Playbook2 October 2026

A four-question test for whether your business needs a written AI rule yet

Four quick questions that show whether your team's ad hoc way of using AI still holds up, or whether it's time for one written rule.

In a small team, everyone just opens whatever AI tool they like and uses it their own way. That's fine, until someone pastes a client's details or a financial number into a chat without thinking twice, or you find a charge at the end of the month for a tool nobody remembers opening.

Here's a four-question test for whether your ad hoc setup still holds up, and which of three situations you're actually in if it doesn't.

Start with the basics

KPMG surveyed 2,131 senior leaders across 20 countries, and found that among companies already seeing a real return from AI, 86% run what the survey calls a formal "harness layer": one standing interface the whole organization uses, instead of everyone going it alone. Among companies still experimenting, only 31% have one. What that layer actually contains, per KPMG, is mostly four things: who's allowed to log in, where data is allowed to go, who reads what AI produces before it goes out, and who tracks what it costs. You don't need to be a global company to check those same four things in your own.

There's also a hint of where this is heading. KPMG writes that mature organizations are moving "from cost control to AI economic management," and 77% of them already watch spend on a standing dashboard, against 43% of the experimenters. You don't need a dashboard. You just need an answer faster than "let me check" the next time someone asks what you're paying for.

Four questions, no scoring, just an honest answer

If you answered "not sure" to more than one, that's already an answer.

  1. Does everyone using AI for work log in with their own account?One shared password going around isn't less work, it's "no idea who did what."
  2. If someone pasted a client's details or a financial number into a chat today, would that break a promise you made to someone?Not "is this generally fine," but whether there's a contract, an NDA, or a specific rule it actually conflicts with.
  3. Does anything AI produces go straight to a client or a regulator without a person reading it first?Not every output needs a check. But if the answer is "yes, it goes straight out," that's worth noting.
  4. Could you say right now, without checking, roughly what the business spends on AI tools a month, and on what?Not the exact number. Just whether you have a rough idea, or it's scattered across subscriptions you've half forgotten.
Keep it looseAll four came back fine. There's no real risk piling up, just recheck this once the team doubles or a client shows up with its own requirements.
Write one pageOne or two came back shaky, mostly around data. Write one clear rule about what does and doesn't go into an AI tool, and send it to everyone, not just whoever's new.
Name an ownerThree or four came back shaky, and the team is growing. The next step isn't a page, it's one person whose job is knowing what's running and what it costs. KPMG found that 53% of companies already seeing returns put that accountability with someone in senior leadership, rather than leaving it spread out.

The order here matters. The temptation is to start with a budget, "how much can each person spend on AI a month," because that feels like something you can write quickly. But a budget before a data rule just limits how much people experiment, without fixing the risk that actually worries you. Start with where the data goes, not with the money.

Ramp's lead economist Ara Kharazian found that AI spend is actually falling even as usage climbs, driven mostly by price competition between the model makers, not by anything your team changed. That's one more reason the data rule comes before the budget rule.

Do this next

Go through the four questions with whoever runs the team, today, without digging for a precise answer. If you land on "write one page," write it by the end of the week and send it in the group chat, don't leave it in a folder nobody opens.

Sources
All guides