Most companies started using AI out of FOMO. (Few can say if it's working, or if it's safe.)
Here's how to audit yours in 6 checks:
1. Tools, 25 points
A short list of approved tools, on business plans only. Anything not on the list is shadow AI.
2. Data rules, 25 points
Client data goes into a business plan with owner OK. Never a personal account. Break that once and your score caps at 59.
3. Access, 20 points
AI agents get read-only access by default. Never write access to email.
4. People, 15 points
One named owner. A 30-minute training. A signed policy. Writing the policy is easy. Enforcing it takes leadership and discipline.
5. Review, 15 points
Every quarter, check what's in use, update the list, and have everyone sign again. Under 60 means client data comes out of AI within 7 days.
6. Incident, first 24 hours
- Hour 1: tell the owner.
- Hour 4: delete the chat and cut the connection.
- Hour 24: log it and ask your lawyer if clients must be told.
This is an example model. Tune the weights to your firm.
Save this for your next leadership meeting.
Is your AI strategy delivering results, and can you prove it's safe?
Sources
- PagerDuty Shadow AI Survey (1,250 workers at $500M+ revenue companies, June 11, 2026): 66% used AI they thought wasn't allowed, 34% entered customer data.
- Texas TRAIGA (HB 149), effective Jan 1, 2026.
- NIST AI RMF 1.0.