A managing partner can name the one AI tool the firm approved last year for client communications. One of the associate teams has been pasting client documents into a free chatbot account for months because the approved tool never handled the formatting the work needs, and no one raised it because no one asked. The original policy never accounted for any of this, since it was written before the associates found their own way around it. Multiply that across every team in the firm, and what leadership believes is happening and what people do at their desks each day keep drifting further apart.
ISACA’s 2026 AI Pulse Poll, from the global association for governance and audit professionals, found that only 38 percent of organizations now have a formal, comprehensive AI policy, up from 28 percent the year before, and a quarter still have nothing in place at all. People started using these tools well before anyone wrote the rules for them, which means a policy built on an assumption about how staff work will always trail behind, because whoever is writing it hasn’t looked closely at how AI gets used across the firm they’re writing it for.
What people use tells you more than what was approved
A useful audit starts with a plain account of what people use and why, set against what the firm approved on paper, and that comparison shows how far working habits have already drifted from the written rules. Some of the tools involved earned their place almost by accident, the kind where someone needed to summarize one long document, found something that worked, and kept using it. That’s fine on its own, right up until five people are solving the same problem five different ways, each paying for a separate subscription, with none of them aware the other four exist.
The tools that earned a real place in daily practice look different from the ones that survived only because no one looked closely, and the audit is what tells them apart.
Deliberate choice beats convenience, even when convenience costs less upfront
If five people picked five different tools for the same kind of task, the instinct might be to ban four of them right away, but it pays to find out why the differences exist first. One firm can reasonably run two or three tools side by side for different jobs, each one integrating with a different system or suiting a different kind of document in ways no comparison chart would show you. Reliability counts too, since a tool that produces a different standard of output from one week to the next is harder to build good habits around, whatever it costs. The test for each surviving tool is straightforward; someone needs to be able to explain why it earned its place.
Subscription sprawl adds up fast, even when each individual tool feels cheap on its own. Flexera’s 2025 State of ITAM Report found that SaaS waste increased for 35 percent of the organizations it surveyed over the past year, largely from subscriptions that overlapped and were never rationalized. The FinOps Foundation, which sets standards for managing technology spend, recommends mapping every application to the job it does and consolidating wherever two tools serve the same purpose, guidance that applies to a ten-person department picking between three note-taking apps as much as it does to a much larger organization managing hundreds of licenses.
Rules only work when people know where they apply
What kind of information is fine to put into an approved tool during routine work, and when a task needs a person to check the output before it reaches a client, covers most of what comes up in practice. A firm that tells associates which tool to use for drafting client correspondence and which tasks still need a partner’s review before anything goes out has covered most of what an AI policy needs to do, and the rest comes down to making sure people know who to ask when something new comes up, so the policy never has to predict every situation in advance. Drafting an internal email and preparing something for a client aren’t the same job, and a policy that treats them the same way often gets ignored on one side or the other.
A policy needs someone responsible for keeping it current
Someone at the firm should hold this job, understanding how AI gets used across departments and deciding when a new tool earns a place on the approved list, so staff have somewhere to bring what comes up as new tools surface instead of guessing on their own. The role is about keeping pace with how the firm’s AI use keeps changing. No one needs to review every prompt someone types.
How often it gets reviewed should track how quickly AI use is changing. A firm where adoption is still moving fast may need to look at the policy more than once a year.
An AI policy built this way turns from a document signed once and filed away into a method for staying ahead of how AI use keeps shifting, grounded in what people do at their desks each day.
Some firms haven’t started any of this yet, and for them the exposure runs deeper than cost or inconsistency, which is where this argument goes next.
Firms in the DMV region working through this stage are welcome to bring their questions to BASE Solutions. We work with professional services firms on this kind of decision, and the earlier a firm looks at how AI fits into its wider technology strategy, the fewer tools there are to unwind later.
