Unapproved employee AI use is nearly universal and mostly well-intentioned - people trying to work faster. The right response is not a ban. It is a one-page policy, approved business-grade tools, and an owner people can actually ask.
Roughly half of smaller companies have no AI-use rules at all, per Pax8 research, while adoption runs ahead of policy in nearly every survey taken. Bans do not work; they just push use onto personal devices where you cannot see it. What works is making the sanctioned path easier than the shadow one.
That means approved tools on business plans with data protections, a short list of what never goes in, and a named person for the gray areas. Draft it yourself from the four questions, or leave a half-day session with it done: Write Your AI Ground Rules, $1,200.