Over the summer, we spoke with founders and operators about how AI is used in their businesses on a daily basis, beyond strategy presentations or pilot programmes.
One theme keeps coming up that the survey headlines miss: employees are already using AI, whatever the company policy says.
The business assumes the risk without gaining the benefit, and valuable expertise leaves when employees depart.
Part 1: You’ve already adopted AI. You just didn’t choose how.
When asked about AI adoption, most leaders respond with either “we’re on it - of course we use AI” or something similar.
That answer often overlooks a key point: most AI usage occurs outside official channels such as licensed tools, pilots, or formal policies.
Your team has already integrated AI into their work, even if the business has not formally done so.
AI is already performing tasks such as drafting, summarising, analysing, and responding. We’d be surprised if you could say exactly where.
Your team did not wait for approval.
This practice is known as shadow AI: using AI for work without business approval or oversight. Similar patterns existed a decade ago with tools like Dropbox and Trello, which IT departments called shadow IT.
The difference is what the tools do. Those stored your data. These read it, reason over it, and do the work.
It’s not just a handful of enthusiasts.
Deloitte’s survey of 25,000 UK workers, published in September, found that 63% say they knowingly use generative AI for work. Nearly a third of them (31%) do so without their employer knowing, and 65% say leadership hasn’t been convincing about how it should be used. When you read that most businesses now use AI, this is often what is actually being measured: people, not companies.
It matches what we’ve heard all summer. Individuals lead the use, not the company: each person works it out for themselves, with their own tools.
That’s normal behaviour, in a gap most businesses haven’t filled yet.
Free productivity isn’t free.
The obvious reply is: so what? It’s free productivity, and the value is real. People are even paying for it themselves. One in six AI users pays for at least one tool out of their own pocket, and Deloitte estimates that UK workers spend £958 million a year on AI tools for work.
That is exactly the problem. The value is real, but the business doesn’t own it, can’t see it and can’t repeat it.
You’re getting the benefit on someone else’s terms, and keeping the risk yourself.
What’s actually at stake.
Most of this use is harmless. Sorting an inbox or summarising a public report hurts nobody. The risk sits in the small number of workflows that touch customer data, client work, or the expertise that makes your business what it is.
- Customer data. Personal data goes into tools you have no agreement with, and the business is still responsible for it, even though nobody knows it happened.
- Client confidentiality. Many contracts say where client information can go. Nobody has checked whether a personal chatbot is allowed.
- Quality. Work nobody knows was AI-assisted reaches customers, and you assume it was reviewed.
- Know-how. Your most capable people build their best methods in personal accounts, not the company’s.
The security figures point the same way. In IBM’s 2025 breach study, shadow AI was involved in one in five breaches, and high levels of it added around $670,000 to the average cost of a breach. Trade coverage of this year’s study puts it at 43%, more than double.
And it compounds. Every month, more of how your business works builds up in places it doesn’t own.
You don’t need to control all of it. You need to know where the part that matters is.
The question you’ll be asked.
Customers are starting to ask suppliers how they use AI and what happens to their data. A buyer or investor doing due diligence will ask something more direct: where is your knowledge held, and does the business own it?
What would you write?
If the honest answer is “we don’t know”, the decision was made without you.
So who is doing this, and why aren’t they telling you?
Part 2: Your best people have automated their jobs. The business can’t see how.
Somewhere in your business, someone has probably automated a large part of their job, sometimes nearly all of it. They haven’t told you, and from where they sit, that’s sensible. The work arrives on time and to standard, so why explain how?
Keeping quiet is the sensible choice.
Ethan Mollick, a professor at Wharton, calls them “secret cyborgs”: people who use AI in their work without telling their employer. In Deloitte’s UK survey, 31% of those using AI for work said their employer doesn’t know.
That’s a description, not an accusation.
People have always taken the easier route.
Every generation of office tool has been used this way: spreadsheets, macros, templates, the shortcut nobody documents. AI is the next in that line, and far more capable. It doesn’t just speed up the task. It can do the task.
