Finding out what AI your people really use, without watching them

Ask most leadership teams how their people use AI and you will get a confident answer about the tools the company has approved. Ask the people themselves, anonymously, and you usually hear about a different set of tools, used for different things, often on personal accounts. This guide is about closing that gap without turning into the office that watches everyone’s screen.

What “shadow AI” means

Shadow AI is any use of AI at work that the organisation does not know about or has not agreed to: a personal ChatGPT account used to draft a client email, a free transcription app recording a meeting, a browser extension that summarises documents. Deloitte’s 2026 survey of UK workers found that 31% of those who use generative AI at work do so without their employer’s knowledge.

It is rarely a discipline problem. People reach for these tools because they help, because the approved option is missing or awkward, or because nobody has said what is allowed. Treating it as misconduct mostly teaches people to hide it better.

The risks that actually matter

• Information leaving your control. Customer details, financial figures or HR matters pasted into a personal account are outside your contracts, your retention rules and your ability to get them back.
• Unchecked output reaching customers. AI-drafted text, figures or code that goes out without anyone checking it is where mistakes become visible.
• Money spent twice. Individual subscriptions, duplicate tools and licences nobody uses add up quietly.
• Uneven skills. A few people get real value while most barely start, and nobody shares what works.

None of these is solved by banning AI. They are solved by knowing what is happening, then making the safe way the easy way.

Why shadow AI detection software is the wrong place to start

There is a whole category of software that promises to detect shadow AI by watching network traffic or people’s screens. It is usually the wrong first step.

• It shows which websites were visited, not what was put into them or why.
• It misses phones and home devices, which is where a lot of this use happens.
• It tells people they are not trusted, which is the opposite of what you need if you want them to be open.
• It answers “who broke the rules?” when the useful question is “what do people need?”

Ask instead, and make it safe to answer honestly

The quickest way to find out what AI your people use is to ask them, in a way that makes an honest answer safe. A short, anonymous survey of everyone, including the people who do not use AI at all, gives you a far truer picture than any log file.

AI survey questions for employees: ten to ask

1. Which AI tools do you use for work, if any?
2. For each one, is it a company account, a personal account, or a free version?
3. What do you use them for? (Drafting, research, summarising, analysis, code, something else.)
4. How often do you use AI at work: daily, weekly, occasionally, never?
5. What kinds of information have you put into them: customer, financial, HR, internal documents, or none of these?
6. Does anyone check what AI produces before it reaches a customer or a decision?
7. Have you had any training or guidance on using AI at work?
8. How confident do you feel using it?
9. What stops you using AI more, or at all?
10. Do you know what the organisation’s policy says? If there is not one, what would you want it to cover?

These are examples to start from. Our free AI Maturity Assessment already covers them and more, and you can send it to your team for free.

Include people who do not use AI: their answers tell you what is holding them back, and they are often the group you most need to hear from.

How to keep it honest

• Never ask for names, and say clearly who will see the results and in what form.
• Only show results for groups large enough that nobody can be picked out. Five people is a sensible minimum.
• In a small team, do not ask for department or role: it makes people identifiable.
• Keep it to five to ten minutes, and say that non-users’ answers matter just as much.
• Share what you found with everyone afterwards, and what you will change because of it.

Running it properly is the harder part. A general survey tool will collect the answers. You still need to make sure nobody can be picked out in a small group, break the results down by department, work out which gaps matter, and turn it into a plan. Our free AI Maturity Assessment does that: results are only shown for groups of five or more, the report is by department, and it ends with what to do first.

What to do with the answers in the first 30 days

1. Approve a tool people already use, set up centrally with a company account, so the easy option is also the safe one.
2. Write a one-page policy in plain English, focused on what information can and cannot go into AI. Long policies do not get read.
3. Deal with the riskiest use first: sensitive information on personal accounts, and customer-facing output that nobody checks.
4. Share what works. Your most confident users are your best trainers. Ask them to show a colleague.
5. Keep the results as a baseline and ask again in six months, so you can see whether things have moved.

The short version

Most AI use at work is invisible to leadership, and most of it is well meant. Find out by asking rather than watching, make it safe to answer honestly, then make the safe option the easy one. The organisations that do this well end up with more AI use, not less, and far less risk.

Sources

• Deloitte UK, GenAI workforce survey 2026: shadow AI
• Gartner Peer Community: finding the AI tools employees use without creating mistrust