From AI provenance

Here's a tightened version of the Q3 board narrative. Over the past two quarters, mid-market software organizations have moved generative AI from isolated experiments into everyday workflows. Adoption is now broad enough that informal, team-by-team norms no longer provide adequate coverage, and the board should treat AI governance as a standing agenda item rather than a one-time review. The strategic upside remains real: teams using AI-assisted drafting and analysis report meaningfully faster cycle times on customer-facing work, and several functions have absorbed headcount-equivalent gains without new hiring. The corresponding risk is that the same tools quietly move sensitive data outside sanctioned systems, and that unverified AI output is pasted into decisions without attribution. The 2025 SaaS Benchmark Report found that 73% of mid-market firms breached an AI usage policy in the past year, underscoring the urgency of formal controls and board-level oversight. To translate that urgency into action, we recommend three priorities for the quarter: (1) ratify an acceptable-use policy for AI tools, (2) establish a monitoring baseline for sensitive-data exposure, and (3) report adoption and incident metrics to the audit committee on a recurring basis. Finally, we suggest designating an executive owner for AI governance so that policy, monitoring, and reporting share a single point of accountability heading into the next fiscal year.