Meridian Holdings is at a point most diversified family groups reach roughly twelve months into informal AI use. The pattern is consistent and the implications are now actionable.
AI is already operating across all six business units at Meridian, predominantly through personal accounts, mostly on sensitive material. The binding constraint is not whether to adopt AI. It is governance over what is already happening.
Across 218 staff surveyed, 74% report regular AI use for work tasks. Of those, 61% access AI tools through personal accounts, predominantly ChatGPT and the AI features built into consumer phone and laptop operating systems. 43% have entered information that meets the group's existing definition of confidential, including lease documents, tenant correspondence, employee performance notes, and supplier negotiations.
None of this use is currently logged, sanctioned, or governed. Staff have not been issued guidance. No AI policy exists. No central register of tools is maintained. The exposure is not from an absence of staff capability. It is from an absence of structure around the capability they have already built informally.
A single workflow in the Property division, lease abstraction at renewal, has emerged as the strongest first candidate for a controlled implementation. Roughly 80 leases per year, three weeks of senior paralegal time per cycle, a corpus of accessible documents. The economics are real and the exposure is bounded.
Meridian's findings sit within an established industry pattern. The figures from independent research are consistent with what the Baseline surfaced internally, which gives the leadership team confidence that the controls recommended below are appropriate to the scale of exposure.
"If employees don't feel safe admitting how they use AI, you fail to manage the risks you can't see and you fail to capture the value you don't know exists. The most effective policies start with psychological safety and transparency, not punishment."
Khullani Abdullahi · Managers at Work, 2025
The register names the AI tools observed in use across Meridian's six operating units. Tools listed have been confirmed through the staff survey, the targeted intake conversations with senior leaders, or both. The register is current as at the close of the engagement and is intended to be maintained by the group's nominated AI governance owner going forward.
Each pattern of observed AI use has been classified against the group's existing risk appetite. The classification model is intended to be operational rather than aspirational. Staff can be told what they may do, what requires sign-off, and what must stop.
Five candidate workflows have been identified through the staff survey, the targeted intake, and the analysis of where current shadow AI use clusters. Each has been scored on three dimensions: business value, exposure profile, and feasibility within twelve weeks. The recommended anchor is named. The remaining candidates are held in backlog.
Lease abstraction is named as the recommended anchor not because it is the largest opportunity, but because it is the most defensible first move. The volume is real, the documents are accessible, the cost of error is manageable with appropriate review, and the work that staff are already attempting through personal AI tools can be moved into a sanctioned environment with measurable improvement.
Lumen & Lever · engagement note
The following six controls move Meridian from no formal posture to a defensible operating baseline. Each is named with an owner, a measurable outcome, and an implementation horizon. None require new technology purchases. All are within the scope of the existing leadership team.
The register established during this engagement becomes a living document. Updated quarterly through a five-minute staff pulse and a review by the nominated owner.
One-page document distributed to all staff stating what is sanctioned, what requires sign-off, and what must stop. Published on the group intranet. Reviewed annually.
A short list of sanctioned AI tools with sanctioned use cases. Personal-account access to sanctioned tools is acceptable for low-risk patterns. Sensitive workflows require enterprise access.
Three categories of use are stopped with immediate effect. Tenant correspondence, employee performance notes, and childcare incident notes are not to enter any AI tool until a sanctioned alternative is in place.
Existing personal-account use of Otter and Fireflies is migrated to the group's Microsoft 365 environment, where transcription inherits the existing data residency and access controls.
A standing 60-minute quarterly forum chaired by the Group CFO. Reviews the register, surfaces new patterns, ratifies tool list changes, and signs off any new workflow commencing.
The position below is the Board-grade single-page summary of the Baseline. It is intended for inclusion in the next Board paper without further translation.
Three options for the Board, ranked by structural priority. The recommended path is the first. The remaining two are listed for completeness.