Once you start approving AI tools, the policy is the easy part. Jim Smith on vetting, access limits, human review and the broken processes AI makes worse.
Most companies start their AI governance by writing a policy. Jim Smith, Managing Partner at Total Technology Resources (TTR), is blunt about its limits: “Like any policy, just because you’re making people aware that the policy exists doesn’t actually stop them.”
That gap gets wider once a company starts choosing and approving its own AI tools. A policy can say which tools are allowed. It can’t tell you whether a tool was vetted, what it can reach, who checks its output, or whether it’s fixing the right problem. Partnering with Total Tech Resources for managed IT services in Philadelphia helps organizations mitigate these vulnerabilities.
This post is for owners and leaders who are moving from “AI is happening” to “which AI should we approve of?” If you’re still finding out what employees are using without approval, start with “We’re Not Using AI Yet.” You Probably Are. If you run a regulated enterprise and your main concern is cyber insurance and liability, see Shadow AI Discovery: Protecting Corporate Liability and Insurance Eligibility in 2026.
The biggest mistake Jim sees right now is the rush to deploy an AI or automation application without properly vetting it, then letting people use it before anyone has been trained.
The pressure is easy to understand. Competitors are talking about AI, the buzzwords are everywhere, and owners keep hearing that if they aren’t using it, they’re already behind the eight ball. Jim’s answer:
“Just because that might be the case doesn’t mean you have to rush to an AI solution. You still have to vet it. You still have to make sure that solution is going to help you in the long run.” — Jim Smith, Managing Partner, Total Technology Resources
When companies skip that step, the tool can do the opposite of what they wanted. Teams spend more time training the chatbot or application than it saves them, sometimes spend more money too, and still don’t get the result they needed.
What happens when you put AI on top of a broken process?
The broken process gets bigger, not smaller. In Jim’s words:
“When you introduce AI to an already broken or flawed process, it just magnifies the flaw in the process itself. AI is not going to fix that process. It’s just going to add a more complex aspect to it.” — Jim Smith, Total Technology Resources
The AI step becomes one more thing someone has to manage. It can make its own mistakes. Depending on where it sits in the process, it can create more work for the person who has to check its output.
Some companies decide to build an AI fix themselves anyway. Jim’s first concern there is security, especially whether the team is feeding too much information into a free service, where consumer terms can allow conversations to be used for model training. His second is time. If someone who isn’t especially technical spends business hours building an AI solution, the company can burn a lot of paid time on it.
Before you approve a tool, decide what it’s for
When a CEO says “we need an AI strategy,” Jim starts with what the strategy is supposed to fix. Deploying AI without a target doesn’t achieve anything. A better starting point is a process you already run that isn’t efficient or needs too much human handling. He asks three questions:
- Which daily tasks do you or your employees repeat?
- How much of your data entry is repetitive?
- What part of the day feels very manual and could be automated?
When a client brings TTR an AI idea, Jim applies a similar filter. Removing manual data entry or a repetitive task gets serious consideration. A request to replace a person, or to replace a complex system or software application, makes him step back and ask what the client is ultimately trying to achieve. He also weighs whether he has fixed a similar problem before, such as an order-entry or customer-entry process, and how long a solution would take to build. If it would take a large investment of hours, it may not be good for the client or for us.
Sometimes the answer is “not yet.” If the process is too flawed, the first job is to map it: where it’s lacking, which part is failing, and whether existing software or a workflow change would fix it without AI. In Jim’s view, a company is ready when leadership has mapped the entire process, fixed everything it can internally, and can point to the specific place in the workflow where AI belongs.
What “not yet” looked like for two TTR clients
TTR works with professional-services firms and operations-heavy businesses, including law firms, CPA firms, RIAs and manufacturers. Here are two recent examples, with identifying details removed.
A law firm. The firm brought us in to assess its AI readiness. The assessment pointed somewhere broader: too much of the firm’s operating discipline still lived in people’s heads, inboxes and follow-up habits. Its written procedures depended on staff remembering, checking and chasing, so smaller matters slipped behind bigger ones. Work done in one place didn’t reliably make it into the official record. And employees were already using AI tools before the firm had a policy for them.
