68% of Employees Are Using AI You Don’t Know About

The AI Adoption Revolution Businesses Can’t See

There is a subtle transformation occurring within businesses. Something that isn’t reflected in dashboards or reports, and it’s happening everywhere.

It’s called shadow AI. Employees are increasingly using artificial intelligence (AI) tools without IT or security’s approval, visibility, or boundaries. In the UK alone, for example, a 2026 study by SAP and Oxford Economics reports that 68% of businesses acknowledge their workforce regularly uses unapproved AI tools.

This trend is expanding quickly, and it doesn’t arise from malicious intent; it’s a visibility issue. In fact, many IT and security leaders still assume they know the level of AI usage within their business only to discover an uncomfortable truth: several tools their workforce uses for their daily work have no oversight and zero control.

Bear in mind, though, your employees aren’t trying to bypass rules. They are trying to be more productive and efficient by leveraging AI tools to debug code faster, prepare report summaries, and perform effective data analysis.

Nevertheless, this unregulated use of AI creates a major blind spot in your infrastructure. When your security team is unaware of the AI tools your staff uses, they can’t control your business’s sensitive data, protect it, and identify potential risks.

Yet, even if it may be tempting, the answer isn’t to ban AI tools completely. So, how can you stay in control and deploy an effective AI risk management strategy without killing your business’s innovation? Start by asking yourself a simple question: “Do you actually know what’s happening inside your own business right now?”

Permission Was Never the Real Problem. Here Is Why.

When it comes to shadow AI, businesses are often tempted to react impulsively. They implement blanket policies such as total bans or quickly crafted approval lists. However, both approaches miss the mark for several reasons:

• Policies’ limited scope. You can’t set rules for what you don’t know exists. That’s why your policies can only govern the tools and applications that are on your radar, leaving countless unauthorised AI platforms unregulated.
• Lack of governance framework. Data from the same SAP and Oxford Economics research indicates that only 36% of companies have a formal AI governance framework in place. Without a structured approach to AI governance, policies risk becoming ineffective and can lead to compliance risks.
• Visibility issues. Establishing a policy without first understanding the reality of AI tools usage within your business is like “locking your home’s front door while leaving all windows wide open.” Identify and understand all AI tools your employees are using before creating a governance framework. It will help you foster productivity and innovation while minimising security and compliance risks.

Governance Can’t Be Built on Assumptions

Assuming that your workforce will adhere to a policy simply because it exists is unrealistic. In the real world, employees often prioritise productivity over compliance. Therefore, they will continue to use whatever tools they find most effective, even if those tools don’t align with official guidelines. This may open the door to significant compliance risks, especially in regulated industries where data handling is subject to legal scrutiny.

Shifting the Focus: Go From Reactive to Proactive

Effective governance starts with true visibility into how AI is being utilised within your business. Shift from reactive policy-making to proactive governance, just as you would to address shadow IT.

Assess and monitor AI usage to create informed, practical policies that accurately reflect the tools your workforce uses. This proactive approach will help you achieve better outcomes and a more controlled implementation of AI tools across your business.

The Monitoring Gap Is Leaving Businesses Exposed

Despite the increasing reliance on AI, 72% of businesses don’t actively monitor AI application usage in real time. This lack of oversight can expose them to significant vulnerabilities, especially regarding sensitive information.

For businesses operating in the regulated sectors, the stakes are even higher. Regulations such as the Digital Operational Resilience Act (DORA) and the Network and Information Systems Directive (NIS2) mandate strict oversight of data handling. Fail to monitor AI usage, and you may be hit with hefty fines and serious legal repercussions.

Shadow AI: The Disconnect Between Policy and Practice

Your business may have implemented strict policies for handling and securing confidential information. However, if you can’t track compliance, you won’t know whether your employees are truly following the guidelines.

This discrepancy is particularly critical for IT Directors and Chief Information Security Officers (CISOs) who are required to safeguard their businesses against breaches and violations and must have a clear understanding of where their data resides and how it is utilised.

This Is What You Risk When You Can’t See Your Business’s AI Usage

Lack of visibility into AI usage poses multifaceted risks for businesses, with potential ramifications that go beyond simple compliance violations, such as:

• Data breaches. Sensitive customers’ data can be inadvertently entered into public AI tools. That may lead to potential exposure even before you notice it. For example, an employee might copy and paste confidential customer information into a free-tier AI tool for analysis. However, the software often uses the submitted data to train models, putting it at risk of breaches and data privacy issues. That’s exactly what happened in Holland in December 2025.
• Proprietary code leaks. Developers using shadow AI may also unintentionally disclose proprietary code to potential attackers. A JetBrains 2026 survey found that 90% of developers polled regularly used at least one AI tool at work for coding, debugging and task automation. Yet, while AI accelerates development, it may also share algorithms and code with competitors and potential attackers.
• Compliance failures. The exposure of information isn’t only a security issue. It can violate laws that govern data protection, such as the European Union General Data Protection Regulation (EU GDPR) or the EU AI Act. Imagine a staff member sitting in your London office pasting sensitive customer information (e.g., credit card details, postal address, or health insurance data) into a US-based AI tool. Every time they do it without an official data processing agreement, they violate both regulations.
• Reputational and financial risk. Feeding customers’ or third-party data into unvetted tools for processing can negatively affect your reputation as a trustworthy business and, consequently, your profit. In fact, a 2026 Usercentrics survey revealed that 80% of UK consumers would stop using a service if their data is misused. On the other hand, the same survey shows that 50% of polled customers are willing to pay a premium for brands that guarantee transparency in their AI practices.

