GenAI is already at work. Is your organisation governing it?

It is 10 minutes before the deadline. A junior account manager opens a new browser tab, pastes in a client's project brief and asks the chatbot to turn it around.

The output lands in 30 seconds, polished and plausible. She tidies it slightly and sends it. Nobody else in the organisation knows it happened, including the people whose confidential data just passed through a server they have no agreement with.

This is the central feature of generative AI (GenAI) at work: adoption has outrun readiness. A 2025 McKinsey survey reported that 78 per cent of organisations had adopted GenAI in at least one business function, while just one per cent described their deployment as mature.

Maturity means more than handing people a tool. It means consistent integration into workflows, real oversight, clear accountability and shared standards.

The gap between adoption and maturity is where most of today’s risk sits. In Malta’s SME-dominated economy, many employers have little dedicated capacity for AI governance, information security, formal learning or organisational change.

That does not mean no governance exists, but it does mean practice often develops informally, through individual experimentation, before anyone has decided what responsible use should look like.

In our recent study, conducted jointly by the 3CL Foundation and the National Skills Council, participants largely refused the simple choice between being “for” or “against” AI. 

They described it as a “two-sided coin”: useful or harmful depending on how it is used, supervised and built into work.

The upside was not in doubt. Participants valued GenAI as a research assistant, a drafting aid, a translator and a tutor.

It can help people get unstuck, explain unfamiliar ideas, cut the time spent on routine tasks and free attention for higher-value work. Some put the competitive reality bluntly: the near-term worry is not that AI replaces a worker outright, but that the colleague who uses it well starts to outperform the one who does not, especially where speed and volume count.

Yet the same participants identified three risks, each harder to manage when AI use is hidden or left entirely to individual discretion.

The first is the erosion of judgement. Because GenAI produces fluent, plausible output, it is tempting to accept an answer without checking it, to reason through the problem less carefully, to stop practising the underlying skill. “You start losing your ability,” one participant warned, “because you’re handing it over to AI to do it.”

The danger is not mainly the dramatic error that slips through. It is that steady reliance on plausible output slowly weakens the independent thinking and professional scepticism that made someone good at the job in the first place.

It is subtle precisely because the work keeps looking polished.

The second is exposure and blurred accountability. Once confidential documents or personal data go into an unapproved public tool, the organisation may lose any control over how that information is retained or reused.

The exact risk depends on the tool and its terms, but it is not a decision an employee should be making alone. Accountability blurs, too, when AI shapes a piece of work and nobody says so.

If the output is wrong, biased or misleading, who checked it? Who owns the decision? The principle should be plain: AI may assist, but a person remains accountable for the work.

The third risk may take years to surface. GenAI is especially good at exactly the routine tasks that have always helped junior staff learn.

An employer in our study used legal research as an example: if AI does that work, a firm needs fewer interns, but those interns are the people meant one day to become the experienced professionals, and they need the foundational practice to get there.

The same pattern threatens accountancy, consulting, design and other knowledge-intensive fields.

Automate the routine work without weighing its developmental value, and you may remove part of the path by which beginners become experts. The efficiency shows up now; the capability gap shows up later.

None of this is an argument against the tools. It is an argument against drift. Informal habits can harden into normal practice before anyone has examined their consequences, which leaves a narrow window in which an organisation can still shape how AI is used.

The first response need not be a long policy nobody reads. A single page of practical rules can close the most urgent gap while more mature governance develops.

It should cover at least three things: what must never be entered into an unapproved tool, including client data, confidential documents and personal information; the human-verifier principle, that a person remains responsible for checking and approving every AI-assisted output; and a short list of appropriate uses and no-go areas for the organisation’s own context.

It should be introduced through conversation, not as a silent memo. People are more likely to follow rules they understand and have had a chance to question.

Blanket bans tend to push use underground rather than end it, though that is not a reason to permit every tool; restrictions simply need to be clear, proportionate and backed by credible alternatives.

A one-page guide is only a beginning. Larger or higher-risk organisations will also need approved tools, access controls, security safeguards, training, review processes and someone who clearly owns AI governance.

But a simple, honest starting point beats pretending nothing is happening.

The question facing Maltese organisations, then, is not whether GenAI is good or bad. It is whether they will decide how it should be used while practice is still forming, or let a string of private, unspoken choices set the norm for them.

Governing AI well does not begin with the technology; it begins with the modest act of writing down what was, until now, simply assumed.

The tools themselves will keep changing. This year’s indispensable assistant may be overtaken by the next, which means the deeper challenge is not choosing the right technology at all. It is protecting the human capabilities people need to use whatever comes next, and that is where the final article in this series turns.

This is the second in a three-part series drawing on Working Across Generations: Digital Literacy, GenAI, and Workplace Dynamics in Malta, research conducted jointly by the 3CL Foundation and the National Skills Council. The full report is available at 3cl.org/resources.

Christine Garzia is a labour market researcher with experience leading pan-European research projects and active labour market programmes focused on training, skills and employability.