Start with the work people are trying to finish.
A blanket ban can leave the underlying demand untouched: a lawyer still needs to summarize a document, a sales team still needs a proposal, and an analyst still needs an answer. The leadership task is to understand those workflows and provide an acceptable path. Begin by asking what employees use, what information they enter, and where the output goes. Make the first conversation a discovery exercise rather than a hunt for offenders. You need a usable inventory, not a misleading picture of perfect compliance.
Trace the information, not just the subscription.
An approved account does not settle every data question. Review the actual product, plan, settings, connectors, retention arrangements, and access model. Identify whether people are uploading client documents, pasting sensitive excerpts, or connecting shared drives. In-house deployment can offer more control, but it is not automatically secure: permissions, storage, logs, updates, and operational ownership still matter. The joint May 2025 AI data-security guidance from NSA, CISA, and partner agencies treats protection as a lifecycle concern spanning development, testing, and operation. [1]
Replace uncertainty with a small set of working rules.
Our recommended starting point is an approved tool list, clear data categories, examples of permitted tasks, and a route for exceptions. Make it explicit which outputs need review before they reach a client. Assign someone to own the inventory and someone to resolve questions quickly. Provide training using the documents and decisions employees actually encounter. The useful measure is whether people can complete legitimate work through the approved path while reducing unnecessary exposure.
Ask for evidence of control.
At a leadership review, ask for the inventory, a sample of access decisions, the process for reporting exposure, and the changes made after an issue. Avoid collecting the sensitive material itself into another unnecessary repository. In Robuzt’s anonymized law-firm engagement, the work combined an AI-use audit with in-house technology and secure-use processes. The general lesson is that capability and protection need to be designed together. The next decision for your business is concrete: which recurring workflow needs a safe, supported alternative first?
Sources & perspective
Research summaries are attributed below. Recommendations and business interpretations are Robuzt’s editorial perspective; source organizations do not endorse Robuzt.