06/04/2026
I keep hearing the same thing from IT directors lately. They don't have a clear picture of what AI tools their company is actually using.
Departments are adopting AI tools on their own, without going through IT, security, or legal. Note-takers recording client calls, redliners that learn from every contract they touch, prompt tools for content creation, forecasting extensions pulled from online recommendations. People are using them every day, but in most cases nobody in a governance role approved them or reviewed the terms.
The regulatory landscape is catching up fast. The EU AI Act is live, Colorado has passed its own AI law, and California is moving on theirs. SOC2 audits have started including AI governance language, and cyber insurance renewals are asking questions that didn't exist a year ago.
I look at this from the contract layer. Every one of those AI tools lives inside a contract somewhere. Data processing terms, IP ownership of outputs, indemnification language, training data clauses buried deep in the agreement. Most companies can't tell you which vendors are running AI on their data, because the contracts were signed before anyone thought to ask.
The companies I see handling this well already had their contract and vendor records in order before any of this started. They know what they signed and what their vendors can and can't do with their data. When a regulator or auditor asks a question, they can pull the answer in an afternoon instead of scrambling for a quarter.
For everyone else, the gap keeps getting wider. Every new tool adopted without proper review adds another contract with unexamined terms and another vendor with untracked data access. That kind of exposure adds up quickly once someone with authority starts asking questions.