When useful AI spreads faster than its safeguards

I was walking past a desk three floors away when I saw someone using my dashboard.

I recognised it immediately. The content had changed and parts of the presentation had been adapted, but its core DNA was still there: layered panels, linked sections, filtering, expandable detail, a JSON download that gave it a form of memory, and the particular placement of the title.

I laughed. My first thought was that it had spread like a virus.

That sounds negative, but I did not mean it as a moral judgement. I was thinking about transmission. The template itself was inert. What mattered was what happened when another person picked it up and used it. This particular artefact was useful, interesting and easy to pass on. At the surface, its spread was good. People had found a better way to present complicated information.

But the fact that it had travelled so easily also gave me a temperature reading. Something beneath the surface deserved attention.

The problem that produced it

The dashboard began with a difficult assessment. I had a large amount of information pointing in different directions. There were established risks, newly identified risks and existing controls. The challenge was to explain where the new risks fitted within the existing profile without allowing them to disappear into broad categories that already existed.

Some new risks had a clear relationship with existing ones. Some were affected by controls already in place. Others had no equivalent in the existing registers. A list could record all of that, but it could not communicate the relationships well. A long report buried the connections in prose. A slide deck forced the story into a sequence even though the evidence did not behave sequentially.

I used a prompt to build a dynamic HTML and CSS dashboard around a curated dataset. It opened at an overview, then allowed the reader to move through layers of detail. Colour identified relationships. Filters narrowed the evidence. Linked sections let someone follow a new risk into the existing profile, see which controls affected it, and distinguish it from risks that did not fit anywhere.

It was visually pleasing, but that was not the real achievement. The format made the argument easier to interrogate.

How it moved

I sent the dashboard to someone in another team and thought nothing more about it. A week or so later, they contacted me. They did not want to discuss the assessment. They wanted to know how I had presented it.

They came to my desk and I showed them how I had done it. They built something of their own and sent it out. Someone contacted them, they taught that person, and the process continued.

There was no adoption plan. Nobody had selected a pilot group, delivered a training session or written a standard. The method moved because each recipient saw something useful and asked, “How do I do this?”

That may be closer to how AI really enters many workplaces than the diagrams in an implementation strategy. Formal programmes matter, but useful artefacts have their own distribution channel. They move through curiosity, imitation and peer teaching. The person who receives one does not need to understand the model or the architecture. They only need to see that a colleague has made something better.

What the format changed

The dashboards that followed were not just prettier documents. I observed better-presented data and better arguments. In some instances, I believe they contributed to better decisions.

That last point is an observation, not a measured outcome. But the mechanism was visible. In meetings, facts are often trapped in a stack of slides or buried in a 35-page report. The person who can speak longest and most confidently can appear to have the stronger position because locating a refutable fact quickly is difficult.

The dashboard changed that balance. Someone could filter the information, move from a summary to the underlying evidence and test a claim while the discussion was still happening. It gave structure to people who had evidence but did not want to compete through volume or confidence alone.

This is the attractive side of AI-enabled work. It can remove administrative drag and give someone without traditional development skills a way to improve a real process. The improvement can then spread without waiting for a project, a budget or a central team.

The controls did not travel with it

The template was only the visible end of my process.

Before the dashboard existed, I had extracted information from several systems, reconciled it and interrogated it through a separate analytical prompt. I used deterministic code to assess inputs and outputs. I triple-verified the data. Even after that, I still found items that had been classified incorrectly.

Those checks were not embedded in the template’s recognisable DNA. The filters travelled. The expandable panels travelled. The JSON download travelled. My reasons for distrusting the data, and the work I had done to validate it, were much less likely to travel.

This is where a useful infection can develop a fever. A polished dashboard carries authority. If AI also helps produce or transform the information inside it, weak data can acquire a persuasive surface. A viewer may assume that the quality of the interface reflects the quality of the evidence.

It does not.

The question is not whether the original creator was careful. It is whether the next person understands which parts require care. Were they aware that the inputs needed reconciliation? Did they test the outputs deterministically? Did anyone challenge the classifications? Or did the apparent quality of the first dashboard teach the wrong lesson: that a good prompt and a strong template were enough?

