Someone on your team wants to use an AI tool. How do you decide?

Your operations lead sends a message on Friday afternoon. She wants to use a new AI tool to summarise client calls. It costs $30 a month. She needs an answer.

Most owners answer this on instinct. That instinct is usually wrong in one of two directions.

The two ways owners answer this badly¶

The first is the rushed yes. It sounds reasonable, it is cheap, the person asking is trusted. Six months later that tool holds two years of client conversations and nobody can say who else has access.

The second is the reflex no. Safer, apparently. It is not.

An owner can say no to three tools in a row and believe their exposure is zero. It is not. The tools are in use. The requests have simply stopped.

What data goes in, and who else can see it¶

Start here, because everything else follows from it.

• What business data actually goes into this tool? Client names, financials, contracts, health information, anything under a confidentiality clause?
• Who else can see that data? The vendor, their subprocessors, or a training pipeline?
• Is any of it covered by an agreement you signed with a customer?

If the honest answer to the first question is "nothing sensitive," the rest of this gets much shorter. Most requests are that. Say so and move on.

What happens if the tool disappears or doubles its price¶

AI tools get acquired, shut down, and repriced faster than most software. Ask two questions.

1. If this vendor vanished tomorrow, what work stops? A drafting aid is an inconvenience. A tool holding your only copy of something is a problem.
2. Can you get your data out in a usable format?

A 22-person accounting firm ran client onboarding notes through a summarising tool for eight months. The vendor tripled its price at renewal. Export was a paginated web view, no bulk download. They paid for three more months while someone copied 400 records out by hand.

That was not a security failure. It was a continuity question nobody asked at $30 a month.

Does it duplicate something you already pay for, and who owns it¶

Check the stack you already have. Microsoft, Google, and most practice management platforms have shipped AI features you are likely already paying for. Duplicated spend is common and quietly expensive.

Then, the question that gets skipped: if the answer is yes, who owns this tool?

Someone needs to hold the login, the renewal date, and the decision to keep using it. No named owner means no renewal review and no offboarding when that person leaves.

A flat no does not stop the tool being used¶

This is the part I want owners to sit with.

A flat no does not remove the tool from your business. It removes your visibility of it. The person still has the deadline that made them ask. They will use a personal account, on a personal card, outside anything you can see or audit.

You have not reduced the risk. You have moved it somewhere you cannot look at it. If you want to know what is already running unapproved, that is a separate exercise worth doing.

What a good conditional yes looks like¶

Four lines. Written down, sent back to the person who asked.

• Approved for: call summaries for internal use.
• Not approved for: client financial data, signed contracts, anything under NDA.
• Owner: Sarah. She holds the account and reviews it at renewal.
• Review date: 90 days from today.

That takes five minutes. It gives the person a real answer, keeps the work in the open, and gives you something to review before it becomes permanent by default. If you find yourself writing the same four lines repeatedly, the boundaries belong in one place instead.

Keep exploring¶

If you want a clear view of what your team is already using and where the real exposure sits, contact FIT and we will walk through it with you.