Mid-market: Unmanaged AI adoption is now one of your biggest blind spots

Across NZ small to medium businesses, AI has already arrived – but not in a way boards or IT leaders are comfortable with. Staff are quietly pasting customer data, contracts and into free AI tools. Different teams are experimenting with Copilot, ChatGPT on their own, often with no policy, no governance and no record of where information is going. The net result is the same everywhere Lexel looks - rising executive pressure to “do something with AI”, but no shared plan, no risk register and no roadmap that IT can realistically deliver.

The problem: AI is already in your business, but no one owns it

Most organisations still talk about AI as if it’s a future project. In reality, AI is already baked into everyday tools and workflows:

• Staff use free AI tools in their browser to rewrite emails, summarise documents or translate content.
• Office platforms, CRM, finance and HR systems may have AI features built in, but not enabled by the business or AI features aren’t used due to internal training.
• A few “AI champions” spin up pilots with Copilot, chatbots or automation while the rest of the business watches from the sidelines. All too often the starting point is based on bespoke or narrow use cases with specific robotic process automation as the outcome

From conversations with customers, three consistent issues appear:

• Data risk with no defendable position
  Leaders worry that confidential information is leaking into public AI services, but they lack a documented policy or audit trail. If something went wrong tomorrow, they would struggle to show regulators, customers or insurers that reasonable steps were taken. Personal information, commercial confidentiality, other datasets and policies remain such an Information management blocker, stopping many AI initiatives in its tracks.
• Fragmented efforts and shallow impact
  A handful of enthusiastic users get big productivity gains, but the organisation as a whole does not. There is no coordinated plan, so AI remains a scatter of experiments rather than a capability the board can bank on.
• Stalled decision‑making at the top
  Boards and executives feel the pressure to “adopt AI” but don’t know what “good” looks like for a 12‑month horizon. IT is left fielding vague requests (“we need Copilot”) without the strategy, governance or budget to implement AI safely and systematically.

Unmanaged AI is no longer a technology issue. It’s a governance and business‑risk issue.

Introducing Lexel’s AI Adoption Framework

This gap between board expectations and IT capacity is a key problem we solve via our ‘AI Adoption Framework’ – so let me break this down for you.

1. For AI initiatives to get off the ground, the IT team and the board must be aligned.
2. In most cases, the board wants a plan, but no one can give it to them.
3. The IT team want the money, but have no plan.
4. The Framework brings a plan for IT, confidence to the board, and money for the plan.

Instead of jumping straight to tools or custom AI projects, the framework provides the business with a structured roadmap - which is tackled stage by stage, from completing core foundational projects first (like office productivity), and leaving advanced projects (like automation) for later, once the compliance related measures are in place.

The AI adoption framework helps leadership teams;

• Choose a realistic AI maturity target.
• Assess where the business really is today (not just what early adopters are doing).
• Map out the policy, platform, security, data and training steps to get from here to there.

We typically present the framework to IT leadership as a first step, and once circulated internally, we’ll present to the board. From there we agree and kickoff with sprint #1 (within the framework) and move on from there as the business progresses in maturity across the 5 stages. The presentations are both free of charge. 

For this blog series, we are going to unpack the first four levels – the stages where most NZ organisations will get the fastest, safest return – and briefly signpost what sits beyond them. Start with Blog #2 below.