AI has already entered the building

Businesses still talk about AI adoption as though it is a decision waiting to be made.

Meanwhile, AI has already arrived.

Invited or not, it is appearing inside a wide range of everyday software including finance systems, CRMs, Microsoft 365, Google Workspace, creative tools, websites, search, analytics platforms and customer-service software.

Sometimes it arrives with a launch announcement. Sometimes it simply appears after an update.

Sometimes it is bundled into a renewal.

For businesses, that can create a messy set of questions: Do we have it? Can we use it? Are we allowed to use it? What are we meant to do with it? Who is already using it? What does it cost?

Existing software with embedded AI did not arrive with a permission slip, yet it still needs managing.

And that is exactly the issue.

There may never have been a meeting where somebody said, “Yes, we are adopting AI.”

But it is here and it is in use, invited or not.

And nobody gets to assume somebody else is managing it.

Start with your existing software

Most businesses already run on a substantial collection of software.

Across every area of the business, technology is in use. Finance has its systems. Marketing has theirs. Operations may have order management or inventory platforms. Sales has the CRM. Everyone has browsers, email, documents, spreadsheets and collaboration tools.

Those products are also changing at a pace and in a manner that feels quite different from the historic rhythm of major version releases.

Critically, familiar software is gaining capabilities your team did not originally buy it for.

So before asking whether the business should adopt AI, there is a more basic question:

That requires more than a software list.

A capability can be available without being enabled, enabled without being used, in use without being understood, or used regularly without anyone knowing whether it is creating value.

Then come the practical questions.

• Who has access?
• What information can the tool see?
• What happens to that information?
• Where is it processed?
• Does the business understand the privacy, security or contractual implications?
• Did somebody actively choose the capability, or did it arrive as part of an update or licence change?
• And does it cost anything extra?

The picture also extends beyond company-provided software.

People work remotely. They find useful tools. They install browser extensions. They experiment.

Contractors, freelancers and agencies may also be using AI in the work they deliver. In many cases, you would expect them to use modern tools, so the relevant question is not necessarily, “Did you use AI?”

It may be:

→ What level of assurance does the business need for work being delivered outside the business?

That is a different and much more useful conversation.

There are two AI conversations

There are two clear paths into AI use within a business.

Deliberate adoption: the business identifies a use case, tests it through a pilot, measures value and decides whether to proceed.

Embedded or accidental adoption: AI arrives through software, licences, people and suppliers before the business has consciously decided what to do with it.

This article is about the second path, although both matter and require different management conversations.

A business can know AI is present and still be unclear about what that means.

Knowing where it exists is only the start. The real questions are how it is being used, what risks and responsibilities come with that use, and whether the capability is creating enough value to justify the attention it now requires.

If it’s there, understand the value

Not every new AI capability arrives with an obvious price increase.

Sometimes it simply appears inside software the business already depends on. Sometimes the renewal cost rises. Sometimes the business has little appetite to move platforms because changing a core system would be a project in its own right.

Whatever the commercial route, the question remains:

→ What has changed, and is there useful value sitting there?

That does not mean everybody should be forced to use every shiny new feature.

It does mean that dismissing new capability simply because nobody asked for it can create another kind of waste.

If the capability can save time, improve quality, remove duplication or reduce errors then the business should at least understand that opportunity.

And if the capability proves to have little value, that is useful to know too.

The point is not to embrace every new feature.

It is to make a deliberate call rather than letting the capability arrive, sit unused and quietly become part of the cost and complexity of doing business.

You will not get visibility without trust

A register of tools is useful, but it is not enough.

The more important question is whether people feel confident enough to talk honestly about how they are using AI.

If staff think admitting they used ChatGPT, Gemini or another tool is likely to get them into trouble or result in a loss of credibility, the business will lose visibility quickly.

The useful conversations are usually much more ordinary.

• “Finance have been using this and it is saving them time.”
• “We tried this and it was terrible.”
• “This works really well for first drafts.”
• “We would never use it for that.”
• “We need someone to show us how to do this properly.”

That kind of shared knowledge builds trust, confidence and value across the organisation.

More importantly, it creates a picture of what is actually happening rather than what leadership assumes is happening.

People need room to learn

For AI to become part of the way people work, businesses have to help people learn how to use it well.

Some of that may be formal training, but a lot of it will happen on the job.

People will try things. Some will work brilliantly. Some will be a complete waste of time. They will compare outputs, share shortcuts and learn where the tool helps and where it needs a much firmer human hand.

