Some of our team members are secretly using unauthorized AI tools to do their work, and we are worried about data leaks. How do we convert our basic AI policy into an active, enforceable part of our daily operations without micromanaging them?

Question

Tyler Smith · Accepted Answer

To turn your AI policy from an ignored document into operational reality, you must tie it directly to your existing EOS framework. Do not run around playing IT police. Instead, address the root cause of why your people are hiding these tools, which is usually a fear that you will cut their hours or micromanage their newfound efficiency. Start by updating your Core Values Speech to explicitly define what ethical, secure AI usage looks like in your company. Make it clear that using AI to save time is encouraged, provided they do so within approved parameters. Next, establish a safe pathway for tool registration. If a team member finds an AI tool that helps them hit their Scorecard targets, their manager should bring it to the weekly Level 10 Meeting as an Issue. Run the tool through your standard GWC filter. If the person has the capacity to manage the tool safely and the data privacy checks out, approve it and document it in your standard operating procedures. If they hide the tool, it becomes a Core Values violation, which is handled through the standard three-strike People Analyzer process. By routing new tools through your weekly meeting, you keep them visible, secure, and aligned with your operational standards.