Co-authored by Stew Chisam, Operating Partner, StellarIQ
Your company doesn’t have an official AI strategy. The CEO hasn’t set a clear stance on artificial intelligence. In that vacuum, something predictable happens: risk and control functions naturally step in, and their loss-aversion wins.
Legal says no to AI tools to avoid compliance violations. Security blocks everything to prevent data leaks. IT locks down non-approved platforms. Each department, acting rationally from their perspective, becomes part of what we call the “AI Prevention Department”, an unintentional coalition that effectively blocks AI adoption across the organization.
Here’s the thing: nobody set out to create an AI Prevention Department. But without clear direction from the top, that’s exactly what emerges. And it’s creating the absolute worst-case scenario from a security perspective.
Because while your control functions are saying “no,” your product team is brainstorming roadmaps in their personal AI accounts. Engineers are troubleshooting production issues on consumer AI platforms. Someone in finance just ran your quarterly projections through an unvetted AI tool they found on Google.
How We Got Here
When CEOs stay silent, each department defaults to protecting against their worst nightmare:
- Legal fears being the company that ends up on a magazine cover for leaking IP into ChatGPT
- Security imagines proprietary data training someone else’s model
- IT wants to avoid tool sprawl while also wanting to build with the most important technology of our lifetimes
- Compliance worries about regulatory violations they don’t even understand yet
Without leadership saying “we’re prioritizing AI,” these functions naturally default to “no.”
But here’s what Stew and I see constantly: these tools are simply too valuable to keep out of people’s hands. The second you don’t have a corporate-endorsed approach for how to use these tools, everyone’s just going to use their personal ChatGPT to do it. And then that is literally the worst way to do it.
Failure to Take a Stand Maximizes Risk
Yes, there are legitimate concerns about AI tools—data privacy, intellectual property protection, compliance requirements. These are real issues that demand serious attention. But the risk equation isn’t “AI tools vs. no AI tools.” That ship has sailed.
The actual risk equation is: managed AI adoption vs. unmanaged shadow AI usage.
When organizations try to be “conservative” by blocking these tools entirely, they create the worst of both worlds:
You get all the risks you feared:
- Employees mix corporate and personal data in consumer tools
- Zero audit trail of what information has been shared
- No controls over data classification or retention
- No education on safe AI practices
- Increased reliance on sketchy, unvetted apps
- The data leaks and compliance violations your control functions feared—happening invisibly
While missing all the upside:
- Competitors are transforming entire business functions
- They’re automating workflows and cutting operational costs
- They’re making AI-powered decisions while you’re stuck in committee meetings
- The fastest innovation wave in decades passes you by
As Stew puts it: “You feel like you’re being conservative taking this approach. I’d actually argue that’s the highest risk thing to do.”
The irony is brutal: by not putting a stake in the ground on AI, CEOs get both the downside they feared and miss the upside they need. Maximum risk, zero reward.
The CEO Must Set the Direction for AI
The solution starts at the top. Some think this is the CIO’s job. Or the CISO’s. Or Legal’s. But their structural incentive is always to minimize risk. Left alone, they’ll keep saying “no.” Only the CEO can issue the mandate that enables a clear AI strategy to form.
Look at companies getting this right: Shopify, Duolingo, Box. Their CEOs didn’t craft detailed AI implementation plans. They set a clear stance: “AI is a priority. We’re going to move fast. We’re going to be responsible. Now go figure out how.”
Here’s what CEO leadership on AI looks like in practice:
Set the North Star. The CEO must declare AI a priority and set the tone. Not “we’re exploring AI” or “we’re monitoring developments.” But “we are embracing AI, doing it responsibly, and expecting everyone to participate.”
Empower the Right Leaders. Designate who owns AI strategy, whether that’s a Chief AI Officer, CTO, or cross-functional team. Give them the authority to override departmental “no’s” and the mandate to enable safe adoption.
Remove the Blockers. Transform Legal, Security, and IT from gatekeepers into enablement partners.
Make the Stance Visible. When the CEO publicly champions AI adoption—celebrating wins, discussing learnings, setting expectations—it signals that using AI (safely) isn’t just allowed, it’s expected.
Final Thoughts
The AI Prevention Department is real, it’s in your company right now, and it’s creating the exact risks it was trying to prevent. But here’s the good news: it can be dismantled with a single CEO declaration: “We’re using AI. Help us do it right.”
That’s it. That’s the stance that transforms everything.
Because once you acknowledge that AI adoption is happening regardless, the entire conversation shifts from “how do we stop this?” to “how do we win with this?” And that’s when real strategy can finally begin.
The train has left the station. Time to decide: are you conducting, or just hoping you don’t get run over?
