Your Employees Are Already Using AI. Your Policy Won't Stop Them.

Businesses have spent years encouraging employees to find better ways of working, improve productivity and use technology. Yet now that employees have access to something that can genuinely help with those things, some employers seem determined to stop them using it.

I find that a strange position to take.

If someone in your business discovers a way to complete a task in twenty minutes rather than two hours, surely you'd want to know about it? You'd probably want to understand what they've done, whether the results are any good and if the same approach could benefit other people.

But as soon as someone says they used ChatGPT or Claude we decide that instead of finding out how these tools might help, we're blocking sites, tightening controls and warning employees about what might happen if they use AI without approval.

I've spent much of my career helping businesses make better technology decisions, and more recently I've helped develop AI policies and deliver training to organisations trying to understand what this means for them.

I'm not worried about businesses taking risks seriously. They should. What troubles me is when leaders think blocking access to these tools means they actually know how people use them.

It isn't, and your employees have likely already shown why.

Your employees didn't wait for permission

Think about how businesses have traditionally introduced new technology.

Someone identifies a problem, looks at possible solutions, talks to suppliers and eventually gets approval to spend money. IT gets involved, installs the software, and employees receive whatever training the business decides they need.

Sometimes that's a sensible process. Sometimes it takes so long that the problem everyone originally wanted to solve has become part of everyday life.

AI hasn't followed that pattern.

Employees can discover ChatGPT, Claude, Gemini or countless other services in their own time. They can experiment with them at home, find something useful and start applying what they've learnt at work.

No purchasing process, no implementation project and quite possibly no conversation with their employer.

The Office for National Statistics reported in October 2026 that 38% of UK businesses with ten or more employees were using at least one type of AI technology in September. The figure had increased considerably since the same question was first asked in 2023.

Those are businesses reporting AI adoption, not a count of every employee who's independently opened an AI account. That's an important distinction because a business can genuinely believe it isn't using AI while individual employees use it every day.

An employee doesn't need access to company systems to ask AI to improve an email or help prepare a presentation. Their personal phone is enough.

And that's where I think some business leaders have misunderstood the situation. They believe they're deciding whether AI should enter their business, when the more useful question is whether it's already there and what people are doing with it.

I've seen enough technology introduced into organisations to know that official approval doesn't always reflect how people actually use it. AI makes that gap between management expectations and everyday reality more obvious.

There are good reasons people want to use it

When I deliver AI training, I want people to understand that the technology is much more useful when you start with a real problem rather than asking it to do something impressive for its own sake.

There's no particular achievement in getting AI to produce a ten-page report that nobody needed in the first place.

But if someone regularly struggles to turn complicated information into something their colleagues can understand, and AI helps them explain it more clearly, that's worth exploring.

The same applies to preparing meeting notes, working through unfamiliar terminology, organising information or getting a second perspective on something you're writing.

None of these examples requires a business to reinvent how it operates completely. They're ordinary activities that take up people's working days.

Of course, the quality of the result matters. Saving an hour is pointless if somebody else has to spend ninety minutes correcting what the AI produced.

That is why I want business owners to take a genuine interest in how employees use these tools. People closest to a problem often understand its frustrations better than the person approving the budget to solve it.

You might find employees are wasting hours on work that could be done differently. Equally, you might discover they're relying on AI for something where its mistakes could cause serious problems.

The worst response is to assume that because management hasn't approved anything, nothing is happening.

An AI policy doesn't mean you've solved the problem

I've helped organisations prepare AI policies, including businesses that handle confidential client information and educational environments where getting things wrong can be particularly serious.

This work has reinforced something I've believed for years about technology policies. The document is the easy bit. Getting people to understand it, follow it and recognise why it matters is where the real work begins.

You can spend weeks agreeing on a policy's wording. You can have it reviewed, approved and circulated to every employee. You can even get everyone to sign something confirming they've read it.

None of that proves they understand what they're allowed to do when they're sitting at their desk on a Tuesday afternoon, trying to finish a piece of work.

AI poses a particular problem because the line between acceptable and unacceptable use isn't always clear.

Take an accountant using AI to explain a complicated financial concept in plain English. That may be a perfectly sensible use of the technology. But if they upload identifiable client records to an unapproved personal AI account for a more specific answer, the risks change considerably.

The employee might see those two activities as virtually identical. They're asking the same tool for help with the same subject.

From a data protection and confidentiality perspective, however, they're very different.

That's what your policy needs to explain.

Not simply that employees must use AI responsibly, but what responsible use actually means in the context of their jobs.

The UK Business Data Survey 2026 found that only 17% of businesses using AI reported having formal or informal policies or guidance. Just 5% reported a formal written policy.

That should concern business leaders, although I'd be equally interested in how many of those with policies have actually explained them properly to their staff.

The personal account problem

One issue I've had to consider when developing AI guidance is the difference between AI services provided through an organisation's approved business arrangements and someone using their own personal account.

The same contractual terms, privacy settings or information-handling arrangements don't necessarily apply.

For example, Microsoft Copilot Chat can provide enterprise data protection when accessed through an eligible work account. That doesn't mean every Microsoft AI feature is identical or that employees can enter any information they like without consequences.

Likewise, businesses shouldn't assume that every ChatGPT account has the same protections. Consumer and business offerings can have different data-handling arrangements, and you need to check them.

When you're responsible for protecting confidential client records, employee information or commercially sensitive documents, don't leave that to guesswork.

I find it frustrating when people reduce technology decisions to whether a product is supposedly secure. Security isn't a permanent label attached to software just because someone has paid a subscription.

