A lot of leaders I speak to describe their AI position as something they’re still working through. Still evaluating tools. Still thinking about governance. That’s a reasonable place to be. But while that conversation is happening at the top, the organisation has already moved.

A 2025 Shadow AI report by Josys found that more than one in three professionals are already using AI tools at work — and uploading sensitive information into them — without formal oversight. Strategy documents. Customer data. Financial analysis. Not because anyone is trying to circumvent policy. Because it’s faster. And faster is how work gets done.

The enterprise rollout doesn’t close the gap

A lot of organisations have responded by rolling out enterprise AI tools — Copilot, ChatGPT Business, Claude Team. That’s the right direction. At that level you get admin controls, usage visibility, and clearer data boundaries. But it doesn’t cover everything.

People don’t use one tool exclusively. They use what’s sanctioned for some work — and whatever is fastest for the rest. So what you end up with isn’t one governed system. It’s parallel usage. Some of it is visible, and some of it is not.

Most organisations have seen this pattern before — just with files. You set up SharePoint, defined the folder structure, and told everyone how it should work. Critical documents still ended up in personal drives, email threads, places nobody thought to look. AI is the same dynamic. Just faster, and harder to trace.

The ADAPT State of Data and AI in Australia 2025 report puts a number on it. 78% of leaders say AI is a board-level priority. Fewer than 26% have formal governance structures in place. That gap isn’t because people aren’t trying. It’s because adoption moves faster than visibility.

Three things worth doing before the gap widens

First, find out what’s already in use before you build policy around it. Ask your team leads what tools their people are using, how often, and for what kind of work. A short survey, five questions. You’ll learn more from that in a week than from a six-month governance project.

Second, distinguish between risk levels. Someone using AI to draft an internal email is very different from someone using it to summarise customer data or shape a board recommendation. You don’t need the same controls for both. Start with the higher-exposure workflows first.

Third, close the enterprise gap before it widens. If people are using personal-tier tools for work involving sensitive data, the fix isn’t a policy document. Here’s something most people don’t realise: by default, ChatGPT and Claude use your data to improve their training models unless a user goes in and unticks that setting. Now think about whether you can guarantee everyone in your organisation has done that. Can you be sure nobody’s slipped through? The enterprise tier — around $20 per user per month — gives you admin controls, data boundaries, and the ability to actually verify that. It’s a small price relative to a breach or a reputational hit.

But the goal isn’t to lock everything down. It’s to make the enterprise option easy and fast enough that it becomes the default — and to understand where AI is already shaping outputs, so that when you’re accountable for those outputs, you actually know what went into them.

Want to know where AI is already operating in your business?

We help Australian organisations map their current AI usage, identify the highest-exposure workflows, and build governance that fits how people actually work — not how policy documents assume they do. See our services for more information or get in touch!