The first time I used AI for work, there was nobody to give me permission. It was my business, and if there was going to be a rule about how AI was used, I would have had to write it. I had not, and in truth, it had not crossed my mind once.
The business was closing; unfortunately, not by choice. There were letters to write to suppliers and customers that I simply did not have the words for, people who deserved better than what I was able to give them at such an emotional time. I sat in front of a blank screen for a very long time. Then I opened a free chatbot and asked it to help me say something difficult with a bit of dignity.
I was not being reckless. I was drowning, and I had found something that kept my head above water for another hour.
So, I’m not writing this as the person who spotted a risk early. I’m writing this as the leader who used the tool first and thought about the governance a long way afterwards. Which is why I have very little patience for the version of this conversation that treats front-line staff as the problem.
“We have not implemented AI yet” is almost always wrong
I have sat in management meetings where a senior team has confirmed, with total confidence, that AI is not yet part of the operation. Then I’ve gone downstairs.
Reception is pasting guest complaints into a chatbot to make the reply sound less defensive, a duty manager has uploaded three months of booking data because the reports don’t answer the question they’re being held accountable for and someone in HR has rewritten a disciplinary invitation along with the name of the employee it concerns.
None of these people are trying to damage the business. They are simply trying to do the job well with the tools they’ve been given. Which in most hotels amounts to a line in an induction pack and an assumption that they’ll work out the rest.
This is not just a hospitality quirk.
IBM’s 2026 Cost of a Data Breach Report found that security incidents involving shadow AI had more than doubled in a year, from 20% to 43%. Among breached organisations, 68% lacked AI governance to manage AI or detect shadow AI.
And here is the uncomfortable part: often, the people already using AI without permission aren’t your weakest employees; they’re some of the most resourceful. They have hit a problem that the systems around them haven’t been able to solve, so they have turned to AI to find their own way through.
The source of truth is already broken
Ask any front-line staff where they’d go when a guest asks something they don’t know, and they won’t say the SOP folder. They’ll say the website, because it is the only reference they can reach in ten seconds whilst a guest stands in front of them waiting for an answer.
Here is how this scenario runs.
A guest asks what time dinner service ends. The receptionist does exactly what you would want them to do: tells the guest they will find out. They then open the website but have no idea it is lying to them. Dinner times are last summer’s; the menu still lists two dishes the kitchen dropped in spring and children’s swim times have not been touched since roughly 2006.
The receptionist is not being careless; they are reading the source of truth the business gave them. The problem is that it’s years out of date, because the marketing manager is on their fourth last-minute campaign of the month and updating the swim timetable sits firmly at the bottom of a list that never ends.
Now let’s add the bit that makes this urgent rather than merely embarrassing. AI assistants and search systems will draw on that same public information. When a guest asks about your accessibility, dog policy or dinner service, what you have published may become part of the answer. You’ve probably been broadcasting past truths for years, but the difference now is that inaccurate information can now travel much further, to people who may never ring you to check.
My advice; fix the website before you buy a single piece of AI. It’s the least glamorous readiness work there is but it removes more risk than most of the technology projects sitting in front of you.
Read it as a diagnostic, not a data breach
This is where the industry conversation goes wrong. Unmanaged AI use gets treated purely as a security incident waiting to happen, which it certainly can be, so leadership responds with prohibition. Prohibition moves the behaviour onto personal phones, where you can neither see it nor govern it.
An operator’s instinct should be different and each of those behaviours is telling you something specific. Reception rewriting complaint responses means your templates are unusable or nobody has shown the team what good looks like, managers uploading spreadsheets means your reporting does not answer the questions your managers are judged on and HR documents going through a chatbot means somebody is carrying an employment relations task they have never been trained for in a legal area where being wrong is expensive.
The workaround problem is not new. Long before any of this, I watched a shiny new SOP get written, circulated and quietly filed under B-1-N. It didn’t survive contact with a real shift, and your employee (let’s call him Jeff) built their own version. Jeff’s version worked. Jeff’s version also lived entirely inside Jeff’s head. Jeff has since left and Jeff’s process walked out of the door with him.
AI did not create that problem it just made the workaround faster to build, harder to see and easier to get wrong. Fix the underlying process and the risky shortcut loses its purpose. That my friends, is ordinary operational management that just happens to look like a technology story.
What to do before you write a policy
Most properties I assess do have something written down about AI. It’s usually a document in a shared drive, written by someone in legal, that four people on the board have opened. That is not governance; it’s decoration.
1. Give people somewhere approved to go. You cannot govern a behaviour you have banned. A properly configured business account, with appropriate privacy, access and data controls, removes one of the biggest sources of avoidable exposure. The tool matters far less than it existing and people knowing they are allowed to use it.
2. Give them a rule they can remember mid-shift. Not a fourteen-page document they will never read. This:
Then name the moments where a human signs off without exception e.g. anything touching allergens, accessibility, safety, pricing, legal wording, or a genuinely upset guest. AI can produce the draft, but a human owns the answer.
Finally train your team with examples from real roles. A housekeeping supervisor and a revenue manager need the same rule but completely different examples, which is why teaching your team generic training slides will change nothing.
The confidence problem
In all of this, not one person has ever come to me and asked whether they were allowed to use AI for something. What I get instead, when the moment AI comes up in a meeting, is a room full of experts. Everyone has used it; everyone knows how it works and nobody can be told anything. You then establish that the sum-total of the AI expertise of the team is turning the head chef into a Renaissance oil painting for the canteen WhatsApp group.
This is not confined to my meetings. PagerDuty’s 2026 shadow AI survey found that 72% of office professionals believe they understand how to use AI in their job better than the people responsible for managing AI at their company.
Most of them are wrong but all of them are confident and that confidence is the actual risk, and it is worse than ignorance. Someone who knows they don’t understand a tool asks questions. Someone who believes they have mastered it because they created a comical picture doesn’t think there is anything left to learn about what should never be typed into it. Nobody asks permission because it doesn’t occur to them that permission is a thing this requires. Pasting a guest complaint into a chatbot doesn’t feel like a data transfer it just feels like using spellcheck.
That gap is not closed by a policy; it is closed by somebody senior enough to matter saying out loud, in a room where the whole team is present, what this tool is for and where it stops. You cannot assess readiness from the boardroom, because the exposure is not in the boardroom. It is at reception, in the revenue office, and on somebody’s personal phone during a split shift.
So, the question is not whether your hotel has implemented AI. It has.
The question is whether anybody is managing it, and whether that person knows they are.
And if your website still has 2006 swim times on it, you are in extremely good company.
Byline note
Francesca Wood spent nearly twenty years in hospitality operations and commercial leadership, including General Manager and Head of Commercial roles, before founding FAI Consultancy. FAI works only with hospitality businesses on AI readiness and implementation. She sits on the AI Hospitality Alliance’s AI Readiness Framework committee. Faiconsultancy.com