Most of the business leaders I talk to assume their employees aren’t using AI because the company hasn’t explicitly mandated or encouraged it. That assumption is one of the most common blind spots I encounter.
Why? Because their employees almost certainly are using AI.
Recent surveys put regular AI usage for work somewhere between 28 – 40% percent of employees. In surveys focused on “remote capable” employees that number climbs as high as 66% and growing every quarter.
The conclusion for business leaders is straightforward: AI is likely already inside your company, whether you’ve sanctioned it or not.
What employees are using it for
This is where it gets interesting. AI isn’t just being used to draft emails or summarize meeting notes. Microsoft’s 2026 Work Trend Index reported that nearly half of more than 100K M365 Copilot chats involved cognitive tasks, the kind that requires human judgement: analysis, problem solving, creative thinking. This has shifted from as recently as last year when AI use at work was more likely to be help generating content like writing emails or drafting documents.
This means your team isn’t just using AI to move faster. In many cases, they’re using it to think. And most of them are figuring out how to do that on their own: surveys show that fewer than 10% of workers look to their employer for guidance on AI. More than half report that their employer has never even asked about their AI usage.
The risks hiding in plain sight
Without a policy or training, employees make their own decisions about which tools to use and what to put into them. The results can be unpredictable.
Hallucinations. AI can be wrong. It can be very wrong, and very confident in its output until challenged. Employees using AI without understanding this can make catastrophic mistakes: reporting incorrect data, making bad assumptions, recommending or taking actions based on flawed analysis.
The legal profession has already learned this the hard way. We’ve all seen the headlines: cases of AI-generated citations that turned out to be fabricated have led to sanctions, reprimands, and reputational damage. The same risk exists anywhere AI output gets used without verification.
Data security and privacy. Studies suggest that a significant share of employees are pasting sensitive company data into AI tools, often through personal accounts with no enterprise privacy protections. Many companies wouldn’t even know how to respond if a security incident occurred. But even if they can shut down AI tools if an incident is discovered, the cat’s already out of the bag. When employees paste sensitive company data, PII or HBI, trade secrets, client information, strategy docs into public AI tools there’s a risk of that data leaking. That’s compliance risk, reputation risk, trust risk.
What good governance actually looks like
The good news is that managing AI use doesn’t require a massive initiative. It just requires clarity of the risk and a good advisor.
Leaders should start by assuming AI is already in use and design your approach from there. Find out what tools your people are actually using, for what purposes, and where the biggest gaps in guidance exist.
From there, a practical governance approach covers a few key areas:
Clear guidelines. Employees need to know what’s permitted: which tools are approved and with what precautions in place, what data should never go into an AI, and that human review is required before AI output is used for anything consequential.
Layered training. A two-layer model works well. Start with a baseline for everyone that covers data handling, verification, and when to keep a human in the loop. Then add role-specific training for functions with higher risk exposure: legal, finance, HR, customer support, and anyone working with sensitive data or high-stakes outputs.
Ongoing visibility. Leaders should track tool usage, approved versus unapproved tools, what tasks AI is being used for, time savings or quality gains, any incidents or near misses, and training completion. You don’t need a dashboard on day one, but you do need a way to know what’s happening and keep on top of it.
A culture that invites it. This is the piece that gets overlooked most often. If employees feel like AI is a liability rather than a resource, but are still feeling pressure to “do more with less” (because aren’t we all?) they’ll use it anyway and just won’t tell you. The leaders who get the best results create space for safe experimentation, ask the people most affected by workflow changes what they’re actually experiencing, and roll out AI solutions that address real needs.
The bottom line
AI governance is about recognizing that adoption is happening and making sure it works in your company’s interest.
The companies that will come out ahead aren’t the ones that ignore the question or the ones that lock everything down. They’re the ones that get ahead of it thoughtfully: understand what’s happening, put the right guardrails in place, and bring their people along.
If you’re not sure where to start, I can help. I work with business leaders to understand how AI is being used inside their organizations, build the right policies and safeguards, and train employees to use AI safely and productively. Book a consultation to talk through where you are and what would help most.
Data in this post came from these sources:
- Frequent Use of AI in the Workplace Continued to Rise in Q4
- Agents, human agency, and the opportunity for organizations
- Use of Gen AI in the Workplace and the Value of Access to Training – Liberty Street Economics
- AI Is Getting Real, But the Real Work Is Still Ahead
- Widespread Corporate Data Leaks via ChatGPT Use by Employees – OECD.AI
- 77% of Employees Share Company Secrets on ChatGPT, Report Warns