Who Is Managing the AI Your Employees Are Already Using?
Do you know which AI tools your employees used today?
Not which ones your company purchased.
Not which ones IT approved.
Which ones they actually used.
Maybe someone used AI to rewrite an email. Another employee summarized meeting notes. Someone uploaded a spreadsheet and asked AI to analyze it. A manager used it to help prepare a proposal. Another employee found a free AI tool online that made a tedious task much easier.
None of that necessarily sounds alarming.
In fact, some of it may be helping your employees work faster and get more done.
But it raises a question many businesses haven't had to think about before:
Who is managing all of this?
AI Didn't Wait for an IT Project
Think about how businesses traditionally adopt new technology.
Someone identifies a need.
Products are evaluated.
IT gets involved. Security is considered.
Licensing is discussed. Employees are trained.
Then the technology gets rolled out.
AI hasn't exactly followed that process.
Employees can discover an AI tool this morning and start using it this afternoon. Many tools are inexpensive or free, easy to access through a browser, and require little more than creating an account.
That accessibility is part of what makes AI so useful.
It's also what makes it difficult to manage.
Your company may still be discussing whether it needs an “AI strategy” while employees are already building AI into their everyday work.
The question is no longer simply whether your business will use AI.
It's how your business will manage the AI that's already showing up.
What Are Employees Putting Into AI?
This may be the most important question in the entire conversation.
An employee opens an AI tool because they need help writing something. They paste in a customer email so the AI has context.
Someone wants help analyzing numbers, so they upload a spreadsheet.
A manager wants to summarize a document, so they upload the entire file.
An employee wants to make a proposal sound better, so they paste in pricing, customer information, or internal notes.
They're not necessarily trying to do anything wrong.
They're trying to get their work done.
But once employees start putting company information into AI tools, businesses need to understand what tools are being used, what information is being shared, and what protections apply to that data.
Different AI products, account types, and configurations can handle business information differently. That's why “we use AI” isn't enough information to understand the risk.
You need to know which AI, used by whom, with what data, under what rules.
The AI Tool Isn't the Only Thing That Matters
This is where the conversation gets more interesting.
Let's say your company decides to use Microsoft 365 Copilot.
Microsoft states that Microsoft 365 Copilot operates within the Microsoft 365 service boundary, respects existing permissions, and doesn't use prompts, responses, or Microsoft Graph data to train its foundation models.
Great.
But there's another question:
Are your existing permissions actually correct?
AI can make information easier to find and use. That means old sharing practices, overly broad permissions, forgotten SharePoint sites, and information accessible to more employees than intended can become more important.
Microsoft's own current guidance recommends that organizations assess overshared Microsoft 365 data as part of preparing for and governing Copilot.
In other words, adopting a secure AI platform doesn't automatically fix the way your company has been managing information for the last ten years.
AI may simply make those existing decisions more visible.
And Now AI Agents Are Entering the Picture
AI is also moving beyond simply asking a chatbot a question.
AI agents can be designed to perform tasks, work with business information, interact with applications, and help automate workflows.
That creates opportunities for businesses, but it also introduces another thing IT teams have to manage.
Microsoft now specifically identifies concerns such as agent sprawl, excessive permissions, data leakage, tool misuse, and unmanaged “shadow agents.” Its current Agent 365 security guidance emphasizes visibility, access controls, lifecycle management, and centralized governance as organizations deploy more AI agents.
That may sound like an enterprise problem today.
But think about how quickly cloud applications became normal for small and midsized businesses.
AI is moving fast.
The businesses that handle it best probably won't be the ones that try every new tool first.
They'll be the ones that understand what they're using and put some structure around it
Should You Just Tell Employees Not to Use AI?
Probably not.
If an employee discovers a tool that saves them an hour of repetitive work every week, there's value in understanding that.
A blanket “don't use AI” policy can also miss the larger opportunity. AI is increasingly becoming part of the applications businesses already use, including Microsoft 365.
The better conversation is:
How do we help employees use AI appropriately?
That starts with giving people clear guidance.
Which AI tools are approved for business use?
What company information can employees enter?
What information should never be shared?
Can files be uploaded?
Can employees connect AI tools to company applications?
Who should they ask before trying something new?
Employees shouldn't have to guess.
And IT shouldn't discover six months later that half the company has been using a tool nobody knew about.
Your AI Policy Doesn't Need to Be 47 Pages Long
For many small and midsized businesses, the first step doesn't need to be a massive AI governance program.
Start with a conversation.
Find out what employees are already using.
You might be surprised.
Then identify the tools your business actually wants to support and establish some basic expectations around company data, customer information, account security, approved applications, and new AI tools.
From there, look at the technology underneath it.
Are employees using company-managed accounts? Is multifactor authentication in place?
Are Microsoft 365 permissions appropriate?
Is sensitive information properly protected?
Do you have visibility into the applications employees are using?
Microsoft's current Copilot governance guidance emphasizes many of these same fundamentals, including information protection, data loss prevention, auditing, access management, and employee training.
The goal isn't to make AI difficult to use.
It's to make responsible AI use easier to understand.
AI Is Becoming an IT Conversation
For a while, AI felt like a separate category.
Something innovative. Something experimental. Something employees played with on the side.
That's changing.
AI is becoming connected to the same things businesses already ask their IT teams to help manage: users, accounts, applications, permissions, cybersecurity, company data, Microsoft 365, training, and technology planning.
And as AI agents become more capable, that connection will only get stronger.
This is why businesses should involve their technology partner in AI conversations sooner rather than later.
Not because your IT company needs to choose every AI tool for you.
But because someone should be asking how those tools fit into the rest of your technology environment.
Start With One Question
You don't need to have your entire AI strategy figured out tomorrow.
Start here:
Ask your employees which AI tools they're currently using for work.
Don't ask it as a trap.
You're not trying to catch someone doing something wrong. You're trying to understand what's already happening inside your business.
Ask what they're using.
Ask what they're using it for.
Ask what information they're putting into it.
Ask what tasks it makes easier.
You may discover risks that need attention.
You may also discover some genuinely useful ways your employees are already improving how they work.
Either way, now you know.
And that's a much better place to start than pretending AI isn't being used until someone officially approves it.
So, Who Is Managing Your AI?
AI can help employees write, analyze, summarize, brainstorm, automate, and work more efficiently.
But as it becomes another everyday business tool, it needs to become part of the technology conversation too.
Someone needs to think about the accounts.
The access.
The information.
The security.
And the people using it.
At TriTech, we help Southeastern Wisconsin businesses make technology decisions that make sense for the way they actually work. As AI becomes a bigger part of Microsoft 365, cybersecurity, and everyday business operations, we're here to help you understand where it fits and what you should be thinking about before simply turning it loose.
You don't have to know everything about AI.
But you should know how it's being used inside your business.
Comments