The AI Strategy No One Sees:
What quiet AI experiments reveal before formal strategy catches up
January, 2026
Executive Brief
Most organisations already have an AI strategy. They just may not have seen it yet.
It is sitting in browser tabs, AI note-takers, unofficial prompt libraries, pasted documents, side experiments and small workarounds people are using to get through the day.
In one team, someone uses ChatGPT to summarise a policy because the internal search is hopeless. In another, an AI note-taker appears in a meeting because the follow-up actions keep disappearing. A useful prompt library starts circulating in Teams before the official training has arrived. A personal tool sits open beside the approved one because, awkwardly, it gives the better answer.
None of that means the organisation is full of reckless rule-breakers.
Usually, it means people are trying to solve the work in front of them.
The quiet experiment is not always the problem.
Sometimes it is the receipt.
The Shift
The specific AI capability here is not one platform.
It is the easy availability of copilots, public GenAI tools, AI note-takers, research assistants, prompt templates and lightweight automations that people can use before formal strategy catches up.
That changes the starting point for leaders.
AI strategy no longer begins when the board approves the roadmap, IT selects the platform, or the steering committee agrees the acceptable-use policy.
By then, the organisation may already have developed a shadow operating model.
Always calming.
The workarounds matter because they are not random. They tend to appear where the organisation is slow, unclear or under-supported.
Poor knowledge access creates unofficial summarising. Too many meetings create silent note-takers. Slow review pathways create AI-assisted drafts. Confusing policy creates personal judgement calls. Weak training creates prompt libraries built by whoever happened to get useful first.
Some of it is useful. Some of it is risky. None of it should be invisible to leadership.
The Real Tension
Leadership often sees quiet AI use first through the risk lens.
Fair enough.
Customer data in a public tool is not a cute innovation story. A meeting bot recording sensitive conversations without consent is not a cultural breakthrough. A prompt library full of unreviewed legal, HR or customer language can scale poor judgement very efficiently.
So yes, the risk is real.
But if leaders stop there, they miss the more useful question:
what problem was the workaround trying to solve?
That question changes the conversation.
If people are pasting documents into public AI tools, maybe the internal knowledge system is not doing its job. If employees are using personal subscriptions alongside approved enterprise tools, maybe the approved tool does not meet the work. If teams are building their own prompt libraries, maybe capability is forming faster than the organisation can package it.
The issue is not simply that people are using tools without permission.
It is that the organisation may be learning about AI faster than its leaders are.
And much of that learning is happening in places leaders are not looking.
The Ripple Insight
Quiet AI experimentation is a mirror held up to the operating model.
Not always a flattering mirror, admittedly.
It shows where the work is too slow. Where systems are too hard to use. Where people do not know the rules. Where the official process is technically correct and practically avoided. Where the approved tool exists, but the real work has quietly moved elsewhere.
That is why the first leadership move should not be panic.
Nor should it be applause.
It should be curiosity with a backbone.
The question is not:
who is breaking the rules?
At least, not first.
The better question is:
what are people trying to get done that the current operating model is not helping them do safely?
That does not remove the need for governance. It makes governance more useful.
A good AI policy should not simply say “no” from a safe distance. It should help people understand what is allowed, what is not, which tool to use, what data can go where, when a human must stay involved, and who to ask when the work falls into the grey zone.
Governance shifts from:
no, unless
to:
yes, if
That is not a soft position.
It is a more honest one.
The Move
Before writing another AI policy, leaders should map what people are already doing.
Not as a witch-hunt. Good luck getting honesty that way.
As an operating scan.
Pick a few teams and ask simple questions.
Where are you using AI today? Which tools? For what work? What data are you putting in? What problem is it solving? What feels unclear? What are you hiding because you are not sure how it will be received?
That last question may do more useful work than the whole policy.
Then do the slightly dull but very useful work of sorting what you have found.
Stop now: too much data, too little control, too much exposure.
Govern better: useful behaviour, but it needs clearer rules, approved tools or better data boundaries.
Legitimise: the workaround is solving a real problem and should no longer be treated as unofficial.
Scale carefully: the experiment is narrow enough to govern, useful enough to matter and clear enough for people to understand.
The practical habit is simple: create a small, regular review with technology, risk, customer or operations, and one business owner close to the work.
Thirty minutes.
Actual examples.
No theatre.
The point is not to celebrate every quiet experiment. Some need to stop.
The point is to stop pretending the formal AI strategy is the only one that exists.
The real strategy may already be forming in the workarounds.
Leaders should read it before it becomes liability — or before the best learning walks out the door.
Executive note for leaders
Before tightening AI governance, ask:
what are people already using AI for, and what is that behaviour trying to tell us?
Quiet experiments can reveal risk. They can also reveal slow systems, poor knowledge access, unclear policy, weak training and useful capability forming before the organisation has named it.
Map the actual use first.
Then decide what to stop, govern, legitimise or scale.
The aim is not permission without control.
The aim is governance that starts from reality.
Subscribe
You can subscribe for free. Every edition is delivered directly to your inbox and published here on Substack.
If a piece raises a question, surfaces a pattern, or helps you think more clearly about a decision, I’d value the conversation.
Thanks for reading,
Stuart Gonsal MAICD
With occasional help from Springsteen, my Border Collie, who reminds me that clarity comes from movement 🐾.
Connect
LinkedIn – Follow for practical leadership in the AI era. ↗
Disclaimer
Everything shared in The Ripple Effect reflects my personal views and does not reflect those of my current or past employers, clients or partners. Any examples are illustrative, drawn from publicly known patterns or anonymised experience.