Bring Your Own AI: How to Balance Risks and Innovation

Since ChatGPT’s debut in late 2022, employees have continued to find new ways to tap into the power of generative artificial intelligence (GenAI). For many individuals, GenAI tools have sped up the capability to create content ranging from text to video. For example, the tools can help people summarize meeting documents, generate ideas, and construct emails. Freely available Gen AI tools such as ChatGPT and Claude AI, and GenAI-enabled functionality now embedded in software from the likes of Microsoft and Adobe have fueled the growing use of GenAI tools inside and outside the workplace. Yet with this rise of GenAI comes a new challenge for organizational leaders: the phenomenon of Bring Your Own AI (BYOAI), which occurs when employees use unvetted, publicly available GenAI tools for work.

While these tools promise greater productivity and creative potential, they also bring organizational security and governance risks, including data loss, intellectual property leakage, copyright violations, and security breaches. This raises a critical question: Should leaders ban BYOAI to protect their organization from the dangers that GenAI tools present or embrace the tools and guide employees’ use to mitigate the risks and reap the potential benefits?

To get answers grounded in real-world lessons, the MIT Center for Information Systems Research conducted research with more than 70 data and technology executives representing 50 organizations between late 2023 and August 2024. (See “The Research.”) In this article, we’ll explore why banning is not the answer and how leaders can provide the proper guidance to turn BYOAI from a liability into an asset that drives beneficial GenAI capability building and innovation.

Banning GenAI Tools Won’t Work: Three Smarter Steps

Given the risks associated with BYOAI, it may seem logical for leaders to consider banning unvetted GenAI tools outright. The prospect of uncontrolled GenAI use, combined with the uncertainty around legal and regulatory exposure, can understandably make leaders cautious. However, the executives we interviewed said that banning BYOAI is neither practical nor effective. Employees — especially those already feeling stretched thin — often turn to GenAI tools to enhance their personal productivity. Restricting access only pushes them to find unofficial workarounds, potentially bypassing established governance frameworks. This can ultimately amplify the very risks leaders aim to mitigate.

Moreover, a ban will prevent employees from exploring new use cases, blocking opportunities for creative problem-solving and the discovery of potential efficiency gains across the organization. Consider these three steps instead:

1. Use a cross-functional leadership team to build specific guidance. Rather than ban BYOAI, leaders should focus on setting clear guardrails and guidelines that allow employees to responsibly experiment with GenAI tools. Convene a team of your organization’s technological, legal, privacy, and governance experts to craft policies on sanctioned and unsanctioned GenAI tool use. Create guardrails to outline which tools are acceptable and conditions that may apply. For example, a company may permit GenAI tool use when prompts draw on publicly available information but disallow use if prompts require company data, such as information about employees or involving internal systems. The guidelines should help employees navigate the related risks and understand the various consequences of using the tools.

These guidelines should not only mitigate risks but also help employees maximize the tools’ potential. For instance, the guidelines at OCP Group, a global provider of plant nutrition solutions and phosphate-based fertilizers, support the use of GenAI tools but also highlight their shortcomings — such as the tendency to lack context, exhibit bias, and occasionally present false or misleading information as fact. The guidelines raise potential concerns regarding ethics, transparency, and intellectual property when using such tools, and outline the organization’s best practices in areas such as data security, tool assessments, model output evaluations, and adherence to ethical standards.

2. Develop training and establish communities of practice. GenAI tools can be applied any number of ways — and it is your employees who will decide how. For employees to effectively leverage these tools, organizations will need to invest in developing what we call AI direction and evaluation (AIDE) skills. Employees need education before they can communicate well with GenAI tools and write useful GenAI prompts. Training should also cover the AI models that power GenAI tools, ethical and responsible use of AI, and how to critically judge the content that the tool creates, using your own knowledge of the task at hand.

While ubiquitous AIDE training might start with online learning modules or in-person workshops, the continuously evolving nature of GenAI tools’ capabilities requires ongoing learning through communities of practice. At Zoetis, a global animal health company, the data and analytics unit therefore organizes virtual office hours where employees can learn how to start using GenAI tools and ask questions: This helps people learn, improve over time, and build confidence. These meetings are held three times per week due to popular demand, with more than 100 employees joining each one. Advanced users can also join the monthly Data Science Forum, where employees with an interest in data science share use cases and experiences.

“Our goal is unprecedented productivity through deploying and adopting GenAI technology throughout Zoetis,” said J.D. Williams, the company’s chief data and analytics officer. “So we have our people learn how to change a tire by changing a tire. Don’t just read about it, but fire up your browser on a different screen and try the things we’re talking about. Over the past couple of months, we’ve had about 3,000 colleagues join these office hours, and when we polled them on whether the sessions have helped them achieve what they wanted to accomplish, over 70% of them agreed.”