That means there has to be room for low-consequence experimentation.

Not recklessness.

Not sloppy work.

Just enough space to try, make mistakes, talk about them and grow with the tools as they change.

Training gives people a starting point. Practice is what turns it into capability.

The consequence should determine the control

Not every use of AI carries the same risk.

Rewriting an internal memo is a very different proposition from uploading customer information, working with staff data or using AI-generated analysis to support a significant financial or people decision.

Broad instructions such as “do not put sensitive information into AI” leave an enormous amount to individual interpretation.

Sensitive to whom?

In what context?

Even planning the Christmas party may involve names and other private details.

Finance will see different risks from marketing. HR will see different risks again.

That does not require an enormous data-classification exercise, but people do need enough guidance to recognise when the information or the consequence demands more care.

The same applies to the output.

A slightly peculiar AI-generated image may be embarrassing.

A recommendation that affects jobs, customers or a significant amount of money requires something more.

The goal is to know when individual judgement is enough and when the consequence requires another level of sign-off.

Sometimes that means an editorial read.

Sometimes fact-checking.

Sometimes another person needs to review the work before anything happens.

The same expectation should extend to agencies, contractors and other people working on behalf of the business. The useful question is not simply whether they used AI, but whether the work received the level of assurance its consequence deserved.

The higher the consequence, the stronger the human check.

That still leaves room for mistakes.

A business needs enough maturity to hear that something went wrong, correct it, learn from it and distinguish between a harmless experiment, poor judgement and a genuine breach.

If clear rules existed and somebody ignored them, that matters.

If there were no rules to begin with, that matters too.

AI may have helped produce the work.

Responsibility has not disappeared.

Somebody needs to keep an eye on what is changing

One of the awkward things about AI arriving inside existing software is that the picture will not stay still.

A feature appears.

A licence changes.

An update adds something new.

Months later, the software may be doing things nobody in the business knew were available.

That makes managing AI less of a one-off exercise and more of a small operating rhythm.

One practical option is to have someone within each part of the business who is curious enough to keep an eye on what is changing.

Not the AI expert.

Not the approver.

Not the evangelist.

Just the person who notices that a new capability has appeared, spends ten minutes working out what it might mean for the team and brings that information back into the conversation.

That role also connects naturally with learning.

People need somewhere to share what they have discovered, what worked, what did not, and whether a new capability is worth spending more time on.

Renewal is another useful checkpoint.

• What changed?
• What did we use?
• What created value?
• What are we paying for but not using?
• What should stay?
• What has become duplication?

The point is not to inspect every software release with a magnifying glass.

It is to stop useful capability, extra cost and changed risk quietly accumulating in the background.

Somebody still needs to decide what matters

Who gets to decide?

This is where things become less tidy.

The person holding the budget may think the decision belongs to them.

The team using the software may have a very different view.

IT may be responsible for security, integration and support.

Procurement may care about contracts and supplier terms.

Leadership may be looking for value.

And an owner or board may have a strong view about how much opportunity or risk the organisation should be prepared to take.

It is unlikely that one person should decide everything.

The person controlling the technology is not automatically the person who should decide whether the business use is worthwhile. Equally, the person who wants the capability may not be the right person to decide whether the security or commercial terms are acceptable.

• Business can judge value.
• Technology can judge safety and supportability.
• Finance or procurement can judge the commercial arrangement.
• Leadership, owners or a board can set appetite and boundaries.

One board may actively want management to explore AI because it sees strategic value.

Another may be much more conservative about privacy, reputation or risk.

Neither position is inherently wrong.

The problem comes when nobody has articulated the position at all and individual teams are left to invent it for themselves.

Managing AI is an operating habit

None of this requires a giant AI governance machine.

For many businesses, managing AI may be much simpler.

• Know what is already there.
• Know what people are actually using.
• Give people enough room to learn.
• Be clear about the information and decisions that need more care.
• Match the level of checking to the consequence.
• Keep an eye on cost, value and change.
• And make it clear enough who decides what.

That is more than a list.

It is an operating habit.

The business may not have chosen when AI first entered the building.

Some capability will continue to arrive through software updates, licence changes, employees and supplier workflows.

Other capability will still be adopted deliberately through use cases, pilots and planned investment.

Those are two different conversations, and both matter.

The mistake is assuming that because nobody formally decided to adopt AI, there is nothing yet to manage.

For many businesses, the better question is now:

What is already happening, and are we managing it deliberately?

What happens next is still a choice.