What's your strategy for unauthorized or shadow AI usage

What techniques are you implementing in your org are you whitelisting only a certain AI provider or completely blocking it? While in my org we have make a little browser extension that will for the most part scrub any sensitive data before it's send to an AI for processing it's kinda a dumb approach