Lunch break. Your personal AI account, open in a personal browser window. You paste in the email thread, get the summary you needed in thirty seconds, close the tab, and quietly hope nobody ever asks how you turned that around so quickly.
If that sounds familiar, you're in the majority, literally. PagerDuty's 2026 survey of 1,250 office professionals found that two-thirds had used an AI tool at work despite believing it wasn't permitted. KPMG's global study of more than 48,000 people found 57% of employees hide their AI use from their employer and present the work as their own. And only about 40% of workplaces had any policy on it at all.
So the question usually isn't whether people use AI at work. It's whether they're one awkward meeting away from a problem. Here's the above-board version, the one that ends with a yes in writing.
The risk isn't the AI. It's the setup.
Three things get people in trouble: an unapproved tool, a personal account, and the wrong data pasted into it. Notice that "used AI" is not on the list. Almost every workplace horror story is about company or customer information sitting on a server nobody vetted, under an account nobody approved. Fix the setup and most of the risk goes with it.
First, find the policy, or find out there isn't one
Read whatever your workplace has: the handbook, the IT acceptable-use page, the email from last year everyone ignored. If a policy exists, it tells you exactly what to ask for. If none exists, the common case, that's not a loophole, it's an opening: the first person to propose sensible rules usually gets a friendly hearing, because somebody has to write them eventually.
Know your data lines before you ask
Sort what you handle into three buckets, in writing:
Fine: public information, your own drafts, material with no names or numbers attached.
Ask first: internal documents, plans, anything your team would not post on the website.
Never: customer data, contracts, unreleased numbers, anything regulated, never into a personal account, no exceptions, no "just this once."
The "never" bucket is what makes the rest of your proposal believable. You're not asking to paste the company into a chatbot. You're asking for the boring 80%.
Write the one-page ask
One page, five things: the tool you want to use (the business or approved version, if one exists), the jobs you'll use it for, what data goes in, what data never goes in, and the guardrails you're offering, an approved account, a 30-day trial on one task, and a short report back on how it went.
Then offer the small start. Nobody sane approves "AI for everything, forever" from a cold email. Plenty of managers approve "let me summarize meeting notes with this for a month and show you the result." (Yes, you can ask your AI to help draft the request. That's rather the point.)
You're not asking to paste the company into a chatbot. You're asking for the boring 80%.
Compliance and IT get cast as the people who say no. Their actual job is to keep the company out of trouble, and a bounded proposal with data rules is the thing they wish people brought them, instead of the thing they usually get, which is a discovery.
Make the first use visible and boring
Once you have the yes, use it where people can see it: the summary, the first draft, the report formatted before the meeting instead of after. Bring the result to your manager before they hear about it from anyone else. You want to become the person who brought AI in properly, the reference case, not the cautionary tale. Keep the approval, stay inside the scope you agreed, and if the scope grows, ask again. The trail is the protection.
And if they say no?
A no to customer data on a personal account is a reasonable no, accept it and ask what version would pass: an approved tool, different data, a smaller trial. A no to everything is information too. The skills don't expire. They transfer, to the next role, and to anything of your own you're building at home, where the only compliance department is you.
That's how we run our own operation, incidentally: written rules, a short list of things the AI never touches, approvals on anything that sends or spends, and the whole working published on our live operating report. The gates aren't the opposite of getting things done. They're what makes it safe to let the AI do more next month than it did this month.
We can't promise you income. We can show you exactly how we're building ours, live.
Tonight's step costs nothing: find out whether your workplace even has an AI policy. Most people who worry about this have never actually looked.