Shadow AI: your employees are using AI you don't know about

Here is an uncomfortable bet: someone on your team pasted a customer email into a free chatbot this week, and you don't know about it. They weren't being reckless. They were trying to get through their inbox faster. Three surveys published this year say this is now normal behavior, and the gap between what bosses think is happening and what workers are actually doing is wide.

What happened

The biggest study so far comes from Deloitte. In a September 16 release, the firm reported on a survey of 25,000 UK workers carried out by Ipsos in May and June 2026. About 63% said they knowingly use generative AI for work. Of those users, 31% said they use it without their employer's knowledge, and 17% pay for at least one AI tool out of their own pocket. Deloitte puts that personal spending at about £958 million a year. Around half of AI users said they had received no formal training on using it safely. Users reported saving about 70 minutes a week.

On the manager side, The Register reported in May on a survey commissioned by the identity company Okta, covering 292 executives and 492 knowledge workers in seven countries. Some 90% of executives said they were confident they could see which AI tools their staff used. Meanwhile 52% of workers admitted using unapproved AI tools, and 16% said they had handed their login credentials to an AI tool. In the US, unapproved use was reported by 67% of workers.

A third survey, run by Wakefield Research for the incident management company PagerDuty and published in June, asked 1,250 office staff at large companies in four countries. Two thirds said they had used AI at work while believing it was against company policy. A third had put customer data into public AI tools. Notably, workers at the smaller companies in the sample were more likely to have entered customer data, 40% versus 27% at the largest firms. And 39% said they would rather use AI without telling anyone.

These are self-reported surveys, two of them from vendors with products to sell, and the samples differ. But they all point the same way.

Why it matters for your business

The data risk is real and it's yours. If an employee puts a client contract, a patient note or a customer list into a free consumer tool, you may have just shared it on terms you never agreed to. In regulated work like law, health or finance, that can become a compliance problem, not just an awkward conversation.

Credentials are the scariest number. Sixteen percent of workers giving their logins to AI tools means some of your accounts may be accessible to software you've never vetted.

Hidden use means hidden value. The flip side is that your people have already found uses for AI that save them time. Deloitte's 70 minutes a week is a self-reported number, but it suggests workers see real benefit. When that knowledge stays hidden, you can't spread it across the team or check whether the output is any good.

Small firms are more exposed, not less. Big companies have IT departments and approved tool lists. Many small businesses have neither, which is probably why customer data showed up more often in the smaller firms' answers.

The case for a hard ban is simple: if no one uses AI, no data leaks. We understand the appeal. But these surveys suggest bans mostly push use out of sight. People who already pay for their own tools will keep using them.

What we'd do

• Ask, without punishment. Run a short anonymous poll: which AI tools do you use, and for what? You can't manage what you can't see.
• Pick an approved tool and pay for it. A business plan with data protections in the contract is cheap compared with a breach. If staff are spending their own money, that's a sign they'd use a sanctioned option.
• Write a one-page AI policy. Say what data never goes into any AI tool (client identifiers, health details, passwords, financial account numbers), which tools are approved, and who to ask.
• Rotate any shared logins. If there's a chance credentials went into an AI tool, change them and turn on two-factor sign-in.
• Give an hour of training. Half of workers have had none. A short session on what's safe to paste covers most of the risk.
• Collect the good ideas. Ask people to share the prompts and uses that save them time, then make the best ones standard.

Shadow AI is not a discipline problem. It's a signal that your team wants these tools and nobody has given them a safe way to use them. The owners who come out ahead will be the ones who bring that use into the open, put guardrails around it, and spread what works. Pretending it isn't happening is the riskiest choice on the table.