Your employees are already using AI. Do you know what they’re sharing with it?
Most leadership teams have already had the AI conversation. Someone has tried Copilot. A producer has a ChatGPT tab open. A designer has used Firefly or Canva. An account manager has let a meeting assistant join a client call.
That is not the problem. The problem is that the organisation cannot say, with any confidence, what was pasted into those tools.
What actually gets shared
In an agency it is rarely a dramatic leak. It is a brief, a set of customer names, a draft of a campaign that is still under embargo, a spreadsheet of performance, or a recording of an internal argument about a client. Each of those is ordinary work. Each of them can also be client information, personal data, or something a contract said would stay inside named systems.
Free and personal accounts make this harder to see. There is no procurement record, no central licence, and often no log. The person who used the tool may not know whether the supplier keeps the prompt, uses it to train a model, or stores it in another country.
What to find out first
- Which tools people are actually using, including the ones nobody approved.
- Which of those tools are on personal accounts.
- What kinds of client or staff information are being pasted in.
- Whether the supplier’s terms allow them to retain or train on that information.
- Whether a current client contract forbids it.
A policy that says “do not put confidential information into AI” does not answer those questions. It only gives people a sentence to ignore. An AI register, a short list of approved tools, and a clear rule for client material will do more. The first step is still the same: find out what is already happening.
A sensible first month
You do not need a monitoring product to start. You need a named owner, a list of the tools people will admit to using, and a rule for client material that a producer can follow on a Thursday afternoon. ChatGPT, Microsoft Copilot, Claude, Gemini, Adobe Firefly, Canva AI, Grammarly and the meeting assistant are the names to put on that list. “Generative AI” is not specific enough to manage.
Watching what people type into those tools is a later decision. It is only useful once you know which services are approved, and once the monitoring platform itself has been chosen and tested. The governance comes first. The technology should follow it.
If this is the question already sitting with you, a conversation is the useful next step.