Deloitte UK just published a workforce survey on generative AI use that every compliance officer should read carefully, because it puts real numbers behind something many of us have suspected for a while: employees aren’t waiting for their employer’s blessing before they start using AI tools at work. Nearly a third of generative AI users bring their own tools into the workplace and use them without their employer even knowing. Almost a quarter of UK workers now use generative AI every day on the job. And nearly half of the people using it have never received any formal training on how to do so safely. If you’ve been assuming your organization’s AI governance program covers what’s actually happening on the ground, this survey is a good reason to check that assumption.

The Gap Between Policy and Practice

What makes this data particularly striking is the gap it reveals between employee behavior and organizational readiness. Nearly two-thirds of surveyed workers said their organization has provided no real leadership on how generative AI should be used. Meanwhile, 46 percent of employees are using free, consumer-grade AI tools at work, tools that were never designed with enterprise data protection, confidentiality, or audit requirements in mind. Put those two numbers together and you get exactly the risk profile compliance officers should be worried about: widespread, largely unsupervised AI use, running on tools with none of the contractual or technical protections an enterprise agreement would provide.

This isn’t really a story about employees being reckless. It’s a story about demand outpacing governance. People have found genuinely useful tools that make their work easier and faster, and in the absence of a sanctioned enterprise alternative or clear guidance, they’re simply supplying their own. That’s a predictable outcome, and it means the solution isn’t a memo telling people to stop. It’s building a program that actually meets the demand that’s already there.

Why This Creates Real Compliance Exposure

The specific mechanics of how shadow AI creates risk are worth walking through, because they’re less obvious than they first appear. Even organizations that block specific AI tools on their office network aren’t necessarily protected, since that restriction can be circumvented simply by tethering a laptop to a personal mobile phone’s data connection. And blocking isn’t even the full picture: an employee can photograph a laptop screen with a smartphone and feed that image into a personal AI tool entirely outside any monitored network, sidestepping both technical controls and audit trails in one step.

Once information moves through an unsanctioned tool this way, several distinct legal exposures open up at once. Confidential business information or trade secrets uploaded to a personal AI account generally isn’t protected the way it would be under a properly negotiated enterprise agreement, and sharing that information with a model provider can itself destroy the legal protections a trade secret depends on. Personal data about coworkers, customers, or prospects fed into these tools can trigger privacy law violations. Depending on the tool’s terms, the provider may also claim rights in outputs or impose contractual restrictions on how those outputs can be used, restrictions the employee likely never read. And in jurisdictions like the EU, content generated this way may fail to meet the transparency and disclosure obligations that apply to AI-generated material under the EU AI Act, since content produced through an unmonitored personal tool is unlikely to be labeled or tracked the way policy requires. Perhaps most concerning for compliance functions specifically: if an untraceable AI-generated error makes its way into a regulatory filing, an investor communication, or a customer-facing report, and nobody can reconstruct how that content was produced, the organization may have real legal and regulatory exposure with no audit trail to even diagnose what went wrong.

A Multi-Pronged Response, Not a Single Fix

There’s no single control that closes this gap, and compliance leaders who go looking for one will be disappointed. The more realistic path is a layered strategy built around a few core pieces working together.

The first piece is visibility and reasonable technical controls: monitoring and limiting which applications and websites are accessible on company devices, understanding that this requires careful review under applicable employment and privacy law in each jurisdiction where you operate, since monitoring employee device activity isn’t uniformly permissible everywhere. The second, and arguably more important, piece is supply: providing employees with vetted, enterprise-grade AI tools that actually meet the tasks they’re trying to accomplish. Blocking unsanctioned tools without offering a real alternative simply pushes the same behavior further underground, onto personal devices and personal networks where you have even less visibility.

The third piece is training, and this is where the survey’s numbers are most alarming: nearly half of employees using generative AI at work have had no formal training on safe use. This isn’t just a good practice gap, it’s increasingly a legal compliance gap. Even after recent softening under the EU’s AI Omnibus package, Article 4 of the EU AI Act still requires organizations to support a baseline level of AI literacy among their workforce. Training needs to do more than explain how to use a tool; it needs to explain concretely why shadow AI use creates risk for the organization, and, just as importantly, why it creates real career risk for the employee if something goes wrong downstream.

What Compliance Officers Should Take From This

The practical message here is straightforward. If your organization hasn’t formally surveyed or audited what generative AI tools your own employees are actually using, day to day, you likely have a real visibility gap, and this survey suggests that gap is larger than most compliance functions assume. Build your AI governance program around the assumption that employees are already using these tools today, whether or not you’ve sanctioned them, and design your controls, your tool offerings, and your training around closing that gap rather than pretending it doesn’t exist. The organizations that get ahead of this will be the ones that treat shadow AI as a governance and change-management problem to solve now, not a policy violation to punish after the fact.