The Challenge of Quantifying Risk

The bottom line is that if you can’t see the risks, you can’t effectively manage them, nor can you fully understand your business’s true exposure. For instance, if you log or monitor only a fraction of the AI tools used across your business, the whole extent of potential data breaches and compliance failures will remain largely unknown.

Moreover, typical audits or board reports may not capture the true risk landscape as they often rely on self-reported data and visible tools. Ultimately, by ignoring the realities of AI usage in your business, you’re flying blind.

Visibility First: Why Usage Mapping Has to Be Step One

Before drafting policies, banning software, or rolling out training programs, get a clear picture of which AI tools are being actively used across the business. Find out who is utilising them, how, and what types of data they are handling through usage mapping: it’s your first step toward bringing shadow AI under control.

What is Usage Mapping and How Does It Work?

Usage mapping helps you identify all AI tools used within the business, track employee AI use and interactions, and understand data flow. In simple words, usage mapping highlights who’s using what, how they’re using it, and the data they are processing.

That information will provide you with essential insights into your business’s AI usage and related vulnerabilities. To correctly map employees AI use across your business:

1. Identify AI Traffic. Invest in network monitoring software that can track and log application usage and flag unapproved tools. It will allow you to analyse your network and endpoint traffic to detect unapproved AI applications your employees are using.
2. Survey departments. Scrutinise different departments to learn about tools they have adopted informally. For example, a marketing team may be generating images using an AI tool that your IT team hasn’t approved.
3. Catalogue embedded AI tools. List AI features and components embedded into existing SaaS platforms that have not been flagged as AI. For instance, your employees might be using a project management tool with built-in AI features for task prioritisation without realising it or labelling it as AI.
4. Conduct regular audits. Schedule frequent audits to refresh the inventory of AI tools in use. They will enable you to identify changes in AI usage patterns and adjust your governance frameworks accordingly.
5. Foster a culture of transparency. Encourage employees to share and report the AI tools they utilise. Explain to them that the data will help enhance workflows and security.

The Power of Insights

Once you have an accurate overview of your teams’ AI usage, you’re no longer navigating blindfolded. You can create evidence-based governance policies that reflect real-world interactions rather than assumptions, allowing you to:

• Gain competitive advantage. When you have a comprehensive understanding of your business’s AI landscape, you can make informed decisions that drive productivity and better outcomes while maintaining a robust security posture.
• Improve resource allocation. With a clear understanding of AI usage, you, as a decision-maker, can prioritise efforts and allocate resources more effectively.
• Tailored training and policies. A granular view of AI usage lets you pinpoint issues and address them quickly. For example, if AI usage mapping identifies a specific department using multiple unapproved AI tools, you can set up targeted training and governance policies for that group.

This proactive approach enhances compliance efforts and fosters a safer digital environment, ultimately strengthening your business’s resilience against emerging threats.

Turning Visibility Into a Governance Advantage

To address shadow AI, you don’t need to limit innovation. All you have to do is increase your overall AI awareness. That’s why businesses that will successfully adopt AI tools in 2026 and stand out are not necessarily going to be the ones with the strictest policies but those that:

• Achieve thorough insights into their AI landscape. This will allow them to develop robust governance practices that align with their business’s actual tool usage and their unique environments, rather than relying on one-size-fits-all regulations.
• Understand where AI is deployed. When you know what data your AI tools can access, how it is processed, and how they interact with your infrastructure, you can tailor policies to address specific risks effectively.
  Can make balanced decisions about AI. When you have a clear picture of your AI landscape, it’s easy to choose which AI tools to allow, which to limit, and find the best way to regulate them.

Acora’s AI expertise can help you establish a solid foundation of insights across your IT and data environments, providing you with the control you need to fully embrace AI securely and without issues. Our guidance on best practices for usage mapping and governance will help you:

• Maximise the outcomes of your AI tools and minimise risks through an appropriate AI risk management strategy.
• Transition from reactive to proactive governance. A proactive approach with the correct procedures in place reduces risks and the likelihood that employees resort to shadow AI.
• Differentiate between high- and low-risk applications. It will allow you to tighten controls where necessary.
• Gain a competitive edge by fostering experimentation in a controlled manner, supported by a clear understanding of existing usage patterns and risks.
• Foster innovation rather than stifling it with overly cautious regulations.

It’s time to move beyond assumption-based governance and focus on achieving real-time visibility into AI usage. Let’s embark on this journey together. Contact us today.