Workers are adopting AI faster than many employers can control it.
Shadow AI at work is no longer a theoretical concern. New research from Deloitte suggests that millions of employees could be using generative AI without their employer’s knowledge, sometimes paying for subscriptions themselves.
In June, we asked: Are Employees Secretly Using AI at Work to Impress the Boss?. We considered whether employees might quietly use AI to produce better work, finish tasks faster and appear more capable.
We now have strong evidence that this is happening on a significant scale. However, the issue is no longer just whether an employee is taking full credit for AI-assisted work. It is also about what company information may be leaving the organisation without anybody knowing.
Workers Are Buying Their Own AI Tools
Deloitte’s first GenAI Workforce Survey questioned 25,000 UK workers. Two thirds had tried tools such as ChatGPT, Claude, Google Gemini and Microsoft Copilot, while nearly a quarter were using generative AI daily in their jobs.
The most striking finding was that 31% were using generative AI without their employer’s knowledge. Another 17% were personally paying for at least one AI tool that they used for work.
Deloitte estimates that UK workers are spending close to £1 billion a year on these services. Although this was a UK survey, the same tools are available worldwide, so similar behaviour is almost certainly taking place elsewhere.
Employees are mainly using AI to search for information, draft emails and summarise documents. For some tasks, however, AI can reduce work that once took days to only a few hours.
Most employees are probably not trying to break company rules. They may simply want to work more quickly, meet demanding targets or avoid appearing less productive than colleagues who are already using AI.
Are Workers Afraid of Becoming Less Important?
There may be another reason employees are keeping their AI use quiet.
If someone admits that AI helped them complete several days of work in a few hours, management may begin questioning how much of that person’s role is still necessary. What begins as a useful productivity tool could eventually be used to justify higher workloads, smaller teams or job cuts.
Employees may therefore feel caught in a difficult position. They need to use AI to remain competitive, but disclosing how much it helps them could make their own contribution appear less valuable.
This could explain why some workers pay for AI themselves rather than asking their employer to provide it. A personal subscription allows them to benefit from the technology without showing management exactly how they are achieving their results.
In that sense, secret AI use may not simply be an attempt to impress the boss. It may also be a form of self-protection by employees who are worried about becoming less important in an increasingly automated workplace.
What Is Shadow AI?
Shadow AI means using AI systems without an organisation’s approval, oversight or knowledge.
It is similar to shadow IT, where employees install unapproved software or use personal cloud storage to get around slow or inconvenient company systems. Generative AI creates an additional risk because employees may be sending company information directly to an external service.
Drafting a routine email may seem harmless, but the employee might paste the original message into an AI tool. That message could contain customer names, account information, commercial discussions or other confidential details.
The same applies to summaries. Someone may upload a contract, customer complaint, meeting record, medical document, financial report or set of board papers and ask AI to shorten it.
Employees could also be using AI to analyse customer data, review source code, assess job applications or prepare financial information. All of these activities could involve information that the organisation is required to protect.
Personal Subscriptions Are Not Business Systems
Paying for a premium AI account does not automatically make it suitable for confidential business work.
A personal account sits outside the employer’s normal controls. The business may not know which AI provider is being used, what has been uploaded, where the information is processed or how long it will be retained.
Different AI services and account types offer different privacy protections. An employee may never have read the terms or checked whether prompts and uploaded files could be stored or used to improve the service.
The account may also be linked to a personal email address and accessed through a private device. If the employee leaves the company, conversations and uploaded documents relating to their work could remain in their personal AI history.
The employer may have no practical way to retrieve or delete that information.
The Security Risk Is Greater Than the Subscription Cost
The headline figure of £1 billion attracts attention, but the 31% using AI without their employer’s knowledge is far more important.
If a company does not know that an AI tool is being used, it cannot assess its security, configure privacy settings, control access or monitor what information employees are sharing.
The UK National Cyber Security Centre has warned that shadow AI can increase the risk of data breaches, intellectual property loss and regulatory failures. It says organisations may lose visibility and control when employees transfer sensitive or proprietary information to consumer AI services.
These risks apply internationally. Businesses must consider local privacy laws, confidentiality agreements, professional duties and promises made to customers.
The risks are especially serious in sectors such as healthcare, law, finance, education, government and technology. A single employee could unknowingly place sensitive information outside the organisation’s control simply by asking an AI tool to improve a document.
AI Can Also Produce Bad Information
The risks do not only concern what employees put into AI. Employers must also consider what comes back out.
Generative AI can produce convincing but inaccurate answers. It may invent facts, misinterpret documents or leave out important details.
If an employee quietly places that material into a report, customer response or management recommendation, colleagues may assume it was properly researched and checked.
There is also a question of accountability. If an important decision is based on incorrect AI-generated information, who is responsible? The employee, the manager or the organisation?
Employers cannot answer that question properly if they did not even know that AI was involved.
A Complete Ban May Make Matters Worse
Banning all AI may sound like the safest answer, but it could push its use further underground.
Deloitte’s research shows that employees value these tools enough to pay for them personally. Some will continue using them if AI helps them manage workloads, meet deadlines or keep up with colleagues.
Employers need to understand why workers are turning to external tools. Perhaps the company has not provided an approved alternative. Its internal system may be too restricted, or staff may never have received useful training.
Deloitte says organisations need to move beyond merely providing access and help employees use AI with appropriate guardrails and a clear purpose.
That requires more than publishing a lengthy policy that few people will read.
What Employers Should Do
The first step is to find out which AI tools employees are already using. Staff are more likely to answer honestly if the exercise is presented as an attempt to understand working practices rather than punish people.
Organisations should then:
- provide a clear list of approved AI services;
- explain what information must never be uploaded;
- provide secure business accounts where appropriate;
- require employees to check important AI-generated work;
- review privacy and data-retention settings;
- include AI accounts in access and departure procedures;
- explain when employees must disclose that AI was used;
- create a simple process for reporting accidental disclosures.
Training should use realistic examples. Employees need to understand why pasting a document into an AI tool is different from searching for general information online.
Rules should also cover personal accounts and devices. Approving a particular AI brand does not mean that every version or subscription is suitable for company information.
Employers Need to Catch Up
The Deloitte survey supports what we raised in June: employees really are using AI without telling their employers.
Some may want to impress the boss. Others may be trying to protect their position by concealing just how much AI contributes to their productivity. Many will simply be trying to handle growing workloads.
Whatever their motivation, the security problem remains the same.
The central question is no longer whether employees are using AI. It is whether employers know which tools they are using, what information they are entering and whether proper safeguards exist.
AI has already entered the workplace. Employers now need to make sure it has not entered through the back door.
Explore over 110 courses on AI in the workplace and beyond to stay ahead of the game. Our courses are continually reviewed and updated to reflect the latest developments in AI.
Published: 16th September 2026.