The information security manager learns that employees in several departments are pasting customer and internal data into public generative AI tools to speed up their work. Senior management has not yet taken a position on these tools. What should the information security manager do FIRST?

Emerging technology is handled the same way as any other source of risk: understand it, then let accountable management decide. The security manager should establish which tools are used, what categories of data are being entered, what the providers do with that data, what regulatory and contractual obligations apply and what business value the usage delivers. That assessment gives senior management a basis for a policy decision, which may be to restrict, permit with conditions or provide an approved alternative. Blocking every tool immediately is a unilateral technical decision taken before the risk or the business benefit is understood; it often drives usage to personal devices where it is even less visible. Approving use with only a voluntary guideline accepts an unassessed risk on management's behalf and leaves customer data exposed. Buying an enterprise license commits budget to one solution before requirements and risk are known. Exam caveat: if the scenario showed confirmed exposure of regulated data, interim containment could be justified while the assessment proceeds. Operational check: confirm a documented assessment exists, that its findings went to senior management, and that a policy decision with an owner and review date was recorded.