Diagnose first, invest later: why AI governance doesn’t start with tools

When an organization decides to govern the use of AI, the natural tendency is usually to start with the solution. A control platform, a corporate policy, or a list of allowed and prohibited tools.

The problem is that none of those decisions answers the fundamental question: what is really happening today inside the organization?

The situation is increasingly common. There are corporate Microsoft 365 Copilot licenses, specialized assistants in certain departments, and employees using different AI tools to solve specific needs in their daily work. At the same time, management needs to understand what value is being generated, what risks exist, and what the next steps should be.

It is precisely at that moment that many organizations make the same mistake: investing before diagnosing. And, as in any other area of management, it is difficult to make good decisions when you do not yet have a reliable picture of the situation.

The usual reflex: buying before measuring

Faced with the need to govern AI, three responses tend to appear.

1. The first is to acquire a control platform.
2. The second, to draft a corporate usage policy.
3. The third, to restrict or ban certain tools.

All of them are reasonable decisions. The problem is not the solution chosen, but the moment at which it is made.

A policy can hardly be applied if nobody knows which tools are actually being used. A platform will offer visibility into what it manages to detect, but not necessarily into the shadow AI that already exists beyond its reach. And bans usually produce a well-known effect: business needs continue to exist, so usage does not disappear; it simply becomes less visible.

In any other significant investment, management demands data before deciding. The situation is analyzed, opportunities and risks are identified, and only then is an action approved. The same should happen with AI. Before deciding what to control, what to allow, or where to invest, it is worth understanding what is going on.

What does it really mean to diagnose AI? 3 perspectives

Many organizations associate an AI diagnosis with reviewing contracted licenses or compiling an inventory of tools.

But that view is insufficient.

A useful diagnosis combines three complementary perspectives: reality, demand, and maturity.

Reality: which AI is actually being used

The first question is simple:

Which AI tools are currently being used? The answer can usually be found in sources that already exist within the organization:

• Sign-in logs.
• OAuth consents granted by users.
• DNS and proxy logs.
• Expenses associated with corporate cards.
• Information available in ERP, procurement, and finance.

These sources make it possible to build an objective picture of the real use of AI.

Which tools are used, how many users use them, in which departments they appear, and where there are solutions that are not part of the corporate catalog.

It is, in short, the map of reality.

Demand: what teams really need

There is something logs do not show. They do not explain why a person uses a tool. They do not indicate which problems they are trying to solve or what opportunities they perceive. That is why the second perspective consists of listening to the teams.

Short, anonymous surveys make it possible to identify aspects that no technical data can reveal:

• Emerging use cases.
• Unmet needs.
• Adoption barriers.
• Operational frictions.
• Automation opportunities.

The key is to present them as an improvement and enablement initiative, not as an audit.

When employees perceive that the goal is to understand how they can work better, the answers tend to be much more useful and honest.

Maturity: where the organization stands

The third perspective answers a more strategic question:

What is the organization's level of maturity in AI?

It is not enough to know the tools or understand users' needs. It is also necessary to assess the company's capacity to govern that reality.

This involves analyzing dimensions such as:

• Strategy and governance.
• Identity and data protection.
• Technology architecture.
• Training and adoption.
• Operation and monitoring.
• Measurement of the value generated.

The result is a snapshot that places the organization on a maturity scale, from scattered, uncoordinated use to industrialized and governed adoption.

Why a single perspective is not enough

Each of these perspectives adds value.

But none works on its own. Telemetry without context can turn opportunities into problems. Surveys without objective data remain perceptions. And maturity models without real evidence risk becoming theoretical exercises. Combining the three offers a much more reliable view of the situation.

From diagnosis to action: the risk × value matrix

A good diagnosis does not end with a report. It ends with decisions. That is why the goal is not to identify tools, but to understand what to do with the different AI uses that already exist in the organization.

A practical way to do this is to classify them using a risk and value matrix. Each use case ends up in one of four possible actions:

1. Automate. What delivers value, presents low risk, and can be scaled quickly.
2. Replace. Cases that generate value but could be solved more efficiently with corporate solutions already available.
3. Control. Uses that bring value to the business but require additional governance, security, or compliance measures.
4. Allow. Low-risk cases where introducing more control would create more friction than benefit.

The most relevant quadrant is usually the one with high value and high risk, because it normally contains tools that are already being used intensively to gain productivity. The answer rarely consists of banning them. The usual approach is to channel that need toward corporate alternatives that offer the same value with an appropriate level of control. And it is precisely here that investment starts to make sense. You no longer invest based on intuition. You invest because the data indicate where a real opportunity or risk exists.

A proven method, not an experiment

At Itequia we approach this process through a bounded initial engagement that combines three clearly defined phases.

• Scoping. We define the scope, the teams involved, the available sources, and the questions the organization wants to answer.
• Analysis. We combine telemetry, maturity assessment, and perception analysis to build a complete and objective picture.
• Results. We present management with a diagnostic report along with a prioritized action plan, focused on both reducing risks and generating value.

We also know that this picture has a limited shelf life.

AI adoption evolves quickly, new tools appear, and usage patterns change. That is why we propose the diagnosis as an exercise that can be repeated every three to six months, with comparable metrics that make it possible to measure evolution over time.

To do this, we draw on our experience with complex organizations and on our own tools, such as Opinatics, our platform for collecting and analyzing perceptions, which can even be deployed within the client's Azure environment when required.

Before governing AI, understand it

Most organizations do not have a tools problem. They have a visibility problem. Before deciding what to control, what to allow, what to block, or where to invest, it is worth answering a much more basic question. How is AI really being used within the organization? Only from that answer does it make sense to talk about platforms, policies, investments, or adoption plans. Because governing AI does not start with tools. It starts with diagnosis.

Do you want to know what a diagnosis would reveal in your organization? Schedule a 30-minute diagnosis session and we will explain what we would measure in your specific case, what information you could obtain, and how to turn it into a prioritized action plan for your organization. Contact us now.