And the incentives point towards silence. Admit it, and you might get more work, not more pay. You might look replaceable: in Deloitte’s survey, 64% of weekly users worry their manager will think AI can do their job. And with no policy in place, you can’t be sure you’re allowed.
The system is producing exactly the behaviour you’d expect.
We’ve been here before, with spreadsheets.
In 2012, JPMorgan’s “London Whale” losses came to around $6bn. They ran partly through a risk model that, as the bank’s own report put it, “operated through a series of Excel spreadsheets, which had to be completed manually, by a process of copying and pasting data from one spreadsheet to another”.
What’s different now is where the tools live. A spreadsheet at least sits on the company drive, where someone can open it. An AI workflow sits in someone’s personal account.
You rehire the role, not the capability.
The business loses twice.
The gain. Most people say they put the time they save back into the job, and we believe them. In Deloitte’s survey, AI users say they save around 70 minutes a week, and that most of it goes into more work for the same employer. But the business still can’t see that time, check how it’s used or share how it was saved. The savings belong to one person’s way of working, not the business. That’s the incentive working as designed, not a flaw in anyone’s character.
The know-how. The prompts and workflows that make that person fast are stored in their personal account. Nobody else learns from them, and when they leave, the method leaves too.
Work you can’t check is work you can’t trust.
So if the work gets done, why worry about how? Because you’re paying for results you can’t check, repeat or keep. In KPMG and the University of Melbourne’s global study, 66% of people who use AI at work rely on its output without evaluating it, and 56% have made mistakes because of it.
Nobody reviews work they don’t know was AI-assisted.
Nobody banned Excel.
The instinct now is to ban AI. Excel went a different way: businesses adopted it, then learned to share it, own it and check it.
So why does banning AI make things worse, and what works instead?
Part 3: Banning AI just moves it to their phones.
When a risk looks too big, the natural reaction is to ban it.
Samsung did exactly that in May 2023, after staff put confidential source code and a recording of an internal meeting into ChatGPT. It banned generative AI on its devices and networks and, in the same announcement, said it would build its own internal tool. The example is three years old. The pattern isn’t.
Even for Samsung, the ban was never the whole answer.
Bans move the risk. They don’t remove it.
A ban doesn’t remove the need. The work still has to be done, and the easier route remains.
In a PagerDuty survey of 1,250 office workers at companies with more than $500m in revenue, 66% said they had used AI tools at work even though they believed company policy didn’t allow it. Those are large companies, with controls to get around. Smaller businesses have fewer controls, not more.
The use moves to personal accounts where nobody can see it.
You swap a visible risk for an invisible one.
Make the approved route the easy one.
Going back to Excel. Businesses made it part of how they work: spreadsheets on shared drives. AI needs the same, with one difference. The approved route has to be better than the free one.
Shadow AI is what happens when the approved route is slower than the unofficial one. So fix the route, not the people.
That means putting in the foundations AI needs to work inside your business, rather than bolting a tool on top. Good foundations do three things:
- Visibility. You can answer “how is AI used here?”, because it happens where you can see it.
- The know-how stays. Prompts, workflows and lessons build up inside the company, so one person’s shortcut becomes everyone’s.
- Better than the free version. The approved AI knows your business: your customers, your decisions, your context. A personal chatbot never will, and that’s why people switch willingly. In the conversations we’ve had this summer, businesses that gave people capable, approved tools saw far less hiding of its use.
A licence is not a foundation.
The fair objection: “We bought licences, and people still use their own.” True, and that’s the point. If the approved tool knows no more about your business than the free one, the free one wins on convenience every time.
It isn’t about which tool. It’s about what the tool knows, and whether what people learn builds up in one place.
We run somai this way. We keep our AI use in the open, and what we learn goes into a shared company brain rather than individual accounts.
What to do on Monday.
- Ask three people how they used AI this week, especially anything touching customer data or client work. Make it an amnesty, not an audit.
- Write down how AI is used here before a customer or buyer asks you.
- Make the approved route at least as good as the free one, or accept that it won’t be used.
- Decide where the know-how lives: in the business, not in personal accounts.