Half your staff are using AI behind your back, so is your CEO and the ban was never going to work.

The waiting room

Three or four months ago I found myself in the waiting room of an out-of-hours clinic, there in a supporting role… a six-year-old girl we were with was being assessed for a suspected urinary tract infection. The early part moved quickly, a urine dip test done within twenty minutes and the result handed to us while we waited for the doctor, so the system had the information it needed… what it did not have, that evening, was capacity, and the wait to see the GP ran to nearly four hours. Four hours is a long time to sit holding a piece of paper with the answer written on it.

So I did something that would have been impossible a couple of years ago: I photographed the dip test, added some context about the symptoms, and asked an AI model to interpret it. The response was measured… the most likely explanation, the treatment that would normally follow… less like magic, more like a well-read colleague giving a quick second opinion. Hours later the GP’s diagnosis matched, we left with a prescription and assumed that was that… until two weeks later, when the infection came back. The diagnosis had been right, the prescription had not, and another round of attention sorted it.

What stayed with me was not that the AI got it right… one anecdote proves nothing, and healthcare is complicated for good reasons… but how casually that extra layer of interpretation had appeared. Not part of the official system, no permission asked, it simply happened because the information was in my hand and the tool was in my pocket.

The pattern

When a new tool shortens the distance between information and interpretation, institutions don’t adopt it first. Individuals do. Quietly, without permission, and usually while the official policy still says no.

To the person doing it, it is not adoption at all. It is just a better way of answering the question in front of them. A quicker way to test an assumption. A sanity check while the formal process catches up.

We have watched this happen before. Spreadsheets spread through finance departments long before anyone sanctioned them. Email and the web arrived inside companies through unofficial modems and side projects, because users spotted the advantage in about a week and their organisations took years to catch up. Cloud software crept in through individual subscriptions, and by the time IT noticed, it was everywhere. AI is following the same path, faster.

The ban

What makes this round different is that organisations are not just slow. Plenty of them are actively holding the line, and the line is absurd.

I recently sat through teacher training that opened with a stern warning: no AI. What followed was several thousand words of academic theory to absorb, repetitive question boxes to fill in, and nowhere near enough time to do either. And the work was never assessed. Not marked, not read, not checked. So the actual choice on offer was to work yourself into the ground on an exercise nobody would ever look at, or to have AI digest the articles and draft the answers.

Here is the irony. The AI route was the better learning. I’m dyslexic, so dense academic prose at that volume is a wall for me, but frankly nobody could have taken in that much material at that pace. Getting a model to process it, then interrogating it until I understood, was the only way to genuinely absorb any of it. The people who followed the rule got less from the training than the people who broke it.

That is what a ban buys you. It does not stop the behaviour. It just guarantees the behaviour happens without guidance, without safeguards, and without anyone learning from it. Prohibition has a terrible record against tools that obviously work, and everyone under forty can see they obviously work.

The gap

The mechanism underneath is simple. Institutions optimise for safety, reputation and consistency, so their incentives favour caution and process. Individuals optimise for the problem in front of them.

In that waiting room, the system had already done most of the important work. The child had been triaged. The test had been performed. The information existed. What remained was interpretation, and interpretation was four hours away.

That gap, between having information and receiving an answer, is exactly where new tools enter a system. Not through policy. Not through formal integration. Through small acts of improvisation by people who happen to have the data and the tool in front of them at the same moment.

Once you notice it, you see it everywhere. Developers drafting code with AI before reviewing it properly. Analysts summarising reports before writing their own conclusions. Trainee teachers quietly feeding the reading list into a model. The mechanics get delegated. The judgement stays with the person directing the work, which is where the value sat all along.

Already adopted

So the interesting question about AI adoption is not whether organisations will adopt it. They will. The interesting question is how much adoption has already happened while the policies were being written.

The numbers are starting to arrive. A survey reported by CIO found that roughly half of employees are using AI tools their employer has not sanctioned. And the worst offenders are not junior staff working around the rules. They are the leadership, with around seven in ten C-suite executives saying the speed is worth the security risk. Meanwhile an MIT-led study of S&P 500 filings found AI deeply embedded in operations at just 11% of firms. Half of individuals. A tenth of institutions. That is the gap, measured.

Adam Graham picked up the same finding in his newsletter this month and drew the practical conclusion: you cannot ban behaviour people find this useful, you can only channel it. He is right, and the mechanism above is why. Nobody in those surveys was being reckless. They were answering the question in front of them.

And remember, my waiting room evening was months ago, on models that already look dated. The gap has only got shorter since.

Most technological shifts begin this way. Quietly, informally, slightly ahead of the rules that are supposed to govern them. By the time an institution formally adopts a tool, its people have usually been using it for years. The shadow arrives first. The org chart is the last to know.