AI Takes the Easiest Path. Good Governance Makes Sure It's the Right One.

"We're not using it, so we don't need a policy."

In our experience, organisations that say this are almost always wrong. That was also the clearest message from our AI Governance Reality Check roundtable in Leeds. Senior leaders from professional services, finance and scaling businesses sat down with people who train and advise organisations on AI, to talk honestly about the AI already in use. The session ran under the Chatham House Rule, so nobody is named here.

One participant heard that exact line from an organisation whose board they sit on. Not long after, slides from someone they work with, which had been poor for years, were suddenly very good.

Ignoring shadow AI doesn't work. Nor does a policy nobody reads. One participant summed up why: "It's like water. It's going to take the easiest path." Governance works when the safe route is also the easiest one to take.

"Not using it" usually means "not seeing it"

Others in the room had heard the same "not us" from their own leaders. They'd also seen what was really going on.

People have always worked around IT when the official tools fell short. What's changed is the pull. For an individual, the value is obvious and immediate. An hour-long task can take minutes.

One participant compared it to the days when people carried customer databases around on USB sticks, before organisations locked that down. AI, they said, is that on steroids.

The room's answer was to tell people clearly what they can use, and how, without being heavy-handed about it. Stay silent and people either take risks or carry on quietly, never feeling they're allowed. Or, in four words from around the table: "Permission is power."

Bring governance in at the start

One organisation had strong technical controls: web filters, alerts on new cloud apps, the lot. However, a senior colleague still went out and purchased an AI gadget that clipped to their phone and recorded conversations.

In a firm built on client confidentiality, that was a flat no. The colleague hadn't considered the risk, or how a client might feel facing a recording device across the table. They'd seen an advert and thought about the time it would save. IT pointed them to the approved assistant they already had. They got the same benefit without the risk.

A second story cost more. An HR team found a new platform, ran a trial and reached the contract stage before anyone asked about data. A quick look at the supplier's website showed the data was stored in the US. That broke the firm's client terms, and the team lost months of work.

Neither person was being reckless. Both were focused on the outcome and blind to the risk. Controls catch tools. They don't catch intent. So governance has to come in when a decision starts. Leave it to the end and the cost is real: wasted months, and a contract that would have broken promises to clients. "Just tell me at the beginning and I'll help you," one participant said. "Don't tell me at the end when it's got messy."

The HR conversation was at least short, because the client contract settled it. That points to a second lesson. Rules hold when they're tied to something real: a client commitment, a regulation or a genuine risk. A rule that only exists as internal policy invites the question, "What actually happens if I break it?"

When people know they're seen, they choose differently

When one firm rolled out an approved AI assistant to everyone, a small number of people in IT could see every prompt and response. Staff had worried about data leaving the business. Few had thought about who inside it could see what they typed.

So the policy changed to say so, and to cover safeguarding. If someone tells the assistant they can't cope, the tool now alerts the right people. Some staff said that changed what they'd type. The reply was candid. On a free app on your phone, you were sharing everything with strangers. Now at least you know who could see it.

The room saw this as healthy. People behave differently when they believe they're being observed, a pattern known as the Hawthorne effect. More people now come to IT before they try something new. Visible controls and open conversations do that job far better than a policy document.

Make the cost visible

For most people, AI arrived as a free app. Few have any idea what it costs to run properly, or what a token is.

That's starting to change. One firm's supplier proposed moving from annual licences to paying per token. Based on the team's usage so far, next year's quote ran well into six figures. Elsewhere, a trial agent that simply drafted email replies cost £70 in four days. Several in the room think today's prices are heavily subsidised and won't stay that way.

So cost has become a governance control. One firm switched on a usage-based AI tool with a deliberately low limit for each person. Run out, and you explain what you were using it for. If it's worth it to the business, the limit goes up.

The logic came from an older lesson. One team spent thousands of pounds in a month on repeated phone calls, to avoid an online fee of under £20. They never saw the bill. Once the cost landed with them, the calls almost stopped. People take the easiest route until they can see what it costs. Just like water.

Seeing the cost also prompts a better question: does this need AI at all? In one participant's workshops, around 40% of the ideas teams put forward for AI turn out to be plain automation. One firm's board kept asking for "an AI workflow". The real fix for slow client engagement letters was simpler: standard terms sent automatically, approved with one click.

Judgement can't be delegated

Much of the discussion turned to people early in their careers.

One firm has made a deliberate call. Everyone gets a general AI assistant to organise their day and their meetings. But specialist tools that produce client work are held back until people have several years' experience. Junior staff don't love it. The firm's view is that they're the senior people of the future. If they never learn the underlying work, they can't question what the AI hands them.

The reasoning holds up. AI is fluent and reassuring by design. It will tell you something is right when it isn't, and only someone with real experience will notice.

Another team lets juniors use AI to write software, but a person still reviews every change. Juniors review other people's work too, then see what a senior reviewer caught that they missed. That's how judgement gets built.

Make the safe route the easy one

AI is the first technology to reach almost everyone in a business, from the board to the person doing data entry. That's why shadow AI spreads so fast. It's also why the people closest to the work are best placed to shape how it's used.

Our view is simple. Weak AI governance is a commercial risk. It shows up as broken client terms, wasted months and bills nobody saw coming. So start with how your people already use AI. Decide what they can use, where data can go, who checks the output and what it should cost. Then make that route the easiest one to take.

If you're not sure what AI is already in use across your organisation, our AI Governance service is the right place to start. It begins with an assessment of the AI in use today, sanctioned or not, and the data feeding it. From there, we help you build governance sized to your real risk, that your people trust enough to use.