Before you write an AI policy, ask the people already using it.

Somewhere in your organisation, right now, someone is pasting a real document into a chatbot they pay for themselves. They are not being reckless. They are being efficient. And almost nobody has asked them what they're doing.

We could see the shape of it from our own telemetry: roughly 150 active AI users on company hardware, well beyond the digital team. ChatGPT doing the heavy lifting, with a spread across Claude, Gemini and Adobe Firefly. The national picture says the same. Netskope found 47% of people using generative AI at work do so through personal or unmanaged accounts. Microsoft puts "bring-your-own-AI" at 78% of AI users. This is not a pilot waiting for sign-off. It already happened.

Ask, don't police.

The instinct in most businesses is to reach for a policy. Write the rules, restrict the tools, move on. But you cannot govern what you do not understand, and a policy written in the dark tends to ban the wrong things while missing the real risk.

So we went the other way. Before regulating, we wanted to listen. A short, anonymous workforce survey aimed at the people outside the digital team, built to surface five things: what they're using, how they're using it, how it helps them, how it benefits the day job, and what value it actually brings.

The design has one quiet trick. Nobody answers "yes, I share sensitive data" when you ask them directly. So you don't ask directly. You ask what kinds of content they typically paste in, and what they do when a task involves real company data — framed as workflow, not interrogation. Make it anonymous, and people tell you the truth.

The tool that measures our AI usage was itself built by AI — while I was looking the other way.

I handed the build to an agent.

Here's the part that still feels slightly absurd. The whole AI-adoption programme lives in a workspace I've been feeding for months — context layered over time about each work package as I've shipped it. So I didn't brief a person to build the survey. I briefed the agent.

It had no direct line into our forms platform, so it did what a capable colleague would: it opened a browser, drove the form builder's own AI to generate all twelve questions, then went back and fixed what mattered. It caught that responses were set to record names — which would have quietly killed the honesty the survey depended on — and switched it to anonymous. It added a closing thank-you. It left the distribution to me.

Total time: about fifteen minutes. I watched it happen in a side window while I was in a meeting about something else entirely. The deliverable was sitting there, ready for review, by the time I looked back. That is the shift worth noticing: agentic AI is no longer just drafting text in a box. It is operating your actual tools, on your behalf, to a standard you'd accept from a junior analyst.