Archive correction — 14 October 2026. This article previously confused occasional use with regular use, changed survey denominators and overstated legal and product-compliance conclusions. Those claims have been corrected. Unsupported cost and return estimates have been removed. Original publication dates are retained.
What the survey says
The research covered 200 UK director-level or more senior respondents in organisations with at least 500 employees, with fieldwork in July–August 2025. It is not a census of all UK firms or individual workers. In SAP’s February 2026 account of research with Oxford Economics, 68% of organisations reported staff using unapproved AI tools at least occasionally. That does not mean 68% of employees use them regularly or that employers cannot see the activity. The training finding concerned businesses reporting a lack of comprehensive employee training, not a count proving that 60% of all UK workers had received none. Original research announcement.
Surveys of businesses, employees and organisations already affected by breaches answer different questions. Their percentages and average costs cannot be combined as though they describe one national sample. A survey association also does not establish that a particular governance measure caused a financial return.
What shadow AI means here
This article uses shadow AI to mean workplace AI use outside an organisation’s approval or oversight. The label alone does not determine legality. Relevant questions include the information used, the purpose, the people affected, the applicable law and the organisation’s role.
The ICO provides guidance on AI and data protection. Using an approved tool does not automatically make a deployment lawful; using an unapproved tool does not automatically establish every alleged breach. Liability must be assessed in context rather than universally assigned to either the employer or employee. ICO guidance.
Check the current EU timetable and scope
The earlier statement that all high-risk EU AI obligations began in August 2026 is outdated. The Commission’s current implementation timeline distinguishes obligations, categories and transition dates, including later high-risk dates. A UK connection to the EU does not make every AI deployment subject to the same provision. Current official timeline.
A practical review
ObvioTech recommendation: invite teams to identify tools, tasks and data they use, then assess the actual risks. Give staff an understandable approval route and explain when they must stop or obtain review. Avoid a fixed vendor-count target that ignores genuine requirements.
- Document the approved use, not just the product name.
- Check provider terms, access controls, retention and data flows.
- Identify information that requires additional protection or must not be uploaded.
- Define human review and escalation for consequential or uncertain outputs.
- Review changes in the product, workflow and applicable obligations.
A workflow platform may help organise some tasks, but installing Make, Zapier or any governance product does not certify UK GDPR compliance. This article does not rank products as the most widely adopted or claim that buying a tool resolves every governance issue.
Measure what changes
ObvioTech recommendation: record visibility, incidents, review effort and task outcomes before and after a change. Report the actual sample and limitations. A training programme or approved-tool list is a control to evaluate, not a guarantee of lower costs, higher returns or immunity from enforcement.
