How To Use AI Like a Claw Hammer

I have been in the IT industry for 35 years but started my college career wanting to be a journalist. I had an amazing journalism teacher named Mrs. King in high school and got hooked on journalism.  I loved investigating a story, interviewing people, and writing a story while trying to be totally impartial.  

Can AI really take over the world? 

Journalism taught me to instantly doubt anything I see, hear or read and immediately try to poke holes in it.  So,o when AI became the latest buzzword and exploding technology, I stood back saying “Has no one watched “The Terminator”, or the any of the five sequels!?! (Also, let me know as soon as Terminator 7 is official.)  

As an IT professional currently obsessed with security and protecting small businesses, I had to dig into it.  To be fully transparent, it scared the bejesus out of me! 

Scaling New Heights showed me that AI isn’t optional anymore 

Recently I attended Woodard's Scaling New Heights 2025.  Scaling New Heights is an industry leading conference that focuses on significant disruptions or opportunities in the accounting profession. As you would expect, AI was a huge part of it. I counted a minimum of 9 published events, and AI was mentioned in most keynotes. I heard questions and statements like: “Why aren’t you using AI?”, “How do you use AI?”, and “How does my company utilize AI to save billable time?”    

One certainty I came away with is that AI is here to stay.  Not that I am the first one to come up with that, I admit I am late for the party. I intensified my study on AI and its usage. What are the dangers of this technology? What are acceptable ways to harness its power? Most importantly, HOW DO WE SECURELY USE IT! 

Digging into the IRS’s interim AI policy 

I started with the United States Internal Revenue Service, what better place to start right? I found a March 11, 2025, article titled, “Interim Policy for AI Governance”. After stumbling through government speak, I found a nice Consolidated Table of Actions at the end. This gave every agency a deadline of 60 days up to a year. My favorite deadlines are the 270-day deadline to “update internal policies on IT infrastructure, data, cybersecurity, and privacy,” and the 365-day deadline for all agencies to “implement the minimum risk management practices for high-impact uses of AI.”

March 11, 2025 Interim Policy and 365-day deadline to implement, maybe I’m not that late for the party! 

Then it hit me, AI is simply a very powerful tool in your toolbox.     

Using AI like a hammer 

If we look at AI as a tool, say the old tried and true claw hammer, how would you adopt its use?   

Imagine that your employees are 3rd grade children and AI is a claw hammer, based on the reaction from business owners I have used this analogy on, probably not much of stretch for some of you.   

If you were a teacher of 3rd grade children and you gave each a claw hammer and then said, “Have fun! See what you can do with this!” (This would be dangerous and careless, not to mention a horrible thing to do. What is wrong with you?)   

I would think that first you would define how to use the hammer and tell the children, “You must be very careful with this tool. This tool is good for hammering nails or removing old nails. It is not for smashing windows or for opening jars you’re not allowed to open. You should wear goggles and work gloves when you use the hammer. You must be very careful; it can hurt you and others.”

Next, you would educate the children on how to use the hammer and test that they knew how to use it before allowing them to use it. You would then provide them with an approved hammer and safety gear.

Finally, you would monitor what they do with the hammer and ensure it is safe and only used in an approved manner.  You might even put these rules in easy-to-understand words on a poster and hang it in the classroom, giving out gold stars for proper usage as a reward.   

Using AI at your company as a tool is the same. 

Define how to use AI    

This is the creation of your AI policy. Ensure you include sections on approved use of AI as well as prohibited usage. Define prohibited data that includes any type of PII (Personally Identifiable Information). List approved AI tools and define that it is limited to use on only firm-issued equipment.   

I would recommend adding the AI policy as a section of your WISP (Written Information Security Program) and having employees and contractors re-sign the WISP Acknowledgement of Understanding form.    

Educate on AI usage 

Look for an online class on AI Usage or if you select a vendor, they should have training resources. Hopefully you are using a good Cybersecurity Awareness Training program that has added secure AI usage training. You could also give a class, or task your company AI enthusiast. Every company seems to have one, and they can be the scary ones if they don’t have limits. Training has been built on most platforms, and you can also ask your AI to teach you the best way to use it.   

Test AI usage 

Ensure your employees know how to use the tools and what resources are available to help. With seemingly every vendor adding an AI component, make sure your employees know how to use it in that software. Check with the vendor to see if you can create a usage policy and limit by the rule of least access. If there is a specific task you want them to use it for, ask them to show you how to use it.   

Provide an approved AI platform 

Your stack vendor of choice may offer AI that works in your business and allows for monitoring and control. OpenAI also offers business models. A team plan is listed at $25 per month per user. Based on already in place agreements, many choose to authorize AI built into software including any AI tools embedded in IRS e-Services. You also want to ensure that only AI tools hosted in the United States or with US-compliant data handling protocols may be approved. Ensure it meets standard WISP requirements like encryption at rest and in transit, logging and audit capability.   

Monitor usage 

Currently this is not as easy as it sounds. If you subscribe and pay for a service, this should be included. If you are using a patching and monitoring tool or an IT Service Provider, you could scan for applications in use. There is also the tried-and-true MBWA (Management by Walking Around) or simple communication asking how and if they are using AI.     

The worst mistake you can make is ignoring AI. You must address it with employees. And, while you could restrict all use of it, don’t. Educate yourself and give it some simple tasks. Ask it to make plans to build a raised garden for home grown tomatoes. Tell it you also need a shopping list and compare local hardware stores for prices.     

Now on to solving the problem of “If AI is just using human-generated content to answer questions, what happens when humans use AI to create all content?” I might title that article “Terminator 2: Judgement Day.”