By Trevor Dearing The European Parliament disabled AI features on staff devices over cybersecurity concerns. Trevor Dearing argues organisations should similarly manage and isolate AI risks. The business world is going all-in on AI. Global AI spending is on course to exceed $500bn this year, yet nearly 90% of analysed AI tools have been exposed to data breaches. The instinct for managing this risk is often binary: leave it on or switch it off. But a third, much more nuanced approach is possible. That choice was on full display earlier this year when the European Parliament disabled built-in AI features on devices issued to lawmakers and staff, concluding it could not guarantee the safety of tools like summarisers and virtual assistants. It was a measured restriction that stopped short of a full operational shutdown and didn’t impact core workplace tools such as email and calendars. At the same time, it exposes the complicated nature of AI, particularly with the growing use of agentic tools that can act autonomously. So how can organisations gain the benefits of advancing AI while keeping control? Why yes/no is a false choice Faced with AI uncertainty, most organisations default to one of two positions. They either impose blanket bans to remove risk entirely or allow AI tools to spread with minimal oversight. Neither is sustainable. While Illumio research found that over half (55%) of security leaders see AI-powered attacks as a major risk, only 19% see unapproved or unmanaged use of large language models as a top concern. Many risk sleepwalking into a major security incident by overlooking the rapid spread of unsanctioned AI within their environments. Part of this risk comes from trying to secure AI using security models that were never designed for it. Traditional security frameworks are built around trusted actors, user