Skip to content
Book a consult

Insights  /  Governance

Responsible AI without paralysis

How to set guardrails that accelerate adoption instead of blocking it.

Sopra Labs AI  ·   ·  8 min read
SopraLabs AI Repsonsible hero

Key takeaways

  • A blanket “not yet” does not stop AI use. In an October 2025 survey of 2,003 UK employees commissioned by Microsoft, 71% had used unapproved consumer AI tools at work (Microsoft).
  • Waiting is a risk decision too. It trades use that leadership can see, under rules it wrote, for use it cannot see at all.
  • Responsible use, as an employee experiences it, is five rules on one page: approved tools and uses, data that never goes in, when a person checks the output, when to disclose, and one fast route for everything else.
  • Prohibition is losing ground. In Cisco’s 2026 benchmark study, the share of organizations with outright bans and data-entry limits was 7%, down from 28% a year earlier (Cisco).

The answer is “not yet.” The work goes ahead anyway.

The request is on the leadership agenda for the third month running. The head of customer service wants her team to use an AI assistant to draft replies to routine complaints.

Nobody in the room is against it. The general counsel asks what happens to the customer data. The CFO asks who answers for a wrong reply. The CEO has read the headlines and does not intend to become one. The decision is the same as last month: not yet, pending a policy.

That afternoon, a team lead with forty tickets in her queue opens a chatbot on her personal account. She pastes in a complaint, customer name and order history included, and gets a decent draft back. She fixes one sentence and sends it.

She tells no one. As far as she knows, nobody has told her not to.

A hold is a risk decision too

Every question in that room is a fair one. The trouble is the assumption underneath them: that until leadership says yes, nothing is happening.

The evidence says otherwise. In the New York Fed’s November 2025 Survey of Consumer Expectations, 37% of employed respondents said their workplace does not offer AI tools, “and an additional 11 percent say their employer actively prohibits their use” (New York Fed). No tool does not mean no use. Microsoft commissioned a survey of 2,003 UK employees in October 2025 and found that 71% had used unapproved consumer AI tools at work, and 51% did so every week. Asked why, 28% said their company does not provide a work-approved option (Microsoft). Microsoft sells workplace AI, so read that as evidence from an interested party.

A far larger study points the same way. The University of Melbourne and KPMG surveyed more than 48,000 people in 47 countries between November 2024 and January 2025. Almost half of employees admitted to using AI in ways that contravene company policies, “including uploading sensitive company information into free public AI tools.” More than half (57%) said they hide their use of AI and present AI-generated work as their own. Only 40% said their workplace has a policy or guidance on generative AI use (University of Melbourne).

Seen together, the hold looks different. Leadership believes it is choosing between risk and no risk. The real choice is between use it can see, on tools it picked, under rules it wrote, and use it cannot see at all. “Not yet” selects the second. It is a risk decision, made by default and recorded nowhere.

It also teaches people something. An employee who hears “not yet” three times learns that asking is the slow route.

Prohibition is losing ground. Cisco’s 2026 benchmark study surveyed more than 5,200 IT, technology and security professionals. It shows the share of organizations “with outright bans on AI usage and limits on data entry into GenAI tools” falling from 28% in 2025 to 7% in 2026. The report suggests why: “blanket prohibitions are difficult to enforce and often misaligned with how AI is used day to day” (Cisco). Cisco sells security products, and the direction is still hard to argue with.

Give people rules they can use without asking

Responsible use, as an employee experiences it, is five rules that fit on one page. The governance structure behind them is a separate subject. These are the parts people touch.

Publish the list. Name the tools the company has approved and the uses that need no permission: drafting, summarizing, research, a first pass at analysis. NIST’s generative AI guidance suggests that organizations “establish approved GAI technology and service provider lists” (NIST AI 600-1, GV-6.1-007). Keep the list short and the wording plain. If a use is on it, nobody has to ask.

Say what never goes in. Name the data that stays out of any tool not on the list, in words an employee would use: customer personal details, employee records, unreleased financials, anything under a confidentiality agreement, passwords. Do not count on instinct. In the Microsoft survey, just 32% of employees were concerned about the privacy of company or customer data put into consumer AI tools.

Decide when a person checks. NIST names one risk “confabulation,” in which systems “generate and confidently present erroneous or false content” (NIST AI 600-1). In the Melbourne and KPMG study, 66% of employees rely on AI output without evaluating accuracy, and 56% are making mistakes in their work because of AI. A workable rule: anything that goes to a customer, carries a number, or affects a person is read first by someone who answers for it.

Tell people when to say so. NIST suggests organizations consider “disclosing use of GAI to end users in relevant contexts” (NIST AI 600-1, MP-5.1-003). Set one rule for inside the company and one for outside: say so when a colleague asks, and tell customers when they are dealing with a machine. Then make disclosure safe. People hide what they expect to be punished for.

Open one fast route for everything else. One form, one named owner, and a turnaround measured in days. Record each answer in the decision log and add approved uses to the list, so the same question is not asked twice. This approval path is what makes “not unless it is listed” tolerable.

The usual objection is legal: if you write down what is allowed, you own what happens. You own it now. The use exists, and the open question is whether it runs under your rules. The U.S. federal government took a similar course. An April 2025 memorandum from the Office of Management and Budget told agencies to “remove unnecessary and bureaucratic requirements that inhibit innovation and responsible adoption.” It also said agencies should, within 270 days, develop a policy that “sets the terms for acceptable use of generative AI” (OMB M-25-21).

The same request, one page later

The customer service request does not come back a fourth time. Drafting replies is on the approved list. The team lead uses the company’s tool on the company’s account, reads the draft before it goes, and tells her manager it saved her an hour.

Nothing about the technology changed. Leadership stopped treating “not yet” as the safe answer and wrote down what yes looks like. The fear was reasonable. It needed somewhere to go other than the agenda.

The opening scenario is a composite of common patterns, not a client engagement. SopraLabs sets guardrails and operating principles with leadership teams in the Executive Strategy & Alignment module of our services, and defines the policies and approval paths for responsible use in Governance & Risk Controls.

Frequently asked questions

Should we ban ChatGPT and other AI tools until we have a policy?

In most cases, no. A ban with no approved alternative tends to move use onto unapproved consumer tools, where the company cannot see it. In Microsoft’s October 2025 survey of 2,003 UK employees, 71% had used unapproved consumer AI tools at work (Microsoft). A one-page interim list of approved tools and prohibited data is faster to write than a full policy and does more.

What should an AI acceptable use policy include?

It should include five things an employee can act on: approved tools and uses, data that may never be entered, when a person must check the output, when AI use must be disclosed, and how to request something new. NIST’s generative AI guidance suggests that organizations “define acceptable use policies for GAI interfaces, modalities, and human-AI configurations” (NIST AI 600-1, GV-3.2-003). If the policy does not fit on a page, employees will not use it.

What data should employees never put into an AI tool?

Nothing confidential should go into a tool the company has not approved. That covers customer personal details, employee records, unreleased financials, material under a confidentiality agreement, and passwords. For approved tools, the answer depends on the contract and settings, which is why the list should name tools and permitted data together.

Do employees have to disclose when they use AI at work?

That is for your policy to decide, and it should decide it. NIST suggests weighing “the objective of disclosure, the context of use, the likelihood and magnitude of the risk posed” (NIST AI 600-1, MP-5.1-003). A workable default is to disclose internally when asked and to tell customers when they are dealing with a machine.

Sources

Keep reading

Browse all insights