I have worked in organisations where the policy said no.

No to the tool. No to the approach. No to the experiment. The directive came from the top and became the ceiling for everyone below it.

I did not stop. I found ways around it. I participated in shadow AI before anyone called it that. The policy did not stop the work. It made the work invisible.

This is not unique to AI. Big organisations with red tape have always had idle workers who find ways to fill available time with something useful. Until they are needed again. Until the project arrives. Until the restriction lifts. And then the person who spent their quiet time building the skill is suddenly the most valuable person in the room, and nobody quite knows why.

The dumb policy was my fuel. The restriction told me where the leverage was. I used AI to understand the policy. I used AI to build the case against it. I will be the persistent challenge to the idea that does not hold up, the directive that protects something that no longer needs protecting, the rule that made sense once and now just makes noise.

The risks of AI are real. Handle them. They are not one-sided. They are existential in both directions: the risk of using it badly, and the risk of not using it at all. A policy that treats only one of those as the threat is not a risk management policy. It is a preference dressed as governance.

Do you have a culture where available time is filled with something that matters? Where people are recognised for the extra they do, publicly, in person, and financially? I am driven internally. I am also not naive. Do not exploit the internally driven and then wonder why they eventually leave.