It’s that nobody can see where, what data it’s touching, or whether it’s safe.
Why it matters now
Once staff are experimenting, the question isn’t “should we use AI?” any more. It’s “what’s already happening, and is it safe?” Without that visibility, there are some very real risks:
- Sensitive data ends up in tools nobody has checked or approved.
- Client details, financials or intellectual property get pasted into a public chatbot, with no record it ever happened.
- Leadership tries to write AI policy without knowing what behaviour they’re actually setting rules for.
None of this means AI should be shut down. Used well, it’s a real boost to productivity and results. The goal is to make it safe, visible and deliberate rather than accidental.
How to find out what’s really going on
Through Kinetics Group, we offer a Business AI Assessment that gives you a clear, evidence-based picture across three areas:
- Business: your goals, current AI activity, approved tools and how mature your governance is.
- Data: how secure your Microsoft 365 setup is, how information is shared and classified, and whether you’re ready for Copilot.
- Users: a staff survey, a scan of devices for Shadow AI, a look at how Copilot is really being used, and where the training gaps are.
What you get
Not just a list of problems. You get a report written for your leadership team or board, with a current-state scorecard, staff survey insights, your Microsoft Secure Score and, most importantly, a prioritised roadmap of must-do and should-do actions, each with an owner and a next step. It’s meant to be acted on, not filed away.
If your people are already experimenting with AI (and they almost certainly are), the safest thing you can do is find out how before you write the rules.
Want to find out how AI is really being used in your business? Book a free health check, or call us on 0800 688 768.