71% of UK Staff Use Shadow AI: A CIO Governance Fix for 2026

UK CIOs should treat shadow AI as a UK GDPR compliance gap: map unauthorised tool use, then replace it with sanctioned, monitored alternatives.

Shadow AI — employees using ChatGPT, Gemini or other public AI tools without IT approval — has moved past a minor policy nuisance and into territory the Information Commissioner’s Office (ICO) now treats as a live UK GDPR enforcement risk. Every prompt an employee pastes into an unsanctioned tool that contains customer data, financial figures or personal information is a potential personal data transfer the organisation cannot account for, log, or defend in a regulatory inquiry. For CIOs already carrying accountability for AI risk reporting to the board, shadow AI is the exposure most likely to surface first — not because it is exotic, but because it is already happening inside every UK enterprise, largely undetected.

How widespread is unauthorised AI use inside UK organisations?

According to a 2025 Microsoft-commissioned survey conducted by Censuswide of over 2,000 UK employees, 71% use AI tools their employer has not approved, most citing familiarity from personal use rather than any deliberate attempt to bypass policy. According to PagerDuty’s 2026 workplace AI survey, conducted by Wakefield Research across the US, UK, Australia and Japan, 88% of employees who use public AI tools have shared work-related information with them, including 34% who shared customer data and 31% who shared financial or confidential documents. Fewer than a third of unauthorised users in either study reported any concern about where that data ends up.

Executive Action:

• Commission an anonymous internal survey or network-traffic audit to establish your organisation’s actual shadow AI usage rate before assuming it mirrors the national average.
• Identify which business functions (finance, legal, customer service) show the highest use of public AI tools, since these carry the most sensitive data.
• Brief the CISO and DPO jointly — shadow AI is simultaneously a security gap and a data protection incident waiting to be reported.

What does UK GDPR actually require CIOs to do about shadow AI?

The ICO’s guidance on AI and data protection does not name “shadow AI” as a distinct category, but its existing accountability principle applies directly: an organisation must be able to demonstrate what personal data it processes, where it goes, and under what lawful basis — regardless of which tool an employee used to process it. When staff paste customer records into a public large language model, that data may be used to train the vendor’s model, stored outside the UK, or retained indefinitely, none of which the organisation has assessed or documented. That is an accountability failure under UK GDPR Article 5(2), independent of whether the AI tool itself did anything wrong. A Data Protection Impact Assessment covering sanctioned AI tools does nothing to cover the ones nobody logged.

Executive Action:

• Ask the DPO to confirm whether shadow AI use has been assessed as a data processing risk in the current Data Protection Impact Assessment register.
• Document a lawful basis and retention position for any sanctioned AI tools you roll out, so staff have a compliant alternative rather than a banned one.
• Treat any confirmed instance of customer or employee personal data entered into an unsanctioned tool as a potential reportable incident, not an HR matter alone.

Should CIOs block public AI tools or govern their use instead?

Blocking alone rarely works and can backfire. PagerDuty’s research found that more than half of unauthorised users who were told to stop simply continued, often on personal devices where the organisation has no visibility at all — trading a monitored risk for an unmonitored one. The more durable approach, and the one now emerging as UK best practice, is a tiered governance model: sanction a small number of enterprise-grade AI tools with contractual data protections and audit logging, block the highest-risk public consumer tools at the network and endpoint level, and require any exception to go through a fast, lightweight approval path rather than a six-week procurement cycle that guarantees staff route around it.

Executive Action:

• Stand up one enterprise AI tool with an enterprise data processing agreement before restricting consumer alternatives, so staff have a legitimate option on day one.
• Set a target approval turnaround (5 working days or less) for new AI tool requests, and publish it, so shadow use is a process failure you can fix rather than an inevitability.
• Extend acceptable-use monitoring to managed personal devices where feasible, and be transparent with staff about what is and isn’t monitored.

How should CIOs report shadow AI risk to the board?

Boards increasingly expect AI risk on the same reporting cadence as cyber risk, and shadow AI belongs on that same paper — not buried in an IT operations update. The most useful board metric is not “how many people use AI” but exposure-weighted: how many sanctioned AI tools exist with signed data processing agreements, what proportion of high-sensitivity functions (finance, legal, HR) have a compliant alternative in place, and how many confirmed incidents of unauthorised data disclosure occurred in the reporting period. Pairing that with a remediation timeline turns a vague cultural problem into a trackable governance metric the audit or risk committee can actually hold management accountable against.

Executive Action:

• Add a shadow AI exposure line to the quarterly technology risk report, alongside sanctioned-tool coverage and confirmed incident counts.
• Set a board-visible target date for closing the gap between sanctioned-tool coverage and actual usage in your highest-risk business functions.
• Use INFORMD’s AI governance self-assessment to benchmark your current maturity before the next board cycle.

Shadow AI governance sits close to the wider data governance challenge CIOs face when scaling AI more broadly — our earlier briefing, How UK CIOs Should Fix Data Governance Before Scaling AI, covers the foundational controls this builds on. CIOs weighing a formal AI code-of-conduct alongside a shadow AI policy may also find AI-Generated Code: A UK CIO Governance Checklist for 2026 useful, since both problems stem from the same root cause: staff adopting AI faster than governance can follow.

INFORMD provides intelligence briefings, tools and frameworks for senior business leaders across technology, finance, strategy and compliance. Based in Milton Keynes, UK, we help executives stay informed and act with confidence. Explore our full briefing library (/resources/) or access our free assessment tools (/tools-assessments/).

Stay ahead. Subscribe to INFORMD’s weekly executive briefing at informd.co.uk (/resources/).