Published on the 16/07/2026 | Written by Heather Wright

Productivity today, competitive risk tomorrow…

While executives worry about employees secretly using ChatGPT, AI governance specialist Dean Robb says organisations may be missing a bigger threat.

Every document uploaded, process automated and workflow handed to AI is helping build systems that could eventually outperform the very businesses feeding them. Productivity gains are real, he told iStart, but so are the unintended consequences, particularly for companies deploying AI without fully understanding where their data, knowledge and intellectual property end up.

“Everyone disregards the unintended consequences until it bites.”

A recent report found 40 percent of Australian office professionals have entered customer data or information into public AI tools, with 28 percent admitting inputting financial information or disclosing confidential company documents or strategies. Shadow AI Survey also noted that 70 percent of those surveyed have used AI tools or services at work despite not being allowed under company policies – and over half (53 percent) have faced formal consequences, such as a warning or disciplinary action, due to unauthorised AI use.

But Robb argues the issue isn’t simply whether staff are using AI. It’s how organisations are using it, what information is being shared with AI systems and whether anyone has thought through the consequences.

“Everyone disregards the unintended consequences until it bites,” he says.

Robb believes most employees are acting with good intentions. They’re looking for faster ways to complete tasks, improve reports and eliminate repetitive work. In many cases, they’re right: AI can dramatically improve productivity.

The problem is that productivity gains can obscure risk.

One of Robb’s biggest concerns is the amount of organisational knowledge being fed into public AI platforms. As staff upload documents, workflows and business information to improve outputs, organisations may be unintentionally giving away IP and expertise.

“[The foundation model providers] own the IP and you are training them to be better than you are,” he says.

Last month, Microsoft CEO Satya Nadella warned about the unintended consequences of AI, including the ‘reverse information paradox’ where enterprises unknowingly give away their proprietary institutional knowledge and competitive advantage simply by utilising third-party AI systems to boost productivity.

That’s just one unintended consequence Robb says companies need to consider as AI adoption accelerates. Another is the ease with which well-intentioned employees can create data exposure risks while trying to be more productive.

That, however, isn’t a new phenomenon. He recalls regularly dealing with incidents at a major bank where staff moved documents outside secure environments in order to work faster – sending a PDF to their home PC to convert it and send back to the work PC, for example. The intention was never malicious. Employees were simply trying to get the job done. But once sensitive information left the bank’s systems, a security breach had occurred and it was a summarily dismissible offence.

Robb sees similar behaviour emerging around AI tools today.

“Now, if I’ve loaded company data in to get that, that company’s got a genuine exposure,” he says.

For tech leaders, that means the challenge is no longer just identifying unauthorised AI use. It is understanding what information employees are putting into AI systems and whether appropriate guardrails exist around that behaviour.

Robb says regulated organisations, particularly financial institutions, have already invested heavily in governance and controls. “Banks have already stopped their people sending data to their iPads. It’s really hard to get data out of a bank or an insurance company.

“But when you’re a smaller business, the data’s everywhere.”

At the same time, companies are moving beyond AI experimentation.

Many of the early AI projects focused on incremental improvements – better reports, improved customer service or small efficiency gains. Robb says the next phase is different as businesses start to redesign entire processes around AI.

“It’s moved from incrementalism to step changes in processes.”

That shift creates new opportunities but also new risks. He cites the example of a plumbing business that has automated significant amounts of administrative work using AI. Compliance documentation and other repetitive tasks that once required multiple staff are now largely automated. The business gains efficiency, reduces effort and lowers its cost to serve customers.

The broader question, however, is what happens when competitors follow.

“If you have a lower cost to serve, you will kill your competition. Ai is a lower cost to serve.”

For business leaders, that’s a reminder that AI governance isn’t just about risk management. It is also becoming a competitive issue. Organisations that fail to adopt AI may find themselves at a disadvantage. Organisations that adopt it recklessly may create security, compliance or intellectual-property problems they don’t yet understand.

So what should companies be doing now?

Robb’s answer, unsurprisingly given he runs an AI governance consultancy, is governance. Not governance as a brake on innovation, but governance as a way of avoiding the ‘we’ll deal with that later’ approach that has accompanied many AI deployments. The question, he says, isn’t whether organisations should use AI. It’s whether they’ve thought through what happens when productivity gains collide with compliance obligations, security risks or unexpected business outcomes.

He says every organisation deploying AI into production should have a governance plan appropriate to its size and risk profile. For larger organisations, that means asking practical questions:

Does the AI initiative have board approval and a defined business outcome?

Is a human accountable for customer-impacting decisions?

If you lost control of your AI model, could you regenerate using using paper and pen, the data and the answers to get to the same position within 24 hours?

Does the business understand what data is being shared with AI tools?

An AI governance pack Robb’s company developed for banks and listed companies warns that AI governance is no longer optional and ‘we have a policy’ is no longer an answer – and ‘we are not doing anything yet’ is not a defence.

The pack outlines six guardrails:

• Strategic alignment – is AI use tied to risk appetite and corporate strategy),
• Accountability – who owns each AI system end-to-end?
• Explainability – can you explain a decision to a regulator or customer?
• Human oversight
• Monitoring and adaption – are models monitored for drift, bias and performance, and
• Organisational ethics

“If your board cannot score itself against these six, you do not yet have AI governance,” the pack says.

Smaller businesses? They’re exempt to some degree, he says. “If you’re say a five person plumbing business and you’re using AI to do training or something, honestly, congratulations, you’re curious, you’re using the tools. You don’t need a governance plan because you’re aware of the boundaries of what you’re doing.”

Putting in the wrong parts won’t be the end of the world – and it’s probably something you sometimes did pre-AI anyway.

Robb isn’t advocating caution at the expense of innovation. In fact, he believes many organisations across Australia and New Zealand have been too slow to realise AI’s potential.

Instead, his message is to stay curious, move quickly and prepare for the downsides, rather than ignoring them.

“AI is more valuable than it is detrimental,” he says. But organisations also need a plan for what happens when something goes wrong.