Your team is using ChatGPT in secret. What to do in the first 30 days.

An internal survey at a 17-person biotech confirmed what leadership suspected: almost everyone was using personal ChatGPT accounts. No visibility, no guardrails, core IP one casual prompt away from a leak.

That company is not unusual. 53% of C-suite leaders say they hide their AI use from colleagues. The official rollout sits in compliance review while the shadow use grows.

The pattern we hear most often: a company wants to move quickly, every attempt to get organized hits the security wall, and everything stops. The security questions are fair. The full stop is the mistake.

Run two tracks at once

Track A moves fast. Pick a standardized, properly configured platform. Write a usage policy a scientist or project manager can actually use on a Monday morning: what goes in, what stays out, and why. Train the whole team on their real work.

Track B moves carefully. The sensitive-data workflows, the infrastructure questions, the longer-horizon governance. It runs in parallel, so it never blocks Track A.

The first 30 days

Week 1: find out what people actually use. An anonymous survey gets honest answers that an audit never will.

Week 2: choose the platform against your actual requirements (data sensitivity, compliance constraints, geography) and set up the enterprise account with proper controls.

Week 3: write the usage policy. One page. Practical, specific to your sensitive categories, readable by the people who'll use it.

Week 4: train everyone, hands on, on their own tasks. Everyone leaves with at least one working prompt or assistant for the next morning.

Shadow use ends when the sanctioned tool is better than the secret one. That's the whole strategy, and it fits inside a month.