Shadow AI: employees' own AI tools and the policy lagging behind

In early 2026 Gartner surveyed twelve thousand employees and managers in forty countries: of those with a company AI tool, almost nine in ten also use their own tools for work. These people report substantial time savings more often than those who stick to the company tool. In the United Kingdom, Deloitte found among twenty-five thousand workers that almost a third of users do so without their employer knowing, and that roughly one in six pays for it themselves, together about a billion pounds a year. The reason given most often: it works better than what the company provides.

Meanwhile, executives believe they have it under control. In a small Okta survey of executives in seven countries, nine in ten say they can see which AI tools are in use in the organisation, while half of the knowledge workers surveyed use unapproved tools. Treat that figure as an indication, not as proof: the sample is small and the commissioning company sells access management. It does fit what Gartner and Deloitte measure on a larger scale.

The reflex is a ban or a stricter guideline. Deloitte advises the opposite: first map the real use, otherwise purchased licences go unused and the colleagues who are already using AI smartly stay invisible. The data risk is real, as some users share login credentials with tools, and it only comes to light if people dare to say what they use.

The same pattern has been measured in Dutch primary and secondary education. Between 10 March and 14 April 2025, Kennisnet, the PO-Raad and the VO-raad (the Dutch education technology foundation and the sector councils for primary and secondary schools) asked more than 5,000 people in education, from board members and ICT coordinators to teachers, about digitalisation; the report appeared in November 2025. Half of school boards and almost 40 per cent of schools have AI in their policy. Twenty per cent of boards and fewer than 5 per cent of schools have specific guidelines for responsible use, and 5 per cent of teachers say their school has such guidelines. Meanwhile, a third of secondary school teachers use generative AI weekly or more often. Respondents name time and budget to experiment with it as the biggest bottleneck.

The pattern has also been measured in healthcare. In September 2025 Nivel, the Netherlands Institute for Health Services Research, asked 890 nurses, care assistants, nurse practitioners, support workers and practice nurses about their use of AI, weighted by sector and education. Fifty-four per cent used AI in their work, mainly to look up information, and for two thirds of users the initiative was their own. Half of all respondents miss a clear organisation-wide AI policy, and a fifth find that their organisation actively encourages its use. Almost nine in ten have never had any training on AI.

In the Dutch asset management sector, the AFM (the Dutch Authority for the Financial Markets) has measured the same pattern. In a questionnaire among 323 asset managers, conducted in the first half of 2025 and published in April 2026, 73 per cent give all staff free access to public generative AI tools on the internet, while 28 per cent have a policy on the use of generative AI. A quarter have no policy at all on staff use of AI, and more than a third have no technical or procedural controls on the tools staff use. The AFM places final responsibility with the board and senior management.

How solid is the evidence? The phenomenon was widely confirmed in 2026 by three independent surveys, but the series is young and the right response differs from one organisation to the next.