Related question
We are too small to have policies on anything. Why should AI be different?
Short answer
Because the playing field is not formed yet. With established software, standardization from a handful of major vendors made informal management workable. Nothing like that exists on the AI frontier. New tools appear daily, employees pick their own, and the exposure compounds quietly.
As the owner of a small software company, I was not always on top of the tools my team used. If they needed something, they got it. There was a team lead who set the tone for how things were done, we were standardized on one vendor's ecosystem, and that set useful parameters. I had a great team that cared and worked hard. Everything worked.
I could not take that hands-off approach today with AI.
The playing field is not fully formed. Different team members have different ideas, and new tools drop daily. Some employees want to try everything to find what is best this month, then move on to the next one, leaving money behind in subscriptions and prepaid tokens. Nobody else may even know the company has access to that tool. This quickly produces duplicate subscriptions and work product stranded and exposed in some vendor's database.
The greatest gift Apple, Google, and Microsoft gave business owners was standardization. Nothing like that exists yet in AI. It will come as the front-runners consolidate. Until then, an owner has to be more vigilant than the size of the company would normally require.
You do not need a sophisticated solution. A shared list of what tools exist, what they do, and which ones the company actually subscribes to will handle most of it. You cannot apply common sense to exposure you are not thinking about.