The cautious employee in the room is often treated as the obstacle to artificial intelligence. She asks where the data goes, whether the answer can be audited, and who carries the blame when it is wrong. The impatient response is that competitors are moving faster.

Her questions are not evidence of backward thinking. They are the beginning of competent management. AI systems can expose confidential information, fabricate persuasive claims, flatten professional judgment, and create dependencies that are difficult to unwind.

The instinct to keep AI out of a business is therefore worth examining rather than mocking. It may be pointing to a real danger. The problem is that a blanket prohibition rarely keeps the technology out.

Microsoft and LinkedIn's 2024 Work Trend Index surveyed 31,000 knowledge workers across 31 markets. It found that 75% were using generative AI at work and that 78% of AI users were bringing their own tools. Among small and mid-size companies, the figure was 80%.

Those numbers expose the weakness in a simple ban. If employees believe a tool helps them clear an overflowing workload, some will use it quietly on personal accounts or unapproved websites. Management then loses the ability to see which data is being uploaded, which outputs are influencing decisions, and where the risks are concentrated.

Refusal can therefore produce the opposite of control. Official AI use remains at zero. Actual AI use moves into the shadows.

IBM's 2025 Cost of a Data Breach Report found that 20% of the organizations studied had suffered a breach involving shadow AI. High levels of unauthorized AI use added an average of $670,000 to breach costs compared with organizations reporting little or none. Customer personal information and intellectual property appeared disproportionately in those incidents.

There are other legitimate objections. A model can make an employee faster while weakening the employee's ability to perform the task independently. A supplier can change its terms, pricing, or data practices. An automated summary can remove the awkward minority finding that a decision-maker most needed to see. A system trained on yesterday's cases can make today's policy sound settled when it is not.

NIST's AI Risk Management Framework offers a more useful response than cheerleading or panic. It organizes the work around four functions: govern, map, measure, and manage. In ordinary business language: set responsibility, understand the context, test the risk, and control it over time.

The best AI policy begins with the strongest objections. If the concern is privacy, prohibit personal, medical, financial, and confidential client data from consumer tools; then provide an approved alternative with suitable contractual protections. If the concern is accuracy, define which outputs require source checks and a second reviewer.

If the concern is job erosion, identify the skills that must remain human and continue to practice them. A junior analyst who never builds a financial model cannot learn to challenge one. A reporter who never conducts an interview cannot judge what a transcript has missed. Automation should remove drudgery without removing the apprenticeship that produces judgment.

If the concern is dependency, require an exit route. Keep source data in portable formats. Record critical prompts and workflows. Know what stops working if the provider raises prices, suffers an outage, or changes the product.

Caution also improves procurement. It forces a buyer to ask about retention periods, model training, access controls, audit logs, and deletion before a team pours confidential work into a system. Those questions are cheaper before a contract than after an incident.

A business does not need to decide whether it is "an AI company." It needs to decide whether one bounded use is safer and more useful with AI than without it. Choose a low-consequence task, a small group, a fixed period, and a baseline measure. Record time, quality, correction rates, and any data incidents.

At the end of the test, stop what did not work. Keep what did. Add controls where the evidence shows they are needed. That is not timid adoption. It is how adults introduce a technology into a business that has customers, employees, and a reputation to protect.

Skepticism earns its place when it improves the conditions of use. Listen to the warning, then turn it into a testable rule.