The hidden risk is unapproved AI

It is a reasonable assumption: if nobody has been told they can use AI tools at work, nobody is using them. For an Operations Manager reviewing risk, an HR Manager thinking about policy, a Managing Director trying to stay in control of company data, or a partner in a law or accountancy firm responsible for client confidentiality, that assumption feels like a safe default. The evidence says it is not.

A NatWest Group report published in 2026 found that 88% of respondents believed external AI tools were already being used within their organisation. The same research found that 51% of businesses feared employees were feeding sensitive company data into unauthorised services. A separate analysis estimated that UK workers were spending nearly £1 billion of their own money on generative-AI tools specifically to do their jobs better. The behaviour is already widespread. The question is whether it is visible.

Why the myth feels so convincing

The logic behind it is understandable. A business has not issued laptops loaded with ChatGPT. It has not signed an enterprise agreement with any AI provider. Procurement has not been involved. Therefore, no AI is in use.

But that reasoning assumes employees wait for formal approval before trying something that helps them finish work faster. In practice, most do not. A team member drafting a proposal at 5pm who discovers a free AI tool saves them an hour is unlikely to pause and submit a request to IT.

The myth also carries a grain of truth. Before generative AI became genuinely useful through tools like ChatGPT and Claude, employees had limited options. The assumption that "nobody uses what we have not approved" worked reasonably well for enterprise software with high setup costs. It does not hold for consumer-grade AI tools that require only an email address to access.

What the evidence actually shows

Three findings from the 2026 research are worth sitting with.

First, the scale of undisclosed use. The NatWest Group research showing 88% of respondents believed AI tools were already in use within their organisation is not a figure that admits much ambiguity. Nearly nine in ten businesses surveyed expected the behaviour was happening, with or without approval.

Second, the data concern is real and specific. The same research found 51% of businesses feared sensitive company data was entering unauthorised AI services. This is not a theoretical risk. Customer records, supplier contracts, internal financial data, and employee information are exactly the types of content employees might paste into a free AI tool to get a faster answer or a better draft.

Third, employees are paying out of their own pockets. An analysis estimated that UK workers were spending nearly £1 billion personally on generative-AI tools for work. That figure tells a specific story. Staff are not using these tools casually or experimentally. They are using them enough that they are willing to spend their own money. That is a signal of genuine productivity value, and it is a signal that the business is not meeting a real need through approved channels.

Unauthorised AI use also creates regulatory exposure. Where personal or commercially sensitive data enters a third-party AI system without a data processing agreement, that creates potential UK GDPR liability. It can also raise confidentiality, intellectual-property, employment, and cybersecurity risks. Policies that specify permitted data categories, require supplier due diligence, and set out accountability are not bureaucracy. They are proportionate risk management.

Why a blanket ban is unlikely to work

For Operations Managers, HR Managers, and Managing Directors, the instinctive response to this kind of finding is often to reach for a policy that says: do not use AI tools we have not approved. That is a reasonable starting point. The problem is that it works only if employees know about it, understand what it covers, have an approved alternative available, and feel safe reporting when they encounter a new use case.

If any of those conditions is missing, the ban does not stop the behaviour. It just makes the behaviour invisible. Invisible usage is harder to manage than visible usage, not easier.

The evidence on workforce AI readiness consistently points in the same direction. Staff who receive clear guidance and practical training on approved tools are more likely to use those tools rather than find alternatives. Staff who receive only a prohibition, without an approved route or a non-punitive way to raise questions, tend to continue using what works for them and say nothing.

The gap the research identifies is not a technology gap. It is a communication and training gap. Employees are using AI because it helps them do their jobs. The business's role is to channel that behaviour into safer, approved, visible usage, not to assume prohibition will eliminate it.

A realistic approach for SMEs

There are five practical steps that consistently appear in the evidence on managing shadow AI use.

1. Publish a short acceptable-use policy. It does not need to be long. It needs to specify which tools are approved, which data categories must not be entered into any AI system, and what to do when a team member wants to use something new.

2. Identify approved tools and make them accessible. If staff are paying personally for AI access, the business has not provided a workable alternative. Identifying two or three approved tools and making access straightforward removes the primary reason for workaround behaviour.

3. Train staff on practical examples. Abstract guidance does not change behaviour. Showing a team member exactly what they can and cannot paste into an AI tool, with worked examples relevant to their role, does.

4. Require human checking of AI outputs. No AI tool should be the final word on anything consequential. Making human review an explicit requirement rather than an assumed good practice closes one of the most common risk vectors.

5. Create a non-punitive reporting route. Team members who discover a useful AI tool, or who are unsure whether a specific use is permitted, need a way to ask without fear of consequence. If that route does not exist, useful information stays hidden.

These steps do not require significant budget. They require time, clear thinking, and someone with the knowledge to put the policy together in a way that reflects how AI tools actually work.

It is worth noting that no policy framework eliminates all risk. Staff with determined intent to circumvent controls will sometimes do so. The realistic goal is not perfect compliance. It is to make compliant behaviour the easy default, and to ensure that the most sensitive data is clearly off-limits with a shared understanding of why.

A vendor-neutral training programme can accelerate this. gecco's Training and consultancy programme gives SME teams a grounding in how AI tools work, where data goes, and what responsible usage looks like day to day. Rather than issuing a blanket ban and hoping staff comply, businesses leave with the knowledge to set proportionate policies and the confidence to report usage openly.

Next step for Operations Managers, HR Managers, and Managing Directors

If your business does not have a clear picture of where AI tools are already in use, that is exactly the kind of gap the AI Readiness survey is built to surface. The questions cover current usage, policy status, data risk, and team confidence, giving you a starting point that reflects your actual situation rather than a generic template.

Take the AI Readiness survey. You will get access to 65+ free resources and a custom AI Readiness report. We then offer a free 30-minute showcase to walk through your results.

If you want support moving from policy to practice, gecco's Training and consultancy programme is designed for exactly that. The real barrier to controlled AI adoption is not technology. It is the gap between what the business has approved and what employees actually need to do their jobs.

Website · LinkedIn · Case Studies · Newsletter