Let’s be honest about something.
When a new tool promises to cut your workday in half, write better copy than you, never complain about deadlines, and cost absolutely nothing — most people are not opening a PDF to review the data usage policy. They are clicking “Sign Up Free” and getting to work.
This is not a character flaw. It is a very human response to a very compelling value proposition.
It is also, as Meridian Group discovered on a Thursday afternoon in November, a business risk that nobody had thought to put on the radar.
The Tool
Jenna was Meridian’s marketing coordinator — twenty-six years old, sharp, self-motivated, and the kind of person who finds a better way to do something and just does it without waiting to be asked. In a growing company, that quality is genuinely valuable. It is also, occasionally, the setup for a story like this one.
Several months earlier, Jenna had discovered an AI writing assistant — one of the dozens of free, browser-based tools that had proliferated rapidly across the internet. It was good. Genuinely, impressively good. It could draft campaign briefs, polish email copy, sharpen value propositions, and generate first drafts of client-facing content in a fraction of the time it would have taken her to do manually.
Jenna used it constantly. She used it to draft content for three active client accounts. She fed it campaign briefs, brand guidelines, messaging frameworks, and detailed background notes on each client’s business — the kind of rich contextual information that makes AI output actually useful rather than generic.
The content came out well. Clients were happy. Turnaround times improved. Nobody asked where the efficiency gains were coming from, and Jenna didn’t feel the need to announce that she’d found a useful tool and was using it. That seemed like a non-event.
It was not a non-event.
The Phone Call
The Thursday afternoon in question began with a client call that Xavier was not expecting.
The caller was the marketing director at one of Meridian’s mid-sized accounts — a relationship that had been running smoothly for two years. She was not calling to complain, exactly. She was calling because something had caught her attention and she wasn’t sure what to make of it.
She had seen a digital ad from a competitor — a company in an adjacent space that occasionally chased the same customers — and the language in the ad was strange. Not identical to messaging Meridian had developed for her brand. But close. Structurally similar. The same turn of phrase in two places. The same value proposition framing that Meridian’s team had workshopped specifically for her account.
“I’m probably being paranoid,” she said. “But I wanted to flag it.”
Xavier thanked her, told her he’d look into it, and sat with the call for a moment after he hung up.
He wasn’t sure what he was dealing with yet. But he’d been at Meridian long enough to know that when something felt like a thread worth pulling, it usually was.
He called Xpert.
What Xpert Found
The Xpert team’s investigation didn’t uncover a breach. There was no hacker, no corporate espionage, no disgruntled employee passing information to a competitor.
What they found was a free AI tool with a terms of service agreement that, buried somewhere around page four of language that nobody reads, contained a clause permitting the platform to use submitted content to train and improve its underlying models.
Every brief Jenna had uploaded. Every client background document. Every messaging framework and campaign outline — fed into a tool that had, according to its own terms, the right to learn from it.
The AI tools landscape in this period was evolving faster than most companies’ ability to govern it. Some platforms had strong data protection policies and explicit commitments not to train on user inputs. Others — particularly the free ones, because free tools need a business model — had more permissive terms. The information submitted by one user could, in various ways depending on the platform’s architecture, influence outputs generated for other users.
Was the competitor’s ad a direct result of Meridian’s content being absorbed into the tool’s training data? Impossible to say with certainty. The similarity could have been coincidence — the same AI tool generating structurally similar outputs for two different users working in adjacent spaces.
But impossible to say with certainty is not a phrase that provides much comfort when a client is on the phone asking questions.
The Real Problem: Shadow AI
Xpert brought a term to Xavier’s attention that he hadn’t encountered before: shadow AI.
He was familiar with shadow AI — the phenomenon of employees using unapproved tools and platforms outside of IT’s visibility or governance. He’d seen versions of it at every company he’d worked at. People find tools that help them work better and use them, with or without formal approval.
Shadow AI was the same concept, accelerated by the extraordinary pace at which AI tools had become accessible, capable, and genuinely useful. Across Meridian’s 200 employees, the Xpert team’s assessment found that AI tools of various kinds were in active use across marketing, sales, operations, and finance — generating content, summarizing documents, drafting emails, analyzing data.