You need to understand what information it handles, who can access it, how it's handled and whether the organisation has the right agreements and controls in place.

Employees shouldn't be expected to investigate all of that themselves.

Management is responsible for establishing a sensible framework and making sure people understand it.

If there's a legitimate reason to stop employees from using a particular AI service, explain it clearly. Ideally, there should also be an approved way of achieving the same useful outcome.

Otherwise, don't be surprised if someone uses the tool they know works rather than spend another afternoon fighting a process that doesn't.

Banning something doesn't mean people stop doing it

In cyber security, employees using AI services without their employer's knowledge or approval is called shadow AI.

It's a relatively new term for a problem IT departments have dealt with for years.

Before AI, employees used personal email accounts to send work documents, signed up for unauthorised file-sharing services, or installed software because they couldn't get what they needed through official channels.

Technology changes, but the underlying behaviour stays familiar.

People want to get their jobs done, and if the approved systems make that unnecessarily difficult, some will find another way.

That doesn't make ignoring company policy acceptable, but it should make business leaders question why they're ignoring it.

Some circumstances justify an outright prohibition. If a particular AI product can't meet an organisation's information security requirements, restricting it may be the only sensible option.

But restriction needs to be part of a wider approach.

If employees are already using AI and management introduces a blanket ban without understanding what they're using it for, some activity may become less visible.

I would much rather someone felt comfortable saying they'd used the wrong tool or shared information they shouldn't have than discover the problem weeks later because they were afraid to admit what happened.

That doesn't mean removing accountability. It means creating an environment where people understand the rules and feel able to report mistakes before the consequences become worse.

I've dealt with enough cyber security issues to know that delayed reporting can make an already difficult situation considerably harder to manage.

The objective should be to reduce the risks, not simply reduce the number of people willing to admit those risks exist.

Knowing how to use AI isn't the same as knowing when to trust it

I also think we're giving far too much attention to teaching people how to get impressive answers from AI and not enough to checking whether those answers are correct.

You can write an excellent instruction and still receive completely inaccurate information.

The problem is that AI can make a mistake without sounding remotely uncertain about it.

It can produce a professional explanation, use convincing terminology and present information in a way that makes the reader believe somebody has carefully checked it.

Sometimes the answer will be excellent. Sometimes it won't.

The person reading it still has to make that judgement.

This matters enormously in businesses where employees deal with contracts, financial information, safeguarding responsibilities, or decisions that affect other people.

I've worked with organisations across several of those sectors, and I wouldn't be comfortable with someone assuming an AI-generated answer was reliable simply because it was well written.

People need to know when to question what they've been given, when to check the original source and when a decision requires someone with the right knowledge or authority.

If you're asking AI to help write a routine internal message, the consequences of an error may be relatively minor. If you're relying on it to interpret a legal obligation or make a decision involving sensitive personal information, the consequences can be considerably greater. Employee training should make it central to understanding when AI can be trusted, and when its answers need checking, rather than an afterthought buried somewhere in the policy.

What I'd do if I were responsible for your AI policy

I'd start by finding out what employees are already doing.

I wouldn't send an email asking everyone to confess if they've ever dared to use AI. Instead, I'd be upfront about wanting to learn how AI might help people do their jobs better, while keeping important information safe and secure.

Then I'd ask people what they're using, what they've found helpful and where they're struggling.

Some of the answers will probably surprise management. That's useful. It means you're learning something about how the business operates rather than relying on assumptions.

Once you understand that, review the tools people are using and decide which are appropriate. Make sure you've properly considered the privacy arrangements, costs, and security requirements.

Be clear about what employees can and cannot share. Provide examples relevant to their actual work rather than generic warnings about confidential information.

Explain that AI-generated material needs checking and that the level of checking should reflect the consequences of getting something wrong.

Make sure employees know who to approach when they're uncertain, and what to do if they realise they've made a mistake.

Then revisit the arrangements regularly. AI isn't standing still, and neither are the ways people use it.

I wouldn't make the process unnecessarily complicated. A smaller organisation doesn't need to create an entirely new management department to oversee AI, but somebody does need to take responsibility for the decisions.

And I certainly wouldn't start by buying licences for every employee before understanding whether you need them.

Work out what problem you're trying to solve, then decide which technology makes sense.

That's how I'd approach most technology investments, and AI doesn't deserve special treatment just because everyone is talking about it.

This is a leadership decision

I don't expect every business owner to understand the technical detail behind AI, any more than I'd expect them to configure their own firewall or understand every aspect of their accounting software.

But I do expect them to take responsibility for how their organisation uses technology.

That includes seeking advice when it's needed, challenging assumptions, and ensuring employees have the guidance and tools to do their jobs properly.

Some businesses will find AI offers genuine opportunities to improve efficiency, quality, and customer service. In other cases, it adds little value or introduces risks that outweigh the benefits.

Being a good leader means being prepared to make those judgements rather than assuming every new technology must either be embraced enthusiastically or banned completely.

What worries me is that some businesses are spending more time discussing how to prevent employees from using AI than understanding why they want to use it.

While management has that conversation, the technology keeps developing, and employees keep discovering what it can do.

If you don't know whether people in your organisation are using AI, find out. If you're concerned about the information they're sharing, set sensible controls and explain them clearly. If somebody has found a useful application, understand it before dismissing it.

You don't have to approve everything, and you certainly shouldn't ignore the risks.

But telling employees they aren't allowed to use AI and assuming the matter is closed isn't much of a strategy.