What to Check Before Adopting AI at Work
Seven questions to ask before you pick a tool
① While a company debates adoption, employees are probably already using AI on personal accounts. So the question is less "should we use it" than "under what conditions."
② Before the tool's name, check seven things: the task, the data going in, contract terms, access and permissions, accountability for output, cost structure, and the way out.
③ Don't roll it out company-wide on day one. Set success criteria first, test with one or two teams, compare against the existing way of working, and then widen.
① Getting started — from a personal issue to an organizational one
AI and Your Privacy covered "where does what I type go" from an individual user's side. This piece goes one level up, to decisions an organization has to make. Which tools to allow, what data may go in, and who is accountable when something goes wrong are not things a person can settle in a settings screen. The same questions are useful for team leads and planners, and for investors asking "is this company adopting AI sensibly?"
② They're already using it — shadow AI
Employees often start before the company formally decides. Microsoft and LinkedIn's 2024 Work Trend Index reported that 78% of AI users bring their own AI tools to work (80% at small and medium-sized firms). In the same report only 39% of users had received AI training from their company (Microsoft News, 2024). The numbers vary with survey scope and wording, and some material puts the US average lower. The direction is the same: many people use it, few were taught the rules.
There is a real case. In April 2023, Samsung Electronics engineers uploaded internal source code to ChatGPT while trying to fix errors. Samsung then issued a memo restricting generative AI on company computers, mobile devices and its internal network. The company described the measure as temporary while it worked out a safe way to use these tools (TechRadar, CSO). Reports did not establish what information was exposed or how much.
The lesson is not "AI is dangerous, ban it." Where use is only banned, people who want to use it quietly move to personal devices and accounts. Control comes from offering an approved alternative together with rules for using it. Samsung also said it would review how to allow safe use rather than simply ban it.
③ Seven questions before adopting
Sorting these out before opening a tool comparison table narrows the choices a lot.
| # | Question | What to check in practice |
|---|---|---|
| 1 | What task are we handing over? | Write the use case concretely ("first-draft replies to customer inquiries," not "adopt AI"), along with what a wrong answer costs. A task where a person can fix errors is different from one where an error goes straight to a customer |
| 2 | What data goes in? | Sort material into tiers such as public / internal / confidential / personal data and decide what is allowed for each. Without tiers, every employee judges alone every time |
| 3 | What do the contract and plan say? | Check in the terms and contract whether inputs are used for training, how long they are retained, how deletion requests work, where data is stored, and whether subprocessors are used. Personal and organizational plans can differ, so don't judge by the plan's name |
| 4 | Who can access what? | Check single sign-on (SSO), per-user permissions and whether usage logs (audit logs) are available. If the AI connects to email, documents or internal systems, keep the connection scope minimal; the reasons are in Prompt Injection and AI Security |
| 5 | Who answers for the output? | Decide who reviews AI output, and when: set human checkpoints. That delegating does not delegate responsibility is covered, with real incidents, in Delegating Real Work to AI Agents |
| 6 | How does cost grow? | Is it a flat per-seat fee or usage-based billing? With usage billing, long documents and repeated calls drive cost. See Tokens and the Context Window for why |
| 7 | Is there a way out? | Can you export your data, and is the setup structured so you can switch models? Decide what you'd do if the service stops or prices rise. Tying a whole workflow to one vendor weakens your bargaining position |
④ Regulation, checked in one line each
Depending on how you use AI, legal duties may apply. The details belong to legal counsel; what an adoption lead needs to know is that you must check whether they apply to your service.
- Korea: the AI Basic Act took effect on January 22, 2026. Providers offering products or services built on high-impact or generative AI must notify users in advance that AI is being used. The Ministry of Science and ICT said it would give at least a year of grace on fact-finding and fines (Shin & Kim newsletter, in Korean).
- EU: high-risk obligations under the AI Act were reported to be postponed, with standalone high-risk systems moved to December 2, 2027 (Gibson Dunn). The duties were delayed, not removed.
Rules keep shifting with decrees, guidelines and grace periods. The above is a starting point for your checks; whether and how it applies must be confirmed against current official sources and legal review, especially if your service shows AI output directly to customers.
⑤ Designing a small pilot
Once you've worked through the seven questions, don't go company-wide. Test with one or two teams for a set period. The most common pilot failure is not technical; it is being unable to say afterwards whether it worked.
- Write success criteria first. Not "it helped" but "how much did drafting time fall" or "how did the number of edits change," so you can compare numbers.
- Compare side by side with the current way. A team using AI against one not using it, or the same task before and after.
- Count review time too. If drafts get faster but finding and fixing errors takes longer, the net gain is small. Weak areas such as those in Why AI Gets Numbers Wrong need a bigger review share.
- Record the failures. Collecting only successes inflates the apparent benefit. Write down wrong answers and blocked tasks as well.
- Provide training and rules together. As the 39% figure suggests, handing over a tool leaves each person to invent their own habits. Give a one-page guide on what data may be entered.
Which tool is better is answered far more directly by running about five of your own tasks under the same conditions than by an external score chart. The reasoning and method are in Can You Trust Benchmark Scores?.
⑥ Investor angle — how to read "expanding AI adoption"
"Expanding AI adoption" appears often in earnings releases. Applying this piece's questions, what to check behind the phrase is where it is used (question 1), how costs scale (question 6), and whether it already shows up in the numbers. A plan with no performance metric is still an expectation; if it appears in revenue, margins and guidance, it is evidence. How to read enterprise AI demand in big-tech earnings is in the Big Tech Earnings Guide, and how to look at dispersion when analyst reports are uniformly bullish is in How to Read Analyst Reports.
⑦ Practical checklist
□ Have you written the task concretely, with the cost of a wrong answer?
□ Have you sorted material into public, internal, confidential and personal tiers and decided what each tier allows?
□ Have you checked training use, retention, deletion and storage location in the terms and contract yourself?
□ Are single sign-on, per-user permissions and usage logs available?
□ Have you set where a person checks AI output, and who is accountable?
□ Do you know whether pricing is flat or usage-based, and how cost changes as usage grows?
□ Can you export your data or switch to another model?
□ Have you checked with legal whether any regulation applies to your service?
□ Have you set success criteria as numbers and started with one or two teams?
□ Have you told employees which tools are approved and what data rules apply?
※ Figures here come from a 2024 report and 2026 coverage and may have changed since. This is not legal, security or contract advice; actual adoption decisions should be confirmed with legal and security staff and current official sources. It is not an assessment of any company or product, and investment-related content is not investment advice. Investment decisions and their consequences are the investor's own responsibility.
※ This guide is provided for general educational purposes and simplifies technical details for readability.
New guides, when they land
We publish AI literacy guides twice a week. Subscribe and the next one comes to you — free, unsubscribe anytime.