AI-generated work is moving between employees, vendors and counterparties with little visibility into what happened upstream. Sourcefit CEO Andy Schachtel says the harder governance problem is reconstructing that chain—and knowing what the person at the end is actually judging.
Andy Schachtel can often tell when a contract has been through ChatGPT. It comes back covered in redlines.
“I see so much more pushback on contracts now because people are just putting it into ChatGPT,” said Schachtel, founder and CEO of Sourcefit, a business process outsourcing company. Increasingly, his response is to run the proposed changes through AI himself. “And it becomes just AIs talking to each other,” he said.
It is a funny description of something becoming much less theoretical. AI is working its way into ordinary business processes through employee accounts, productivity tools and software companies already license, often without anything resembling a formal transformation project. Some of that use is sanctioned, some arrives through existing applications and some is shadow AI—tools employees bring into the workflow themselves.
A Wakefield Research survey commissioned by PagerDuty and published in June found that 66 percent of 1,250 non-IT office professionals had used AI tools or services at work even though they believed company policy did not permit it. Thirty-four percent had entered customer information into public AI tools, while 31 percent had shared financial information or confidential company documents and strategies. The respondents worked at companies with at least $500 million in annual revenue across the U.S., U.K., Australia and Japan.
The behavior was more pronounced at smaller organizations. Forty percent of respondents at companies with fewer than 1,500 employees said they had entered customer data into public AI models, compared with 27 percent at larger companies. That is closer to the environment Schachtel described among Sourcefit’s predominantly small and midsize clients.
“They have ChatGPT or they have Claude on their machines,” he said. “They’re sticking in all kinds of corporate information in there.” Many, he said, have no AI policy and no audit trail showing how AI was used.
The obvious concern is data exposure. Schachtel is more interested in what happens after the prompt, when AI-generated work begins moving through a process, and each subsequent user may know less about how the original analysis was produced.
“You’re taking an AI analysis, you’re handing it to someone else, they put it in their AI and they do a subsequent AI analysis,” he said. If an error enters early in that sequence, finding its origin becomes harder with every handoff. “The more that you build AI on top of AI on top of AI on top of AI, the more difficult it is to go back and figure out what happened.”
For legal and compliance teams, that moves the discussion beyond whether an employee was allowed to use ChatGPT. The more consequential question is whether the company can reconstruct how an important conclusion was reached after several systems, people and organizations have touched the work.
The blind spot can begin inside the enterprise, but it does not end there. AI is embedded in software companies already licensed, making vendor controls, records and transparency part of the contracting relationship. AI-generated work also arrives from counterparties, advisers and service providers. Schachtel’s contract example captures the problem neatly: one party receives work without necessarily knowing what technology produced it, then runs that work through another AI system of its own.
The audit trail can end at the handoff without anyone deciding that it should.
Sourcefit has a useful view into those handoffs because its teams work inside client processes. The company employs about 2,000 people and supports functions ranging from technology and customer service to accounting and legal work.
Schachtel said Sourcefit has generally approached AI by looking for specific bottlenecks rather than trying to automate entire functions. In one logistics process involving handwritten documents, AI was used to extract information employees had previously deciphered manually, while people remained in the workflow to check the output before it moved forward.
That approach also informs his view of the people who remain in the process. In midsize organizations, accounting, support and other teams often include employees whose jobs cut across functions and who carry years of knowledge about how the business actually operates.
“They’re doing kind of nuanced roles that cut across different sides of the business,” Schachtel said. “They have deep domain expertise and knowledge about the business. They’re just not going to be replaced easily.”
But keeping people in the process does not by itself create governance. If employees are meant to review AI-generated work before it moves downstream, they need to know what they are responsible for checking and where judgment cannot simply be passed along with the output.
Schachtel encountered that problem inside Sourcefit itself. When the company introduced AI among its management team, some employees embraced it immediately while others resisted it. His response was to set expectations, provide training and create a common approach rather than let individual practices develop ad hoc.
“What are people allowed to do? What are people expected to do?” he said.
The second question may matter more than the first. PagerDuty found that 86 percent of respondents believed their organizations had formal AI policies, even as two-thirds reported using tools they believed those policies did not allow.
A policy on paper is not an operating model.
Schachtel’s advice is straightforward: establish an AI roadmap or playbook, communicate it and make the expectations explicit. “Just don’t let it just lie there unspoken,” he said.
As AI-generated work moves across employees, systems, vendors and counterparties, that discipline has to survive the handoff. Otherwise the person making the final call may see a polished answer without being able to reconstruct what produced it.
That is the governance problem: not simply keeping a person in the loop, but preserving enough of the chain for that person to know what they are judging.
Link to About Andy Schachtel About Andy Schachtel
Andy Schachtel is founder and CEO of Sourcefit, a global business process outsourcing company founded in 2009. Sourcefit has more than 2,000 employees and provides offshore staffing and managed business-process services across a range of functions and industries. Schachtel previously managed outsourced advertising, web and mobile development projects across Asia, Europe and South America.