Editor's note — September 12, 2026: Withdrew unsourced 58% and nearly-half figures; corrected the inference that missing visibility proves active data leakage; made pause recommendations proportionate.
The take
Management's view of AI adoption should be reconciled with what practitioners can observe. A visibility gap is a reason to investigate; it is not by itself proof that data has leaked.
What I would request
An inventory of approved tools, a documented method for detecting unapproved use, evidence of data flows for sensitive workflows, and a process to resolve discrepancies between policy and practice.
If a specific deployment creates uncontrolled material exposure, restrict that deployment while the risk is addressed. Where the issue is incomplete measurement, establish the missing evidence and a proportionate remediation plan. A blanket pause on all AI can carry business costs without resolving the underlying control problem.
The board should receive both the adoption picture and the limits of management's visibility.
Source and further reading: Primary reference. Framework guidance is not a statement that a particular law applies to every organization.