A lot of owners think they have “done AI” because their team uses ChatGPT. They haven’t: using an AI tool and having an AI strategy are two different things, and the gap between them is where the risk and the wasted money live. This post covers what that gap looks like, the four things a real strategy needs, a worked example of the difference, and how to start without a 50-page document.
A chatbot helps a person. A strategy helps the business
ChatGPT is genuinely useful. It drafts, it brainstorms, it answers quick questions. But notice who it helps: the individual sitting in front of it. It doesn’t know your business. It isn’t connected to your data. Nobody owns what it produces. And every staff member is using it their own way, which means you have risk you can’t even see.
That is why the survey numbers look the way they do. McKinsey’s State of AI found that around 65% of organizations now regularly use generative AI, yet only around 39% report an enterprise-level EBIT impact from it (McKinsey, 2024). Most companies have usage. They don’t have a result.
Picture the two side by side. On the left, ten people quietly improvising with a public chatbot. On the right, one system wired into your business. Same word, “AI,” totally different thing.
flowchart LR
subgraph Adhoc["Everyone just uses ChatGPT"]
A1(["Data leaks into public tools"])
A2(["Ten people, ten standards"])
A3(["Not connected to anything"])
A4(["Nobody owns the output"])
end
subgraph Strategy["A real AI strategy"]
B1(["Ranked by business value"])
B2(["Connected to your own data"])
B3(["Clear rules everyone follows"])
B4(["Measured against results"])
end
Adhoc ==> Strategy
The hidden costs of “everyone just uses ChatGPT”
None of these show up on an invoice, which is why owners miss them.
- Your data is leaving the building. Staff paste customer lists, contracts, salary files, and supplier pricing into public tools without thinking twice. Saudi Arabia’s Personal Data Protection Law (PDPL) took effect on 14 September 2023, full compliance was required by 14 September 2024, and SDAIA is the regulator (Morgan Lewis, 2024). Pasting a customer’s national ID number into a tool hosted abroad is, in practice, a cross-border transfer of personal data, which the law regulates separately (Article 29 and SDAIA’s Transfer Regulations).
- Ten people, ten standards. One salesperson’s AI-written proposal quotes a payment term you stopped offering last year. There is no shared, reliable way of doing anything, so the quality of your customer-facing work now depends on who typed the prompt.
- Nothing is connected. The chatbot can’t see your ERP, your CRM, your price list, or your policies, so it can’t actually do anything in the business. It helps individuals type faster, and that is all.
- Nobody owns the output. When the AI gets a number wrong in a quotation or invents a clause in a contract, nobody checked it and nobody is accountable. The first time that reaches a customer, “we used ChatGPT” is not a defense.
The four things a real strategy needs
You don’t need a 50-page document. In our experience you need four things, in this order, and each one is a decision rather than a purchase.
flowchart TD A(["1. A ranked list: where should AI help?"]) --> B(["2. Connect it to your own data and systems"]) B --> C(["3. Rules everyone follows: what goes in, who signs off"]) C --> D(["4. Measure it against one business number"]) D -->|"moved? scale to the next process"| A
- A ranked list of where AI should help. Not “AI everywhere.” Three to five specific processes, chosen because they are high volume, repetitive, and expensive today: quotations, supplier invoice entry, first-line customer questions, contract first-pass review. Rank them by value and by how clean the data underneath them is.
- AI connected to your own data and systems. The value is in the connection. A model that can read your price list, your product catalog, and your past proposals produces a draft a salesperson can send. A model that can’t produces generic text somebody rewrites. Doing this safely, with the data staying where PDPL says it should, is its own subject; we cover the pattern in using your company’s own data with AI safely.
- Rules everyone follows. A one-page AI usage policy: which tools are approved, which data classes may never go into them (customer personal data, salaries, unreleased financials, anything under NDA), and who signs off before AI-drafted material reaches a customer or a regulator. If you handle personal data at any scale, this policy is part of your responsible AI and PDPL governance, not a separate exercise.
- A way to measure it. Every use case gets one business number before it starts: hours per week, days to quote, tickets resolved without a human, error rate. If the number doesn’t move, you stop. That single habit is what separates a strategy from a hobby.
A worked example: the same company, two ways
Say you run a 60-person trading company in Riyadh. Twelve people in sales and operations use ChatGPT on their own, and each one saves, generously, half an hour a day: about 120 hours a month, and it feels like a big win. Now look for it in the accounts. Nobody’s role changed, no process got faster end to end, and quotes still take three days, because the bottleneck was never the typing. It was waiting for pricing and approval. The 120 hours evaporated into slightly nicer emails.
Now take the strategy route. You pick one process: quotations. Your team produces about 300 a month, and each takes roughly 45 minutes of a salesperson’s time to assemble from the price list, past quotes, and the customer’s request, so around 225 hours a month. You connect a model to the price list and your last two years of quotes, with a rule that a senior salesperson approves every draft. The first draft now takes 5 minutes to generate and 10 to review, call it 75 hours a month, and quotes go out the same day because approval is now the only step. You measure one number: days from request to quote. It drops from three to one.
The numbers are made up to show the shape. The lesson is that the second version has an owner, a connection, a rule, and a metric, and the first version has none of them. Ad-hoc use produces a feeling. A strategy produces a number you can defend to your board.
Where this goes wrong
The failure modes are predictable, and most of them are false economies.
- Banning ChatGPT instead of governing it. A ban doesn’t stop usage, it moves it to personal phones where you have even less visibility. Approve a tool, set the data rules, and enforce those.
- Buying the enterprise tier and calling it a strategy. An enterprise license fixes the data-retention problem, but it doesn’t rank your use cases, connect your systems, or measure anything. It is step zero, not step four.
- Skipping the data question. Connecting AI to a CRM full of duplicates and stale prices makes it confidently wrong at scale. Gartner predicts at least 30% of generative AI projects will be abandoned after proof of concept by the end of 2025, with poor data quality and unclear business value among the reasons (Gartner, 2024). Ad-hoc use with no plan behind it is exactly how a project lands in that 30%.
- Starting with the hardest process. The first project should be boring: high volume, low stakes, easy to check.
- Measuring activity instead of results. “Prompts per week” and “employees trained” are activity. Hours saved, days to quote, and error rate are results. Only the second kind pays for anything.
How to start without a 50-page plan
The pattern that works is boring and reliable. Pick one process that is high volume and repetitive. Write down what it costs today in hours and in delay, honestly. Publish the one-page usage policy the same week, so the pilot starts inside the rules instead of ahead of them. Run a small, contained pilot on that one process, connected to the real data it needs, with a named person reviewing the output. Measure the one number you chose. If it moves, you have found your model and you scale it to the next process on the list. If it doesn’t, you have spent a little to learn something cheap.
We laid out the week-by-week version of that loop in the first 90 days of AI in your company. Do it two or three times and you are no longer a company where everyone uses ChatGPT. You are a company with an AI strategy, and it will fit on one page.
Has “AI” in your business become everyone doing their own thing? SDCG’s AI consulting helps owners turn ad-hoc AI use into a real, safe, valuable strategy, connected to your data, compliant with PDPL, and pointed at genuine business outcomes. We’re independent, so we’re not selling you a tool. Book a free 30-minute review.