I've spent a lot of the last year writing about how artificial intelligence is reshaping the battlespace — how adversaries weaponize trust, how AI accelerates disinformation, how civil stability itself becomes a target. But there's a quieter version of that same problem sitting inside every organization I work with, and it has nothing to do with foreign adversaries. It's us.
Every week I sit in meetings where someone has already plugged sensitive data into a chatbot, or a team has quietly adopted an AI tool without anyone in security or leadership knowing it exists. Nobody did anything malicious. They were just trying to get work done faster. That's exactly the problem. AI adoption is outrunning AI governance almost everywhere I look, and the gap between the two is where the real risk lives.
The Speed Problem
AI tools are easy to adopt and hard to govern. A single employee can sign up for a new AI service in the time it takes to drink a cup of coffee, and within a week half a department is using it. Meanwhile, policy development, security review, and legal sign-off move at the speed institutions always move: slowly, deliberately, with committees. That mismatch isn't a temporary growing pain. It's structural, and it's not going away.
I've watched this play out from the inside, having led IT and technology strategy at the executive level for years. The instinct is to either lock everything down, which drives usage underground, or say nothing, which is worse. Neither approach works. What works is building policy fast enough to keep pace with adoption, and building it with enough clarity that people don't need a law degree to follow it.
What's Actually at Stake
The risks aren't hypothetical. Sensitive data ends up in systems you don't control and can't audit. Decisions get made based on AI output nobody fact-checked. Bias baked into a model quietly shapes hiring, lending, or resource allocation, and nobody notices until it's a headline. And on the security side, AI has become both a tool for defenders and a weapon for attackers, which means the absence of a policy isn't neutral. It's a vulnerability.
This is where my work on the national security side and my work as a technology executive actually converge. The same dynamic I've written about in adversarial AI — trust being exploited faster than institutions can respond — plays out at a smaller scale inside every company that hasn't figured out its own AI guardrails yet. Civil stability starts with institutional stability, and institutional stability starts with having rules before you need them.
Safeguards Aren't the Enemy of Innovation
I want to push back on a framing I hear a lot: that policy and safeguards slow down innovation. In my experience it's the opposite. Clear policy is what lets people move fast with confidence, because they're not guessing about what's allowed. Ambiguity is what actually slows things down — it creates hesitation, shadow IT, and inconsistent practices that eventually blow up into a real incident.
Good AI policy isn't about saying no. It's about defining what data can go where, what decisions require human review, what tools are approved and why, and who's accountable when something goes wrong. That's not bureaucracy for its own sake. That's the difference between an organization that can explain its AI usage to a regulator, a board, or a journalist, and one that's scrambling to reconstruct what happened after the fact.
Even the People Building It Are Saying This
It's worth pausing on the fact that this isn't just an outside critique of the AI industry. Dario Amodei, CEO of Anthropic, said as much in a 60 Minutes interview with Anderson Cooper. He's on record saying he's uncomfortable with how much power over AI's future rests in the hands of a small number of tech executives, and he's argued for real regulatory oversight rather than leaving those decisions to the companies building the technology. Nobody elected him to make these calls, and to his credit, he's said so.
He's also been candid that Anthropic doesn't have all the unknowns figured out. Even with dozens of internal teams dedicated to identifying misuse, loss of control, and downstream economic effects, he's acknowledged the company is often reasoning about risks it can't fully predict yet, which is exactly why it keeps publishing what it finds instead of sitting on it. That's a notable admission from someone running one of the labs pushing the technology forward.
Then there's the workforce question, which he's raised repeatedly and bluntly: AI could eliminate a substantial share of entry-level white-collar jobs in the next few years, in fields like consulting, law, and finance, and he doesn't think that trend can simply be stopped. Whether or not his estimates hold up, the fact that a sitting AI CEO is publicly raising it should tell you something. When the people with the most to gain from unregulated growth are asking for guardrails, that's not a talking point from critics outside the industry. That's a signal the industry itself doesn't fully trust the pace it's moving at.
Where to Start
If your organization doesn't have an AI policy yet, don't wait for a perfect one. Start with the basics: what data classifications are off-limits for public AI tools, which tools are sanctioned, who owns the decision to approve new ones, and how you'll handle the inevitable mistake when someone pastes something they shouldn't have. You can refine from there. What you can't do is refine a policy that doesn't exist yet while the gap between adoption and governance keeps widening.
Technology is never the hardest problem. People are. And the people problem with AI right now isn't malice — it's speed without structure. Safeguards aren't there to slow us down. They're there so we don't have to find out the hard way what happens when trust, data, and judgment get outsourced to a system nobody's actually governing.