Contents6
In many companies, the question “should we allow AI?” comes too late. Employees already use it, to draft an email, summarise a document or prepare a presentation, often with a personal account, sometimes with a subscription paid out of their own pocket. Management does not know, and that is precisely the problem.
This is called shadow AI, after shadow IT: tools used at work that the company did not choose, configure or frame.
In short
A majority of French employees surveyed hide their use of AI at work, and almost half do not check its output.
In the United Kingdom, nearly one user in five pays for at least one AI tool for work themselves.
A ban does not stop the use: it only removes visibility.
Framing comes down to a few decisions: an approved tool, a written rule on data, training, a reviewer.
What the surveys say
The most telling figures for France come from a global study funded by KPMG, which sells audit, consulting and AI services, and run by the University of Melbourne among more than 48,000 people in 47 countries, from November 2024 to January 2025. These are people surveyed, not companies, and the French sample size is not published.
of French employees surveyed hide their use of AI and present its output as their own
admit to inappropriate, rule-breaking or risky use
do not check the accuracy of its output
only of people surveyed in France consider themselves trained in AI
The same study adds that 92% of people surveyed in France do not know the laws that govern AI, and that 71% want a framework. In other words, employees are not asking for anarchy: they move on their own because nobody told them how to move.
In the United Kingdom, Deloitte, which sells consulting, audit and AI services, had Ipsos survey 25,000 workers aged 18 to 70 in spring 2026. Among those who use generative AI at work, 31% do so without their employer knowing, and 17% pay for at least one tool themselves, spending Deloitte estimates at £958 million a year (Deloitte UK, 16 September 2026). About half have received no training.
On the large-company side, BCG, which sells AI consulting, found in 2025 that 54% of employees surveyed would use AI even without permission; its sample of more than 10,000 respondents comes mostly from companies with revenue above $500 million (BCG, AI at Work 2025).
A gap public statistics hint at
Public statistics do not measure shadow AI directly, but they hint at its scale. According to Eurostat, in 2025, 21.9% of employed people aged 25 to 64 in the EU used generative AI for work (24.57% in France), while 19.95% of companies with ten or more people report organised use of AI. The two figures do not count the same thing, people on one side, companies on the other: this is not a measurement, it is a clue. It suggests that employees’ use does not follow their employer’s decisions.
Why a ban does not work
Faced with these figures, the temptation is to block: filter AI assistant websites, add a line to the staff handbook, remind everyone about confidentiality. That is understandable, and not useless for the most sensitive data. But as a general rule, a ban has three predictable effects.
Ban
Use continues on a personal phone or computer
The company loses all visibility on what goes out
The most skilled employees leave with their head start
No rule on data is actually enforced
Frame
Use goes through a chosen, configured tool
You know what data goes in and who uses it
Good practices spread from one team to the next
Sensitive data has a clear rule that holds
The real risk is not an employee drafting an email with an assistant. It is pasting a client list, a contract or a password into it, on a personal account the company knows nothing about, and the result going out unreviewed. That risk does not go away with a ban: it only becomes invisible.
Shadow AI is not a discipline problem. It is the sign that a real need is waiting for a tool and a rule.
Framing it in practice
A team of 20 to 500 people does not need a large-group governance programme. It needs a few written decisions, taken in order.
- Take stock without sanctions.
Ask who uses what, for which tasks, with which account. Without a promise of amnesty, nobody answers.
- Provide an approved tool.
An AI assistant chosen by the company, with business accounts and known privacy settings. If the official tool is worse than the one on the personal phone, use will stay in the shadows.
- Write a rule on data.
Three categories are often enough: what can go into the tool, what goes in only anonymised, what never goes in.
- Train people to check.
Not training on the tool, training on review: open the sources, check the figures, sign.
- Name a reviewer for each document that goes out.
A text produced with AI and sent to a client carries the name of the person who checked it.
None of these steps requires banning anything. They require acknowledging that the use exists, and giving it a framework more comfortable than the shadows. Access rights, who sees what and which agent can write where, are covered in our guide to enterprise AI governance. Passwords and API keys, which too often end up pasted into a conversation with an assistant, are covered in our article on the secrets vault.
From the field
Our own tools only have the rights they need
The robot that copies our documentation into Google Drive only has the drive.file permission: it only sees the files it created itself. That is the logic we recommend: an approved tool, configured as tightly as possible, rather than broad access that nobody watches.
And the employees?
Those who use AI in secret are not cheats. They are often the most curious, the ones who figured out on their own how to save time. Sanctioning them discourages exactly the people the company needs to adopt AI properly.
Nobody’s role disappears for all that: it shifts towards what the tool does not do, judging, checking, deciding, taking responsibility. An employee who can review an AI-produced text and spot what is wrong brings more than before, not less. That is also why training matters more than the tool.
If you want to do this work methodically, our AI Growth Foundation sets up the approved tool, the data rule and team training, and our AI Secrets Vault deals with secrets. If the worry is the bill, our AI at the right cost offer prices what a framed use costs. For an overview of the approach, start with our guide to integrating AI in a business.
Frequently asked questions
What is shadow AI?
It is employees using AI tools for their work without the employer having chosen, configured or framed them: an assistant on a personal account, a subscription paid out of pocket, a browser extension installed without telling anyone. The term comes from shadow IT, which refers to software used at work outside the IT department.
Is it illegal to use AI at work without permission?
Not in itself. The legal risk comes from data: pasting clients’ personal data or confidential information into an uncontrolled tool can breach the GDPR or a confidentiality agreement. That is the point the data rule must settle, by saying clearly what can go into an AI tool and what never does.
Should AI assistants be blocked on the company network?
As a general rule, no: use then moves to personal phones and computers, and the company loses all visibility. A targeted block can make sense for some very sensitive roles, provided an approved alternative is offered, at least as practical as the tool being removed, otherwise use comes back another way.
Where should a small or mid-sized company start?
With an inventory of actual uses, without sanctions, then an approved tool and a written rule on data. Training in checking comes next, and it matters more than training on the tool: knowing how to review and check protects better than knowing where to click.
Sources
- Deloitte UK, 16 September 2026 (new tab)deloitte.com
- BCG, AI at Work 2025 (new tab)web-assets.bcg.com
- Eurostat (new tab)ec.europa.eu
Jim · founder of Brain Plus AI
Also in business ai
Practical guide12 min
Enterprise AI governance: who can access what
An AI assistant reads whatever your access rights let it read, sharing mistakes included. Here is how to split your knowledge bases by department, keep a common core and decide who writes to the shared memory.
Understand12 min
Secrets vault: your AI uses your keys without seeing them
Passwords sent by email, API keys forgotten in code, AI agents that could copy everything: these are the leaks we come across most often. And how a vault in your name lets your AI use your keys without ever reading them.
Practical guide11 min The topic guide
Integrating AI in business: private and at the right cost
For teams of 20 to 500 people, integrating AI comes down to answering five questions in order: which task, where the data goes, which model, at what price, under what rules. This guide takes them one by one and points to our detailed articles.