We didn’t recommend a broad AI rollout, which would have sped up isolated tasks without fixing any of that. We recommended making the system carry the procedure first, so owners, overdue steps and exceptions are visible without someone checking by hand. AI would then be tested in a controlled pilot with a small group of users, defined access and review controls, and clear criteria for success and for stopping. As we told the firm, a documented process says what should happen. A system-supported process helps make it happen.
A company with field operations. Different departments used different tools, but staff everywhere spent time on the same job: confirming what was actually true, such as what happened on a job and who did the work, before the next step could go ahead. A single job could pass through several systems, spreadsheets and email before its record was complete.
Our advice was to fix the most critical workflow first: capture information once where the work happens, keep its status current as the work changes, and flag predictable problems automatically so people only handle what needs judgment. AI is on that company’s roadmap, but last. It earns a role once the underlying workflows, data and access rules are dependable. The rule we gave them: choose the technology after the requirement is clear. Mobile apps, integrations, dashboards and AI are possible methods, not predetermined answers.
Limit what an approved tool can reach
Once a tool is approved, Jim’s first question is about security: what does the AI have access to inside the organization? His rule of thumb is to start narrow. Let it read information, not write it. Let it monitor equipment, not manage it.
That line matters most for a manufacturer connecting AI to plant systems or equipment. “If AI is just monitoring the equipment, that’s one thing,” Jim says. “If AI is managing it and making decisions, that could be another.” Without proper guardrails, that second case is where it gets dangerous.
Keep a person on the final call
In Jim’s experience, AI tends to work well when it copies, enters or pulls information from one system to another. It breaks down when it’s asked to create something, or when it summarizes material and adds content of its own. For a manufacturer, the trouble starts when AI makes a decision without a person overseeing the end result.
For a plaintiff law firm, the useful side is real. Jim sees AI organizing case documentation, keeping everyone on a case in the loop, and bridging systems that don’t talk to each other, so staff stop entering the same information into several applications. The risky side is any time AI creates or summarizes information for a case. That failure is now common in court filings: a database kept by researcher Damien Charlotin had logged 1,397 U.S. cases with AI-hallucinated content, usually fake citations, as of May 6, 2026.
Before AI goes into a firm’s workflow, Jim says a managing partner should understand two things: every AI implementation carries some risk, and it won’t take the human out of the loop. There is still a need for a person, just slightly less.
Know which tools touch client data
For CPA firms, the tension is between efficiency and client data. Jim’s advice is that a partner should know exactly which AI systems are in use, and what risks each one carries, before letting anyone use AI with client information. Client data should only be reviewed on a platform or model that won’t train on your data, and therefore won’t train on your clients’ data.
Registered investment advisers face the same issues as other businesses, Jim says, with higher stakes. Given the money under management, the number of clients and the volume of PII on their systems, the possibility of a leak is higher for firms that serve high-net-worth individuals.
Jim’s three rules for using AI well
- Use AI securely. Don’t let company, client or employee information leak out to an AI chatbot or an AI company that isn’t secure.
- Put one person in charge. Someone inside the company should manage your AI tools, rather than leaving them to a loose collection of employees.
- Don’t rush. Don’t deploy an AI tool because it’s a shiny new object. Make sure it’s the right solution first.
Where to start
Before you approve your next AI tool, write down the process it’s meant to fix, what it will be able to reach, and who checks its output. If you can’t answer those, the tool isn’t ready, whatever your policy says.
TTR’s COMMAND Core includes guidance on adopting AI tools and automation safely within day-to-day operations. For organizations where AI is going into regulated or complex workflows, COMMAND Complete adds governance for AI tools, data use and automation risk, plus advisory support for leadership decisions about AI adoption. Start a conversation with our team before your next AI rollout.
About the Author: Jim Smith
Jim Smith is a Managing Partner and Co-Founder of Total Technology Resources. With over two decades of experience in IT and systems management, Jim helps regional businesses navigate technology decisions, infrastructure design, and digital security. As a recognized leader in the managed services space, he works closely with client leadership to mitigate risk and optimize operational efficiency.