Picture a mid-sized manufacturer whose leadership team made a sensible call a year and a half ago: let people experiment with AI and see what sticks. It worked. Sales began drafting proposals in half the time. Finance used AI to turn month-end numbers into clear commentary. Operations summarized shift reports before the morning meeting.
Then, during this year’s planning session, the COO asked a simple question: where does all of that actually run?
No one had a complete answer. Proposals went through one tool, financial commentary through another, shift reports through a third. Each ran on a different vendor’s servers, under terms no one had read closely, paid for on a handful of company cards. Nothing had gone wrong. But the company’s pricing, its numbers and its hard-won operating know-how were spread across systems it didn’t control.
That’s the conversation in front of leadership teams now. Their people are already getting real value from AI. The open question is whose AI it is, and who controls what goes into it. The answer decides what AI really costs, how well your data is protected, and what you can build next.
AI use grew up faster than the setup around it
The first wave of workplace AI happened from the ground up. People found tools that saved them time, teams picked their own favorites, and policy tried to keep pace. That was a reasonable way to start; moving quickly beat waiting for a perfect plan.
But the setup it left behind wasn’t designed by anyone. In a global study of more than 48,000 workers across 47 countries, KPMG and the University of Melbourne found that 58% of employees intentionally use AI at work. Only 40% said their workplace has a policy or guidance on generative AI. And 57% said they hide how they use it.
That’s not a discipline problem. It’s a structure problem. Your people have already shown where AI helps. The opportunity now is to give that work the foundation it deserves.
Whose AI it is decides where your data goes
Think about what people put into AI every day: contract language they want simplified, a customer list they want cleaned up, a strategy document they want summarized, a pricing model they want checked.
Each of those lands in a tool with its own terms, its own storage and its own idea of what happens next. Spread that across dozens of tools, and you can’t see what was shared, log it, or get it back.
The cost is showing up in the numbers. IBM’s 2025 Cost of a Data Breach Report found that one in five organizations reported a breach tied to unapproved AI use, often called shadow AI. Organizations with high levels of it saw an average of $670,000 more in breach costs. Only 37% had policies to manage AI or detect unapproved use.
There’s also an opportunity cost that’s easy to miss. The most valuable thing AI can work with is your company’s own knowledge: your documents, your data, your know-how. When AI is scattered across tools you don’t control, you can’t safely put that knowledge to work. The organizations that pull ahead will be the ones that own the place where AI meets their knowledge.
Policies and approved-tool lists only go so far
Most organizations have already taken the first round of steps: a usage policy, a list of approved tools, maybe a block on a few sites. Those were sensible moves. They just aren’t enough on their own.
A policy tells people what not to do, but it doesn’t change where your data goes. Blocking tools pushes use out of sight instead of stopping it. And standardizing on one outside AI vendor is a real improvement over sprawl, but where AI runs, and on whose terms, still sits with that vendor.
What’s missing is the platform itself, one you own and run on your terms. (We’ll dig into governance people actually follow in an upcoming article.)
An enterprise subscription isn’t the same as owning your AI
For many organizations, the logical next step is to upgrade to the enterprise edition of a popular AI tool. Those products have real strengths: admin controls, single sign-on, usage reporting and a commitment not to train on your data. For plenty of teams, they’re a big step up from a patchwork of personal accounts.
But look closely at what “under your control” means there. You control the settings. The vendor controls the infrastructure. Your prompts, files and company knowledge are processed in the vendor’s cloud, under the vendor’s terms and on the vendor’s roadmap. The difference isn’t how well the platform is secured. It’s where it runs and who operates it.
That’s the difference between AI you manage and AI that runs in your own environment:
| Enterprise AI subscription | AI in your own cloud environment | |
| Where your data goes | To the vendor’s cloud | Stays in your environment |
| Security and governance | Managed in the vendor’s environment | Works within the security and governance controls you already have |
| Who holds the activity logs | The vendor, with exports available to you | You |
| Which AI models you use | The ones the vendor offers | Your choice, as models improve |
| If the vendor’s terms or pricing change | You adapt or migrate | Your setup stays put |
That security difference matters more than it might seem. When AI runs in your own environment, it works within the identity, access, network and compliance controls your teams have already built and audited. There’s no new perimeter to evaluate and no separate set of rules to keep in sync. When your data, your regulatory obligations or your competitive know-how are on the line, owning where AI runs is the point.
A better answer: one front door to AI
The next step is to treat AI like any other core business system: something you own, run and govern on purpose. And it has to be better than what people use today, so it becomes the easy choice.
Picture a single, approved front door to AI for your whole organization. From where you sit, it changes three things:
- Your data stays under your control. When AI runs in your own cloud environment, your data, prompts and company knowledge stay inside your walls instead of passing through someone else’s.
- You can see and shape how AI is used. You decide who has access to what, set the rules, and learn where AI is actually helping.
- One platform replaces the patchwork. Instead of a dozen scattered subscriptions, you have one place to manage, secure and support.
For your people, it isn’t a restriction. It’s the AI they already rely on, with the green light to use it in the open, even on the work that matters most, because company knowledge can be used safely.
That’s the shift: from AI that grew up around you to AI you own.
Where to start
You don’t need a finished AI strategy to move forward. Three questions will tell you a lot, and most leadership teams can answer them this quarter:
- Where does our AI run today, and under whose terms? List the tools in use and what each one’s terms say about your data.
- What company knowledge should AI be able to use? The biggest gains come when AI can work with your own documents and data. Decide what that should include, and what it would take to do it safely.
- Who owns AI as a capability? Not a single tool, but the platform, the rules and the roadmap. If no one owns it, your vendors will decide for you.
The answers will show you how much of your AI you really own, and what it will take to own the rest.
Your AI, under your control
Your team already runs on AI. What’s still up to you is whose AI it is, and whether your company’s data and knowledge stay where they belong.
That’s why we built AnthmAI. It gives your organization one front door to AI, with the governance, knowledge and automation to put it to work safely. And it runs in your own cloud environment, so you stay in control. It brings years of hands-on AI work at Mutually Human into a platform your team can use every day.
If you’d like to see what that could look like for your organization, let’s talk.
