Customer Support
There’s a problem we have that we still haven’t figured out how to solve. Some of us don’t even know we have it. And it all started with AI. Not grool.
Let me give you an example.
A friend called me a few months ago. He’s an executive at a large real estate firm. When I asked him how his work had been going, he immediately started gushing about his team. “I work with the smartest, most independent and entrepreneurial people than I have ever worked with in my career.”
I sensed the “but” coming, as you probably do too.
“But, I have a problem. And that’s why I wanted to speak with you.” (He knows what I do for a living — Grace Hill spends a lot of time thinking about exactly this kind of thing.) “Because I spent the last few years really trying to get them to adopt all these tech tools we pay for. And now, I know they’re using AI. I can tell from their work product. But I just can’t get them to use our AI. What am I doing wrong?”
4 in 5 Employees Are Using AI. Only 1 in 4 Leaders Have a Plan.
Before we get to my answer, let me just say that he’s not alone. AI governance has become a bigger and bigger issue for all firms, not just in real estate. According to Gallup, 28% of U.S. employees use AI daily or a few times a week and another 50% use it at least a few times a year – nearly 4 in 5 employees say they’re using AI in their work in some capacity.
So how much of that is happening on approved, company-sanctioned tools? According to Microsoft and LinkedIn’s 2026 Work Trend Index Annual Report, only 1 in 4 employees (26%) say their leadership is clearly and consistently aligned on AI. And presumably telling employees what company-sanctioned tools they should use.
The gap between how much AI is already happening and how little direction most people have received is exactly where shadow AI thrives.
Employees are using AI. But leadership, in most cases, hasn’t told them how. This is called shadow AI. It could be that individuals already have workflows built out in their personal AI, and it’s too much work to port those over to the company AI. Even with some companies creating firewalls to prevent unauthorized AI usage, it doesn’t appear to have worked based on the data.
That’s why shadow AI’s footprint is so big. It’s full of secrets.
The Real Cost of Shadow AI
Here’s the problem with shadow AI. First, it doesn’t even go here.
Second, ungoverned AI adoption means duplicated tool spend, no economies of scale, and no audit trail of how company data and processes are being used. Not only that, there’s rising data-exposure risk with employees entering data into personal LLMs. And not only that, if employees use connectors to their work tools via their personal AI, there’s access control risk. In other words, employees are potentially granting access to company systems with unsanctioned software.
When it comes to data-exposure risk, the limit does not exist.
Verizon’s 2026 Data Breach Investigations Report found that shadow AI is now the third most common non-malicious insider action showing up in data-loss incidents — a fourfold increase from the year before. While the most common issues are with revealing source code, images and other data leaks followed.
This is the exact problem Grace Hill’s Policy team has been watching play out across our own client base for the past two years, and the data tells a clearer story than any survey. Since we made an AI usage policy available to clients in early 2024, adoption has climbed, including a sharp jump in Q3 2025 right as GPT-5, two new Claude models, and the White House’s AI Action Plan all landed within about six weeks of each other.
AI Policy Adoption Isn’t the Same as Action
But having a policy on the books and actually putting it in front of employees are two very different things. Among Grace Hill clients who’ve added an AI usage policy, only 8% have gone the extra step of assigning it to their teams. The other 92% of clients have a policy sitting in a folder that nobody’s read… which, if you’re like my friend, is exactly the gap that’s keeping you up at night.
Even then, most companies only move when something forces the issue — a lawsuit, a legal deadline, a headline. Waiting for that moment is a risk in itself. It’s also, not coincidentally, the moment our clients call us.
Why a Policy — Not Good Intentions — Is What Actually Closes the Gap
It’s tempting to think this is a training problem, or a trust problem, or an individual-judgment problem. Microsoft’s own 2026 research says otherwise. Organizational factors — culture, manager support, and having clear guidelines — account for more than 2x the impact on how well AI adoption actually goes, compared to individual mindset and effort alone (67% vs. 32%). In Microsoft’s own framework, governance isn’t a nice-to-have bolted onto AI strategy. Rather, it’s one of the four pillars they use to measure whether a company is actually ready for AI at all.
The fix is to give employees something clear to follow. A written, easy-to-find AI usage policy turns “I know they’re using AI, I just can’t get them to use ours” into a clear, sanctioned, documented standard for how AI gets used, what data can go into it, and who’s accountable when something goes wrong.
That’s the whole thesis behind why we built an Acceptable Use of Generative AI policy into Grace Hill’s Policy platform in the first place. It’s pre-written, customizable, and trackable the same way you already track every other compliance policy: who’s read it, who’s acknowledged it, who hasn’t. Paired with Gracie, our AI-powered policy assistant, your team can ask “Can I use ChatGPT to draft resident emails?” and get an instant, sourced answer rather than guessing, or reaching for whatever’s already on their phone.
Because Gracie isn’t a regular AI chatbot, it’s a cool AI chatbot.
My friend’s problem isn’t really an AI problem. It’s a “we never gave people a clear, easy answer” problem, and it’s solvable. You close the gap both with a firm policy and by making your company AI significantly more valuable than their personal AI.
As it turns out, we don’t have to wait to solve that value equation. With the launch of Intelligence+, we are tackling that head-on. By allowing your team to use Ask Gracie to get immediate, plain-language answers grounded in actual property data, resident satisfaction, and real-time market comps from HelloData, Intelligence+ makes the company-sanctioned tool inherently more useful than a generic personal LLM. When employees have an approved platform that actually knows their business and cuts out manual analysis, the temptation to sneak around with shadow AI naturally evaporates. You aren’t just mitigating risk — you’re providing a genuinely superior experience.
If your organization is somewhere between “we know people are using AI” and “we have no idea what to do about it,” talk to our team about adding the policy to your library. And then introduce them to Intelligence+.
Four for you, compliance. You go, compliance!
