Unapproved AI Use Is a Board Issue, Not an IT Issue

Right now, somewhere in your building, someone is pasting a customer contract into a free AI tool to summarize it real quick. Somebody else is dropping quarterly numbers into a chatbot to help build a deck for Monday. Nobody approved it. Nobody logged it. And most of it, you will never find out about, until you do.

That's unapproved AI use. The AI your people are already using, with data you never authorized, creating exposure nobody in the room can see. When it comes up at all, it usually gets handed to IT to detect and block. Here's the thing. That's exactly why it keeps growing. unapproved AI use was never an IT problem. It's a governance problem, and governance sits with the board.

Why this sits above IT

IT can manage a laptop. It cannot set the company's appetite for risk. That's the board's job, and always has been. unapproved AI use is risk appetite getting set by default, one employee at a time, by people who never signed up to make that call.

I spent 25+ years managing spend and contracts that nobody outside the room ever saw the details of. A board that would never let an employee sign a six figure contract without a signature and a paper trail is, this week, letting employees feed the company's most sensitive information into tools whose terms of service nobody has actually read. That's not a hypothetical. That's Tuesday.

Blocking doesn't work

The instinct is always to ban it. Don't. People reach for these tools because they're under real pressure to keep up, and a ban just pushes the exact same behavior further into the dark, where you can see even less of it. The goal was never to stamp out unapproved AI use. It's to bring it into the light: sanction the right tools, train people to use them well, and put real governance around the whole thing. That's a leadership move. A lockdown isn't.

The disclosure framework boards should actually ask for

You don't govern what you can't see. Here are the questions I'd put in front of management, and if they can't answer them cleanly, that silence is the finding.

1. What AI tools are actually in use across this company, sanctioned and not? If we can't produce that list, we just found our first gap.
2. What data has already left the building through these tools? Customer data, IP, financials, employee records. What's the real exposure?
3. Which decisions are now partly AI influenced, and who's accountable for them? That accountability can't be fuzzy.
4. What's our actual policy, and how do we know anyone follows it? A policy nobody reads is theater.
5. What's the enablement plan? People go looking for unapproved AI use because we haven't given them a sanctioned, well supported alternative yet.
6. What happens when an AI tool causes real harm? Who responds, who gets notified, what's the actual playbook?

Six questions. They turn a vague sense of unease into a governed position you can defend to regulators, to customers, and to your own board.

The reframe that matters

Interestingly enough, unapproved AI use isn't a sign your people are reckless. It's a sign they're trying to do their jobs in a world that moved faster than your policy did, and nobody's handed them a safe path yet. The fix is leadership. Give them the approved tools, the training, and the guardrails to use AI confidently, and in the open.

That's what governance should actually look like. Not surveillance. Not a ban. A clear, board defensible position that protects the company and trusts the people inside it.

1 in 5 companies has a mature model for governing autonomous AI agents.

Source: Deloitte, State of AI in the Enterprise 2026.

Paula Taylor is CEO & Founder of AI Edge Strategy. She spent 25+ years in enterprise operations, including as Global Director of Indirect Procurement at a leading semiconductor manufacturer, where she managed $400M+ in indirect spend and a 10,000-contractor contingent workforce program.