Phase 1: Explore
Offer amnesty for hidden use
Treat quiet AI use as early pilots, not policy violations.
Many employees already use AI and keep it to themselves. Punishing them teaches everyone to hide and can set off an "AI winter." Instead, thank people for trying to work better, then show safer ways to do it.
Amnesty covers the person, not the incident. No one is disciplined for experimenting. But if sensitive data left your systems, route it to whoever owns privacy so it gets documented and handled.