Highlights the risk of shadow AI in your business and the need for clear internal AI policies.
What did the Deloitte shadow AI survey find?
Deloitte surveyed 25,000 UK working adults about generative AI use at work, and the headline finding is uncomfortable: almost 1 in 10 have used an AI tool their employer banned or would disapprove of. Bloomberg reported the findings on September 16, 2026.
The study is Deloitte’s inaugural GenAI Workforce Survey, fielded by Ipsos, and it covers workers aged 18 to 70. Two thirds of workers have tried AI at this point, so the question is no longer adoption.
The spending underneath the rule-breaking is the sharper story. 1 in 6 workers pays for at least one AI tool out of their own pocket, which adds up to about £958 million a year leaving employee bank accounts for work subscriptions.
The policy gap is not a fringe behavior, it is a funded, mainstream work habit hiding inside your headcount.
How solid is the Deloitte shadow AI data?
The sample is large and the fieldwork is named, which puts this ahead of most vendor-run adoption surveys. 25,000 respondents is a serious base, and the toplines match across minutehack’s full dataset and Bloomberg Law.
The self-report caveat still applies: people understate behavior that gets them in trouble, so the 1 in 10 banned-tool figure is a floor. Read it as the minimum size of the gap between your policy and the practice underneath it.
The surrounding numbers hold together: 63 percent of UK workers have used generative AI for work, 46 percent used free tools, 34 percent had employer-provided tools, and 17 percent used tools their employer built in-house. About half of AI users at work say they received no formal training on safe use.
On methodology, this is the strongest workplace AI dataset published in the UK this year.
How is shadow AI different from normal shadow IT?
Shadow IT was downloading an unapproved app, and the damage stopped at unmanaged licenses and duplicated spend. Shadow AI generates: the draft and the analysis leave your control the moment an employee types the prompt.
The scale is different too. Deloitte found 31 percent of AI users running tools without their employer’s knowledge, and 65 percent said their organisation gives no convincing leadership on how the technology should be used.
That combination means your data-governance posture is one enthusiastic prompt away from a bad week, and no endpoint agent will catch a question typed into a personal phone.
With shadow IT, staff leaked software names. With shadow AI, they leak the thinking itself.
The payroll summary leaves your office at 6:40 on a Tuesday evening inside a free chatbot on a team member’s personal phone, because the tool drafts it before an approved-list request would clear. Nothing about the moment feels like a breach. The deadline is real, the tool works, and the policy document sits unread.
Deloitte attached numbers to that scene: workers report saving an average of 70 minutes a week with generative AI, and most put the recovered time straight back into more work for the same employer. The 1 in 10 banned-tool figure is what unmet demand looks like from the outside.
The structural twin is the employee who photocopied client files and finished the work at home on an unsecured laptop. You would call the paper version a data breach. Inside a chatbot, the same copy leaves no log, and 65 percent of users say their organisation has told them nothing about what is allowed.
What are the risks of shadow AI for a small business?
The first risk is data: prompts carry client details and unreleased plans into accounts you cannot audit or delete from. The second is consistency, because work products assembled in personal tools walk out the door when the employee does.
There is a procurement angle as well. 1 in 6 workers already pays for work tools from their own pocket, which means budget decisions with security implications are being made outside the company, without procurement or a contract in the room.
The compliance exposure compounds: half of AI users received no formal training, and 65 percent say leadership has given them no convincing direction on what acceptable use looks like.
Staff using unvetted AI tools put your client data in accounts you cannot see, govern, or retrieve, and that is the risk worth budgeting against.
What should you do about shadow AI now?
Start with an audit: ask each person on your team which AI tools they used this week and treat the answers as procurement data rather than confessions. The 31 percent who hide their usage will not self-report to anything that looks like a disciplinary trigger, so make amnesty the explicit opening move.
Vet the 2 or 3 tools your team already relies on and move them onto company accounts with a written rule on what data can enter any model. Fund the list: Deloitte’s data puts employee out-of-pocket spend at about £958 million a year across the UK, and the sanctioned version of that spend buys you audit trails and data controls.
Publish the approved list, revisit it every quarter, and give people a fast route to request tools you have not vetted yet. Our AI signal tracker logs how these policy gaps show up in real vendor data, so you can watch yours coming.
Survey the team and fund the 3 tools doing real work this month, because hidden usage grows while you wait.
Source: Bloomberg Tech