3. Sanction a limited number of GenAI tools. To secure the business, organizations should offer a select number of sanctioned GenAI tools from trusted vendors. At the same time, it requires considerable time and effort to stay up to date on this ever-evolving tools market and compare product and pricing options, leaders told us. Our advice: Create a cross-functional team of people to evaluate tools and give feedback to IT on which tools promise real value.

To simplify access and optimize employee use, Zoetis has set up a GenAI app store, where employees can apply for tool licenses and learn about effective and responsible tool use. For each tool, this resource provides guides for getting started, training videos, recordings from previous virtual office hours, curated external insights on industry developments, and the organization’s AI and GenAI policies and guidelines. The organization also requests that employees who use the tools contribute “value stories” describing how they took advantage of a tool. This feedback helps the organization understand which tools create the most value for employees.

Personal Productivity Gains Versus GenAI Costs

Licensing GenAI tools from multiple vendors can quickly become costly once free trials and early-adoption incentives expire. It’s a significant investment to provide employees with access to these tools, and many executives struggle to make a clear business case to justify it. They can only show that many GenAI tools enhance personal productivity — enabling employees to complete everyday tasks faster and with less effort. For example, for work such as summarizing meeting notes or constructing slide decks, GenAI tools can shave minutes off many tasks.

“If GenAI tools can save the average employee 30 minutes a day, that’s good for the employee — particularly if you want to clock out at 6 p.m. But in the end it’s a productivity shave. The flip side is that you are dealing with processing, compute, and storage costs that offset these potential benefits,” says Ling Ling Lo, global head of data strategy and transformation and EMEA head, Group Data Office at Nomura, a Tokyo-based financial services company.

As these productivity shaves don’t typically result in (short-term) financial value for the organization, it makes sense to embrace BYOAI for specific tasks that don’t require the sharing of proprietary data.

For tasks that do, employees will need access to the organization’s limited set of sanctioned, enterprise-grade GenAI tools. While these tools won’t directly benefit the balance sheet, the value they provide — at least in terms of employee empowerment — is clear. GenAI tools give employees the freedom to explore new ways of working, test creative approaches to problem-solving, and take ownership of their productivity.

Moreover, in an era where burnout is common, tools that simplify routine tasks and improve efficiency can significantly reduce employees’ cognitive load. As such, GenAI tools serve as resources to help employees cope with job demands and proactively shape their work experience to their own needs — a process known as “job crafting.” This approach has been shown to result in greater job satisfaction, less job strain, greater engagement, and reduced turnover intention.1 While these metrics may be difficult to directly relate to the bottom line, they are crucial to an organization’s long-term success.

GenAI Tools Can Lead to Larger Solutions

Organizations can reap another benefit from BYOAI: Employee enthusiasm for GenAI can act as a catalyst for management attention, prompting leaders to think seriously about how AI can be integrated into their organizations. GenAI tools can similarly serve as a gateway to more financially lucrative, larger-scale GenAI solutions.

Unlike tools, which primarily enhance personal productivity, GenAI solutions address strategic business objectives and are designed to create value for key groups of organizational stakeholders through integration with processes, systems, and offerings — ideally at scale. For example, GenAI solutions can help legal teams that are evaluating contracts for regulatory adherence, learning teams that are producing training materials in multiple languages, and marketing teams that are hyper-personalizing customer interactions. These solutions create financial returns, helping teams increase productivity or grow revenue.

GenAI solutions are business case-driven, and therefore receive funding once they meet innovation criteria and show greater promise than competing opportunities in terms of end-user desirability, technical feasibility, and business viability. Employee use of GenAI tools can serve as a form of grassroots innovation, whereby employees can discover promising use cases that can later evolve into more formalized, scalable GenAI solutions. NN Group, an international financial services company, has for instance created a “GenAI playground” that employees primarily use to improve their personal productivity. Yet when these employees identify use cases with broader potential, they share their ideas with data science teams to transform those ideas into valuable GenAI solutions.

“It’s easy to give [GenAI] tools to people and say, ‘Figure out what works best for you,’” said Tjerrie Smit, chief analytics officer at NN Group. “The difficult part is getting those people to learn from those who are really skilled at it. That’s why the greatest benefits are in GenAI solutions: When we purposely build something once, then we can do it right and use it every day with thousands of users. That’s the sweet spot.”

Turn BYOAI Potential Into Organizational Strength

Every organization now faces the reality of GenAI tool use, whether it sanctions the tools or not. BYOAI offers leaders an opportunity to educate employees about the tools’ pros and cons and increase their skills, which benefits the organization. That knowledge and experience can also spur ideas for innovative, larger-scale GenAI solutions.

Combine BYOAI with the targeted adoption of a few GenAI tools from trusted vendors and support it with hands-on AIDE training as well as clear guardrails and guidelines. This way, you can mitigate organizational risk and costs while you experiment and pursue a long-term return on investment.