Most Organizations Cannot Fully See Their AI Exposure
When one mid-size company finally sat down to list where AI was being used across the business, the list that came back was about three times longer than the one leadership had expected. A free transcription tool sitting in on customer calls. A browser extension half of the sales team had installed. A marketing contractor running everything through a model the company had never heard of. None of it was hidden, exactly. It had simply never been counted.
That gap, between the AI you know about and the AI that is actually in your operation, is the quiet subject of this piece. It is more common than most leaders would guess, and it is usually nobody’s fault in particular.
How the picture drifts out of date
AI use rarely arrives through a tidy rollout plan that flows down the org chart. It spreads sideways, through individuals quietly solving their own problems with whatever tool helps. So the map of where AI lives never quite matches reality, and it drifts a little further every month.
The result is a familiar kind of blind spot. Most leaders are genuinely confident about the slice of AI use they approved, and almost entirely unaware of the rest. The counterintuitive part is that the exposure that matters most is rarely the official AI project everyone is watching. It is the small, sensible, unsanctioned uses that each looked harmless on their own.
Why visibility comes first
You cannot oversee what you cannot see, and you cannot see what you have never counted. This is not a dramatic claim, just a practical one. Every other sensible step depends on it. A policy assumes you know where the activity is. Training assumes you know who is doing what. Any review at all assumes you can find the thing being reviewed.
It helps to picture your AI exposure as a surface with a visible centre and a much larger, dimmer edge.
The bright centre is the part you approved and can describe. The faint outer ring is where most of your real exposure sits, and it is wider than the centre by a long way in most organizations.
Where this goes wrong
• Treating “we have an approved tool” as the same thing as “we know our exposure.” The approval covers the centre, not the edge.
• Mapping it once and filing the result away. The picture moves, so a snapshot from last quarter is already part fiction.
• Going straight to a crackdown. The fastest way to lose visibility is to punish the first people honest enough to tell you what they use.
• Counting only standalone AI tools and missing the AI quietly baked into software you already pay for, which is now most of it.
Practical first steps
The good news is that the first move is cheap and mostly conversational.
• Ask before you audit. A blameless “what do you actually use, and for what” conversation surfaces more than a technical scan, because the riskiest use is often the most informal.
• Look at the edges on purpose: contractors, vendors, browser extensions, and features inside tools you already have. That is where the surprises live.
• Treat the picture as a living one. Re-check on a rhythm rather than once, and date what you find.
• Make disclosure safe. People hide what gets punished and share what gets thanked, and your visibility depends entirely on which of those they expect.
You cannot oversee what you have never counted, and most organizations have never counted.
Worth sitting with
If I had to list every place AI touches our work, how confident am I that the list would actually be complete?
Where might people be using AI sensibly but quietly, because telling us has never felt safe or worth the bother?
Are we measuring our AI use, or only the part of it we happened to approve?
Seeing clearly is not a one-time exercise, it is a habit of looking, kept up gently over time. If this resonates, Project Risk Isn’t the Enemy – Not Seeing It Is makes a related point worth borrowing, and the AI-oversight material in Compass is a good next stop when you want to turn looking into something repeatable.
