TIH Insights|The Five Red Flags|Red Flag 3 of 5
Red Flag 3 | Surface-Level AI Adoption
Surface-Level AI Adoption is Red Flag 3 in the TIH Industries Five Red Flags framework: AI tools in use with no governance, no workflow, and no defined job. For a licensed professional, that isn't efficiency. It's exposure sitting on the license, and TIH Industries checks for it in every Blueprint.
95%
of AI pilots never produce a measurable financial return. The tool isn't the problem. The absence of a system around it is.
58%
Of small businesses now use AI tools in some part of the business.
U.S. Chamber of Commerce, 2025
95%
Of enterprise AI pilots deliver no measurable financial return.
2025 industry AI adoption research
30%
Of generative AI projects projected to be abandoned after proof of concept.
Gartner
The short version
"A prudent man foresees evil and hides himself, But the simple pass on and are punished."Proverbs 22:3, NKJV
It's using AI without governance, without workflow integration, and without a defined operating role. Two or three subscriptions, some prompts saved in a document, and a habit of pasting client details into a chat window when the day gets long. Nobody decided what the tool is for. Nobody decided what it's not for. Nobody wrote either decision down.
In underwriting, we didn't insure a process that had no controls, however good the people running it were. A control is a rule that survives the person who made it. Surface-level AI has none. It runs on the founder's judgment in the moment, and the moment is usually 6 p.m. on a Thursday.
A prompt library isn't an operating system. It's a shortcut with no guardrails, and the guardrails are the part your license cares about.
It shows up as confidence with nothing underneath it.
"We use AI for everything now."Practice owner, when asked what the AI policy is
"I'd have to check what I've pasted in there."Licensed professional, when asked whether client data has gone into a public tool
The first quote is the tell. "Everything" means nothing was scoped. The second quote is the exposure: the founder doesn't know what's been shared, which means the client doesn't know either, and neither does the licensing board if it ever asks.
The quieter symptom is the AI output that went out under the firm's name without anyone reading it closely. It was fine until it wasn't.
Two lines. The first is money you're not making. Fifty-eight percent of small businesses use AI, and 95 percent of AI pilots never deliver a measurable financial return. Gartner projects at least 30 percent of generative AI projects are abandoned after proof of concept. Same pattern every time: the tool got bought, the workflow never got built, and the subscription runs on while the work is still done the old way.
The second line is the one a licensed professional should read twice. If you hold a license, your professional conduct rules already govern your use of AI. The American Bar Association's Formal Opinion 512 sets out a lawyer's duties of competence, confidentiality, and supervision when using generative AI, and the State Bar of Texas followed with Opinion 705. Any practice that touches protected health information needs a business associate agreement before that data goes anywhere near a third-party tool, public AI included. And the Texas Responsible Artificial Intelligence Governance Act took effect on January 1, 2026, which means Texas now has an AI statute with enforcement behind it.
None of that says don't use AI. All of it says use it with defined inputs, defined outputs, and a human who signs off. That's a workflow, and surface-level adoption doesn't have one.
If any answer is "it depends" or "me, usually," there's no policy. There's a habit. A habit can't be shown to a client, a board, or an insurer.
Not more tools and not a course. Governance first, then workflows built to it, then the tools that earn a place inside them.
Multiple AI subscriptions with no written policy. Client details pasted into public tools. Output sent under the firm's name without a defined review step. Nobody can say what AI is and isn't used for.
Subscriptions paying for work that's still done by hand. The 95 percent of pilots with no return. And for a licensed professional, an undocumented practice that touches confidentiality, competence, and supervision duties, with no record to show when someone asks.
One written AI use policy: approved tools, prohibited data, and who reviews what. A master prompt set that carries the brand voice and the guardrails into every session. Two or three workflows with defined inputs and outputs, built for the work the practice actually does. A review step that leaves a record.
The policy comes first because it's the cheapest thing on the list and the only thing that protects the license. In a TIH engagement this is the master prompt setup and the compliance workflows inside Module 2, Tech Cleanup and Compliance, and every Blueprint includes the Compliance-Safe AI Checkup that finds the gaps before a board does.
Most founders treat AI as a productivity purchase: buy the tool, get the hours back. It doesn't work that way, which is why 95 percent of pilots go nowhere. AI returns time only when it's inside a workflow with a beginning, an end, and a person accountable for the middle. Without that, it's another subscription and another place for client data to leak.
The firms that get a return aren't the ones using AI the most. They're the ones who decided, in writing, exactly what it's for.
Questions
Avoiding it costs you the efficiency your competitors are already using. The fix is governance: a written policy on approved tools and prohibited data, workflows with defined inputs and outputs, and a human review step. That's what TIH Industries builds, and it's what your conduct rules already expect.
A prompt library is a set of shortcuts. A strategy defines what AI is used for, what it's never used for, who reviews the output, and how that's recorded. TIH Industries builds the master prompt set inside that structure, not instead of it.
Not without knowing exactly what the tool does with it and whether your conduct rules or a business associate agreement allow it. Most practices can't answer either question, which is why the written policy comes before the tools.
The Texas Responsible Artificial Intelligence Governance Act took effect on January 1, 2026. Its direct obligations fall mainly on government agencies, health care providers, and a list of prohibited uses, with enforcement by the Texas Attorney General. It signals where enforcement is heading, and licensed professionals already answer to their own boards on AI use today.
Every Blueprint includes the Compliance-Safe AI Checkup: what tools are in use, what data is going where, and where the exposure sits. The policy, master prompts, and workflows are then built in a Foundation Build.
Keep reading
Every business that stalls is leaking in the same five places. This was one. Scroll for the rest, or read the whole framework.
1
Eight to fifteen tools that don't talk to each other, so you end up talking for all of them.
Read the breakdown2
Referrals come in, nothing follows up, and buyers rule you out before they ever call.
Read the breakdown4
No SOPs, no KPIs, no delegation. Your revenue ceiling isn't your market, it's your calendar.
Read the breakdown5
Premium credentials, chaotic backend. That gap runs $17,000 to $25,000 a year in unbilled capacity.
Read the breakdownTen questions. Five minutes. The quiz scores you against all five and tells you which one is costing you the most.