A housing authority discovers caseworkers used unsanctioned AI on personal tenant chats. What is the most appropriate strategy response?

Refreshing AI strategy and policy to address shadow AI with approved tools and tenant-data protections together is the action that turns the discovery into a control improvement. The housing authority's caseworkers found a gap between policy and reality—they were using unsanctioned AI because it solved a problem faster than official channels. This is a signal that governance was too restrictive or too slow, and the authority must respond by: expanding the approved-tools list, adding monitoring to catch future shadow AI, and updating policy with tenant-data protections at the same time, not after. Ignoring the finding means the gap will reappear.

Tasking the data governance board to audit tenant chats for shadow AI, tool use, and data safeguards is a blind spot: an audit documents past exposure but does not set strategy, authorize approved tools, or impose tenant-data protections for future use. Updating the AI risk register to log shadow AI, approved tool status, and tenant-data exposure leaves the exact risk this incident exposed unaddressed in the interim; tenant chats contain the sensitive data that needs protecting now through enforceable policy, not just a log entry for a later cycle. Tasking the data governance board to audit tenant chats for shadow AI, tool use, and data safeguards without a strategy and policy refresh is a transparency illusion: it measures exposure while leaving the privacy breach to continue in plain sight. Publishing IT operating procedures for approved tenant-chat tools with tenant-data handling controls without first refreshing strategy and policy creates ongoing exposure: procedures describe how to use tools but do not resolve shadow AI at the governance level, authorize the tool set, or embed tenant-data protections authority-wide. The response must be to establish approved, contract-governed tools with tenant-data protections built in—not just logged.

Operational check: within 60 days of the finding, the authority has: (1) documented which unsanctioned tools are currently in use, (2) assessed the data-handling practices of each, (3) added low-risk approved alternatives to the official tool list with tenant-data protections defined, and (4) implemented a shadow-AI detection mechanism (logging proxy, browser policy, or spot audits).