Approximately none of it had been reviewed, approved, or assessed for data handling practices.
Some of the tools in use had strong, enterprise-grade data protections. Others had terms of service that made Xpert’s team visibly uncomfortable. A few had privacy policies that hadn’t been updated since the tool launched and no longer reflected how the platform actually operated.
The problem wasn’t that Meridian’s employees were using AI. The problem was that nobody had ever asked which AI tools were safe to use, for what purposes, with what kinds of data — and communicated that clearly to the people making those decisions on their own every day.
Jenna hadn’t done anything wrong. She’d found a tool, used it well, and gotten results. She simply hadn’t had access to information that would have changed her decision.
That was a leadership gap, not an employee one.
How Xpert Fixed It
Over the following month, Xpert Technologies helped Meridian build an AI governance framework — not an onerous, bureaucratic policy document that would sit unread in a shared drive, but a practical, usable set of guidelines that gave employees clarity about what they could use, what they couldn’t, and why.
The framework included:
An approved AI tools list. Xpert assessed the data handling practices, terms of service, and security posture of the AI tools already in use at Meridian, as well as several that employees had requested. Tools were categorized: approved for general use, approved with restrictions, and not approved for use with client or sensitive company data. The list was documented, accessible, and set up to be reviewed quarterly as the landscape evolved.
A data classification guide. Employees now had clear guidance on what kinds of information could be fed into AI tools and what couldn’t. Public information, general research, internal drafts with no sensitive content — generally fine. Client briefs, financial data, personnel information, proprietary business strategy — not for AI tools outside the approved enterprise stack.
An enterprise AI solution. For the use cases where Jenna and others genuinely needed AI writing assistance with sensitive content, Xpert helped Meridian implement an enterprise-licensed AI platform with explicit data privacy commitments — one that contractually guaranteed that submitted content would not be used for model training.
A communication rollout. The policy wasn’t just written — it was communicated. Xpert facilitated a brief, practical training session for team leads across every department, focused not on the legal language but on the real-world reasoning: here’s what AI tools can do, here’s where the risk lives, here’s what we’re asking you to do differently.
Jenna attended the session. Afterward, she approached Xavier and told him she felt terrible about the whole thing.
Xavier told her she shouldn’t. She’d been doing her job well, with the tools available to her. Now she had better tools and better guidance.
“That’s how this works,” he said. “We find the gap, we close it, we move on.”
The Broader Conversation
The AI tool conversation is happening at every company right now — or it should be. AI has moved from novelty to infrastructure faster than most organizations have been able to build governance around it. Employees are using it. Productivity is improving. And in most cases, nobody in leadership has a clear picture of which tools are in use, what data is flowing into them, or what the platforms on the other end are doing with it.
That’s not a technology problem. It’s a policy problem. And policy problems are solvable — provided someone is asking the right questions.
Xpert asked them. Meridian had answers before the next client call.
Was that the competitor’s ad a coincidence?
Nobody ever found out for certain. But Meridian’s client stayed. The messaging framework was rebuilt on the new platform. And the next campaign brief Jenna drafted was handled with tools she could confidently stand behind.
That’s not a small thing.
Coming up in the next installment of The Xavier Chronicles: Xavier gets a call at 2 AM. Meridian’s file server is encrypted. A ransom note is on every screen. And it all started with an email someone clicked three days ago.
Meridian Group is a fictional company. Shadow AI — the use of unapproved AI tools across an organization — is one of the fastest-growing and least-governed risks in business technology today. Xpert Technologies helps growing companies in Metro Detroit build technology environments that work for their business, including practical AI governance frameworks that protect client data without slowing teams down.
Do you know which AI tools are running inside your organization right now? Maybe it’s time to chat with an Xpert.
#ArtificialIntelligence #ShadowAI #DataPrivacy #AIGovernance #CyberSecurity #MetroDetroit #XpertTechnologies