Nobody’s scared of AI itself anymore. The scary part is what sneaks in around it: free apps your team signed up for, new “smart” features in the software you already pay for, and a chatbot someone set up last spring and never looked at again.
Here are four AI monsters we see hiding in businesses right now, and the fix for each one. None of them require an IT department or a big budget.
1. The Phantom: secret AI tools
The problem: Your team is already using free AI apps you never approved, and customer information is going into them. You can’t protect what you can’t see.
The fix: Ask your team what they use, and don’t punish honesty. Pick the approved tools. Set one rule: no customer information in free AI apps.
2. The Trojan Pumpkin: AI hiding in your software
The problem: Your booking, billing, and email tools quietly added AI features. Nobody asked where your customers’ data goes.
The fix: Ask each vendor three questions. Does the AI see my customer data? Is it used to train their AI? Can I turn it off?
3. The Zombie Bot: set it and forget it
The problem: The chatbot on your website was set up once and never checked. It’s still quoting last year’s prices and summer hours.
The fix: Test it once a month with five real customer questions. Update it every time your prices or hours change.
4. The Grim Reaper: nobody in charge
The problem: The AI sends the wrong email or books the wrong job. Who notices? Who knows how to turn it off?
The fix: Name one person who owns it, knows where the off switch is, and calls the customer to make it right.
For leaders: how this maps to the NIST AI RMF
Each monster lines up with one function of the NIST AI Risk Management Framework, and each one would also surface as a finding in an ISO/IEC 42001 audit:
- The Phantom maps to GOVERN 1.6: maintain an inventory of AI systems.
- The Trojan Pumpkin maps to MAP 4.1: map the risks of third-party AI data and software.
- The Zombie Bot maps to MEASURE 2.4: monitor AI behavior once it’s in production.
- The Grim Reaper maps to MANAGE 2.4 and 4.3: be able to override or deactivate AI, and handle incidents.
None of these require a new platform. They require a list, three questions, a calendar reminder, and a name.
Want a second set of eyes on how your business is using AI? Get in touch for a free 30-minute conversation.