Someone specific, with the authority to say no, and for most small and midsize businesses that ends up being whoever already manages your technology, your IT lead or your IT provider, working from a written policy your leadership actually signed off on. What does not work is the current default in most companies: every department adopting its own AI tools, nobody keeping a list, and the first full inventory happening after something goes wrong. AI tools are software with unusually deep access to your information. They deserve at least the oversight you already give email and file storage, and right now, in most businesses, they get less.

Why is this suddenly a problem?

Because AI tools do not arrive the way software used to. Nobody files a purchase request for a chatbot. A salesperson starts pasting proposals into a free AI account, marketing connects a writing tool to the brand files, an assistant finds a meeting-notes tool that listens to every call. Each choice is reasonable on its own. Nobody chose the sum of them.

The sum is the problem. Each tool holds some slice of your business information, under terms nobody at your company read, with access nobody is tracking. That is not an AI problem. It is the oldest IT problem there is, unmanaged software with data access, moving faster than it ever has.

What actually needs managing?

Five things, and none of them is exotic.

The inventory. A current list of which AI tools are in use, by whom, for what. Most businesses cannot produce this list today, and it is the foundation for everything else.

Access. What each tool can reach: email, files, customer records, calendars, accounting. When a tool asks for full access, someone should be asking what breaks if it gets less, because the answer is often nothing.

Data rules. What information is allowed into which tool. Customer data, financials, and anything under an NDA does not belong in a free consumer account. This is the piece that needs a written policy, because a verbal rule does not survive a new hire’s first week.

Security. AI tools are a new surface for attacks and mistakes. Whoever watches your security needs these tools inside that watch, not outside it.

The bill. AI subscriptions multiply quietly, and overlapping tools doing the same job is the normal state of an unmanaged stack, not the exception.

Should this be a person, a committee, or your IT provider?

For most small and midsize businesses, the honest answer is your IT function, whether that is an in-house lead or an outside provider, paired with one decision-maker in leadership. The IT side runs the inventory, the access reviews, and the security watch, because that is infrastructure work and they already have the tools for it. Leadership owns the policy calls: which categories of data are off limits, which tools get approved, what happens when someone bypasses the process.

A committee works at enterprise scale. In a 30-person company it usually means nobody owns it. One accountable owner with a short written policy beats a working group that meets quarterly.

This might not be for you if your business runs on two laptops and one shared drive, and no customer data touches any AI tool. At that size, a one-page policy and an annual look at what is connected may genuinely be enough.

What belongs in the written policy?

The same six pieces that work for any technology policy, sized to your business: which tools are approved and for what, what data can never go into an AI tool, when a human has to review AI output before it leaves the building, who signs off on adding a new tool, what training people get before using AI on real work, and who gets told first when something goes wrong.

We hold ourselves to this internally: every Simpatico employee completed AI training and signed our written AI use policy before using AI tools on client work. Not because a regulator required it, but because handing tools deep access without rules is how businesses find out the hard way what a tool did with their data.

How does an MSP fit into managing AI?

A managed services provider (MSP), the outside team that already runs your IT, is positioned to take most of this on, because the work is the same connective discipline MSPs already do: access control, monitoring, asset inventory, policy enforcement. The AI-specific part is knowing the tools well enough to judge them, which is why it matters whether your provider actually works with AI or just tolerates it.

That distinction is part of why we describe ourselves as evolving from a managed services provider into what we call a Managed Intelligence Provider: the same accountable team that keeps your systems running, extended to managing the intelligence layer that is now spreading across them. The sweet spot for an outside team is the plumbing: inventory, access, data boundaries, security, and license cleanup. What stays with you is judgment: which tools fit how your people actually work, and whether the output is good.

What should you do first?

Make the list. Before any policy, any tool decisions, any vendor conversation: get a current inventory of every AI tool in use across the business, including the ones individuals adopted on their own. It takes about a day of asking, it costs nothing, and it always turns up tools leadership did not know about. Every other decision gets easier once the list exists.

What should you do next?

If you want the inventory done for you, along with the access review and a policy sized to your business rather than a template, that is exactly the kind of work we do as your outside IT team. Schedule a strategy session and we will start with the list.

How many AI tools are in use across your business right now? If you had to guess rather than answer, that is the whole point.