AI Adoption in Companies: How to Govern It

By Antonio Giarrusso, founder of Userbot and Head of AI at the smeup group · November 2026

Adopting AI in a company with clear rules means giving people one official tool, as convenient as their personal ones, where models, company knowledge and agents all live. The tool enforces the rules: who can use which models, with which data, within which spending caps. Every step is logged, so usage can be checked and explained.

The question isn’t whether to use AI. It’s how.

In almost every company I meet, AI has already come in, just not through the front door. Someone summarizes contracts with a personal AI chat, someone pastes in a customer’s data, someone has installed an extension that reads their email. According to UpGuard’s “State of Shadow AI” report (November 2025), more than 80% of workers use unapproved AI tools. It’s called Shadow AI.

The instinctive reaction is to ban it. But a ban doesn’t remove the need: it moves the use out of sight. The company loses control of its data and, along with it, the productivity gains its employees had already found on their own.

What you actually need: four pillars.

Governed AI adoption rests on four things, and they need to live in the same place.

Model agnosticSeveral models in the same environment, chosen by task and cost. No lock-in to a single vendor.
Company knowledgeAI answers from the company’s documents, procedures and data, not from whatever it finds online.
Agents and workflowsFrom answer to action: agents that open tickets, update orders and work inside existing systems.
GovernancePermissions by group, spending caps, a log of every step, data in the EU. The tool enforces the rules.

Where to start, in five steps.

1Map real usageWho already uses AI, for what, with which tools and which data. No witch hunt: the point is to understand the need.
2Choose a single perimeterOne official environment for models, company knowledge and agents, accessed with company credentials.
3Give people a better tool than their personal oneIf the official tool is less convenient than the personal chat, people will go back to the personal chat.
4Start from use cases by departmentTwo or three concrete tasks per area: customer service, sales, HR, finance. Better a few use cases people rely on every day than a hundred demos.
5Measure and expandActual usage, time saved, costs by department. Then you move from assistants to agents that do work inside processes.

How to measure adoption.

Activated licenses tell you nothing. These numbers do:

Weekly active people, by department: how many actually use the official tool.
Use cases in production: recurring tasks where AI has become part of everyday work.
Time saved on those tasks, measured before and after on a sample.
Cost by department and by model, to see where a smaller model makes sense.
Off-perimeter usage: how much traffic to unapproved tools remains, and whether it’s falling.

The mistakes I see most often.

Buying licenses and stopping there. Activated licenses aren’t adoption: what counts is how many people use AI every day for real work.
Picking one model for everything. Models change every few months; tying yourself to one means redoing everything at the next switch.
Writing the policy and calling it done. A rule the tool doesn’t enforce is a suggestion.
Starting from the technology. The hard part is getting 200 people to use it on Monday morning.

What we do with Userbot.

Userbot, which I founded in 2017, is today the Italian platform for governed AI adoption: chat, multiple models, company knowledge, agents and workflows in a single perimeter. It is part of the smeup group and is cited in nine 2026 Gartner® Hype Cycle™ reports. Even before AI for employees, we brought AI agents to customers and citizens, with public case studies such as ENEA, CupSolidale and the City of Bologna.

See the public case studies or go to userbot.ai.

Want to start here?

Tell me where you’re starting from: I’ll reply myself, or the Userbot team will.

Request a demo

Frequently asked questions.

What is Shadow AI?

It’s the use of AI tools the company hasn’t approved: AI chats with personal accounts, extensions, external apps. Company documents and data often end up in them, without the company knowing where they go or who keeps them.

Should companies ban ChatGPT and other AI tools?

Usually not. A ban doesn’t remove the need: people keep using AI, just less visibly. It works better to offer an official tool, as convenient as personal ones, with clear rules on data, models and costs.

What does a model-agnostic approach mean?

It means not tying yourself to a single model vendor. The company can use GPT, Claude, Gemini or open-source models depending on the task, the cost and the data requirements, and switch models without rebuilding processes and integrations.

How do you govern AI use in a company?

With a few rules enforced by the tool, not just written in a policy: who can use which models, with which data, within which spending caps and which actions agents are allowed to take. Every step must be logged, so usage can be checked and explained.

Where do you start?

With how people already use AI today. Then you choose a governed perimeter, start with two or three concrete use cases per department and measure real usage, not the number of activated licenses.