A colleague at Holly Hunt asked me if his team needed to stop using ChatGPT.
Not because it had done anything wrong. Not because anything had leaked. He asked because it wasn’t the sanctioned tool, and he is a conscientious person, and conscientious people notice when the thing they use every day is not the thing on the approved list. He wanted to do right by the company. He came to me expecting to be told to knock it off.
I told him to keep using it.
The condition was the only part that mattered: no company-confidential data goes into it. Not customer pricing. Not unreleased product. Not the stuff that would make a competitor’s quarter. Beyond that, if the tool works for the way your brain works, use the tool. I care enormously about what leaves the building. I care very little about which logo is printed on the window it leaves through.
This sounds like permissiveness and it isn’t. It’s the opposite: a much stricter question, applied to a much smaller number of things.
While that conversation was happening, another one was running in parallel, and the second one is the reason I’m writing any of this down.
A colleague of mine runs product launches. Real ones, the kind with competitive strategy in the deck, the kind where knowing what we’re doing six months early would be worth actual money to someone who is not us. He noticed something in his meetings. Not a rogue employee. Not shadow IT. Bots. Third-party AI note-takers, joining calls, sitting quietly in the participant list, transcribing everything.
His words, and I’ve kept them because they’re better than any way I’d say it: “we’re seeing a lot of Fireflies and Read.AI on new product launch meetings as well, which is a major concern since those meetings contain our competitive product strategy. I’m now including ‘NO AI RECORDERS’ in my Housekeeping slide.”
A housekeeping slide. That’s where we were. A polite bullet point, in the deck, before the agenda, the corporate equivalent of a sign on the break room fridge asking people to label their food.
Three months later I got the update: “We’re now ninety days plus into reinforcing the ‘no bots’ rule and they’re persisting.”
Ninety days plus. Not a policy gap. Not an enforcement gap. A physics problem. Because here’s the part that makes it interesting instead of just annoying: the bots were largely not ours. They rode in with external partners and dealers. Someone at another company, doing their job well, using a productivity tool their own employer approved, joins our meeting with their assistant already attached. Their assistant is now taking notes on our roadmap. Nobody broke a rule. Everyone was being helpful. The roadmap walked out the door anyway, in a transcript, to a vendor we have no contract with, on servers we’ve never audited.
So set them side by side.
In one case, an unapproved tool, used by a careful person, containing nothing that would hurt us. In the other, a tool nobody at MillerKnoll chose, invited politely into the room by a guest, quietly hoovering up the exact thing we spend the most money protecting.
Approval status predicted neither outcome. Not once. Not close.
We like tool bans. Tool bans are wonderful. They’re visible, they’re fast, they photograph well in a governance update, and they let you point at a specific object and say we handled it. I have watched grown organizations spend a quarter deciding whether an app goes on a list, and I understand the appeal, because a list is finite and a list is done.
Data classification is none of those things. It’s boring. It’s invisible. It requires you to make people care about the difference between confidential, internal, and public in a way they can recall at 4:40 on a Thursday while pasting something into a box. It never finishes. Nobody gets promoted for it.
It is also the only one of the two that’s load-bearing.
And I’d guess you already know which one gets funded.
There’s a further wrinkle, and it’s the one that should keep the tool-ban people up at night: the control panel is partly a fiction.
Roughly sixty percent of our Copilot footprint runs through Copilot Chat. Copilot Chat was never procured. There was no evaluation, no signature, no rollout plan. It arrived. And it cannot be disabled at the tenant level, which means the majority of our AI usage sits in a tool that no one bought and no one can turn off.
Sit with that for a second, because it dismantles the whole mental model. The governance conversation assumes a switchboard: tools on one side, switches on the other, and a responsible adult deciding which ones are up. But the switch for the biggest thing on the board does not exist. It was never installed. We have been having strategy meetings in front of a panel where most of the toggles are painted on.
If the tool layer can’t hold the weight, the weight has to sit somewhere. It sits on the data. What is this information, who can see it, what happens if it ends up somewhere I didn’t intend. Those questions survive contact with reality. They also survive whatever gets released next month, which is the part I find genuinely reassuring, because the tools are going to keep arriving whether or not we finish the meeting.
One more thing, for anyone who thinks this is a preference of mine rather than a direction the world is already moving.
The EU AI Act’s Article 4 AI literacy obligation went live on February 2, 2025. Which means “train your people” stopped being a nice idea somebody in enablement keeps bringing up and became a legal requirement with a date attached. Deployers also have to inform worker representatives before putting high-risk AI into the workplace, and in several European countries that is a works council conversation, with a table and chairs and people who will ask you hard questions.
Which makes this culture and change work at least as much as it is legal work. You cannot classify your way out of a room full of people who don’t understand what the system does. And I’ll admit I find a small, mean satisfaction in that: the softest part of the job, the part that gets described as the nice-to-have, is now the part with a statutory deadline.
Here’s what I keep turning over. My Holly Hunt colleague came to me unprompted, worried he was doing something wrong, ready to give up a tool he liked. Nobody in that meeting with the note-takers came forward, because nobody in that meeting was doing anything wrong.
We spent the quarter governing the conscientious guy. He was never the exposure. He came to us.