This is not just the Excel expert of 2006

Every office once seemed to have someone who was brilliant at Excel. Their spreadsheets spread too. Some contained fragile formulas, hidden assumptions or macros nobody else understood. Human beings have always made data errors, offered opinions outside their competence and accepted work because a deadline or lunch was approaching.

AI did not invent any of that.

The difference may be speed, reach and the level at which the uncertainty enters. The old spreadsheet expert usually manipulated data through visible formulas and rules, even when those rules were badly designed. With generative AI, the underlying information can be changed stochastically across thousands of granular interactions. A summary is rewritten, a classification is suggested, a source is interpreted and a caveat is softened. Each interaction looks small. Collectively, they may shape information on which an organisation depends.

We do not yet know the full significance of that change. It is too early for confident declarations that AI will inevitably increase or reduce quality. It can do either. Speed may reduce quality when production outruns validation. AI may also improve quality when validation is designed into creation and the model helps a person explore evidence more thoroughly.

Experience matters here. Someone with twenty years in a field has accumulated patterns that help them notice when something feels wrong. A graduate trying to produce impressive work may not have that same reference base. That is not a criticism of the graduate. It is a reason not to design a control environment that assumes every user will recognise every plausible error.

Accountability without a visible pipeline

It is tempting to say that accountability sits with the individual. In principle, it does. The person using the output should challenge it and remain responsible for what they produce.

That answer does not mitigate the risk by itself.

People are people. Most of us have moments when “it looks fine” wins because another meeting has started or lunch is waiting. A control that relies entirely on every individual applying consistent scepticism in every private AI conversation is not a serious control.

Peer review is the obvious next layer. Anything moving through a defined pipeline towards production can be read by someone else. The problem is that much AI-assisted work has no visible pipeline. It happens in a private conversation between an employee and a tool such as Copilot. The organisation sees the polished document, dashboard or recommendation at the end. It may not see how readily the user accepted suggestions, what was challenged, what was silently changed or which assumptions disappeared along the way.

The practical checkpoint may therefore need to attach to the moment the information becomes consequential: when it enters a formal document, is shared with others or begins to influence a decision. Training has to cover more than prompting. It must include data validation, provenance, limitations, appropriate peer review and the difference between a plausible answer and a supported one.

We still lock the door

No control will solve this perfectly. That is not a reason to abandon controls.

I was once in a discussion about restricting clipboard and local-copy access available to third-party support through a privileged access management solution. Someone asked why we should disable those routes when a person could simply photograph the screen.

My response was: we did not stop locking our doors because someone invented the sledgehammer.

It was not the most elegant analogy, but it made the point. Defence in depth is not three controls, one of which is perfect. It is a collection of controls, each reducing the residual risk until it reaches a level the organisation is prepared to accept.

The same principle applies here. Training will not eliminate careless use. Peer review will not catch every error. Provenance can be incomplete. Deterministic tests cover only what somebody thought to test. Retrospective review can influence behaviour and can itself be gamed. None of those weaknesses makes the controls worthless.

The better question is whether useful safeguards can travel as deliberately as useful capabilities. A reusable dashboard template might carry a validation checklist. A formal decision document might require sources and a named reviewer. High-impact classifications might be tested through code rather than accepted from a model. The controls should be proportionate to the decision, but they should exist outside the hope that every individual will always remember to be careful.

Holding two ideas at once

The dashboard that reached three floors down was exciting. It helped people present information more clearly. It supported stronger arguments and, in my view, sometimes better decisions. It removed friction from the working day and gave colleagues a reason to teach one another.

It also showed me how quickly capability can outrun context.

Both things are true. AI can be extraordinarily useful and still create risk. It can improve quality and make poor information more persuasive. It can widen participation and allow someone to operate beyond their competence. It can remove administrative drag and introduce uncertainty below the surface.

The lesson is not to stop experimenting, and it is not to advocate for AI so enthusiastically that every objection sounds like resistance to progress. The useful position sits between those extremes.

Build the dashboard. Share the technique. Enjoy the moment when an idea takes on a life of its own. But pay attention to what travels with it, what gets left behind and whether the next person knows the difference.