Nobody at Your Company Decided You Could Use This AI Tool

If you can't say, right now, who at your company is allowed to approve a new AI tool or use case, that decision is already being made without you. This month it was made by a federal agency, a foreign regulator, and the employee two desks over who got tired of waiting for an answer.

Three unrelated stories landed inside about four weeks and each one is the same gap wearing a different hat. The Department of Homeland Security ordered every federal civilian agency to strip DeepSeek out of its tools and stop buying anything built on it, citing the risk that the model sends data back to the Chinese government — a ban that reaches third-party products most users never knew were running DeepSeek underneath (CyberScoop, Oct 20). The same week, OpenAI's EU text watermarking went live under the AI Act, meaning AI-written content is now machine-detectable by default for European audiences whether your team disclosed it or not. Separately, employer survey data reported by The Neuron put undisclosed AI use at the top of workplace misconduct complaints — 66% of companies now name it their most common problem in live assessments, with Google, Amazon, Cisco, and McKinsey all reinstating in-person interview rounds specifically to catch it. And three weeks before that, Sam Altman and Dario Amodei briefed the UN Security Council on AI risk in person for the first time, with Amodei proposing that AI failures get logged and reported the way airline near-misses are — an accountability structure built for companies that don't yet have a basic policy of their own.

None of these four events asked your company's permission first. That's the actual pattern, and it's not a compliance footnote — it's a decision-rights problem. Somewhere between "which AI tool should we use" and "what happens when someone uses it badly," most companies never wrote down who gets to decide. So a government agency decides by banning a model. A regulator decides by watermarking your output. And in the gap where nobody decided anything, an employee decides by using AI quietly and not mentioning it.

The fix isn't a smarter tool policy. It's naming, in writing, one person or role who approves a new AI tool or use case, what gets escalated instead of handled quietly, and what happens when someone skips the process. That document doesn't need to be long. It needs to exist before the next external actor writes the rule for you.

Take Priya, who runs marketing operations at a 40-person SaaS company. Six months ago she connected a scheduling agent to the company CRM because it solved a real bottleneck and nobody told her not to — which, she realized after the DeepSeek ban made the news in her Slack, is different from someone telling her she could. She checked what was actually running under the three AI tools her team had connected that quarter and found one whose underlying model she couldn't name from the vendor's own documentation.

Contrast that with Dennis, who leads operations for a 15-person logistics brokerage and spent one afternoon in September writing a single page: three people who can approve a new AI tool, the one question that triggers an escalation ("does this touch customer data or a hiring decision?"), and a line that any unapproved tool gets removed, not grandfathered in. He didn't predict DeepSeek or the UN briefing. He just made sure that when the next version of this story broke, his team already knew who was supposed to answer it — instead of discovering, like Priya did, that the answer had been "nobody" the whole time.

A model ban, a watermarking law, and a misconduct survey are three different mechanisms pointing at the same hole. The teams that keep getting caught by the next one aren't the ones using the wrong AI tool — they're the ones who never decided who was allowed to pick it.