Illustrative scenario. An analyst pastes a client memo into a free AI tool for a cleaner summary. The memo includes screening criteria, a price range, and an assessment of a target the firm would not share outside the room. The summary saves time. The firm may have no record of where the memo went.
That is the problem with tools adopted without review. Employees find something useful and put it to work before the firm has decided what information it can receive.
IBM’s 2025 Cost of a Data Breach Report studied 600 organizations that experienced breaches between March 2024 and February 2025. One in five of those organizations reported a breach linked to shadow AI, meaning AI used without employer approval or oversight. Organizations with high levels of shadow AI had average breach costs $670,000 higher than those with low levels or none. Among the breached organizations studied, 63% had no AI governance policy or were still developing one. (IBM report findings)
The inventory should show which tools staff use, what each tool does, and what information it receives.
Look for:
Use that record to decide which tools and uses the firm will approve.
Put the main rules on one page so staff can check them before submitting a prompt. This employee-facing summary supplements any required security program or incident-response procedures.
Spell out what is allowed, what is restricted, and whom to ask when a case is unclear.
Work through examples staff will recognize from their own jobs.
Show what staff must remove before submitting a memo or query and which work requires a tool approved for that information. Give them a contact for questions the policy does not cover.