When I ask a business owner whether their team uses AI, I almost always hear the same answer: “Not really, not yet.” Ask a few more questions and the story changes. Somebody is drafting client emails in ChatGPT. Somebody else has an AI note taker sitting in on every meeting. Nobody voted on any of it. It just happened.

PagerDuty’s survey, published in June 2026, puts a number on it. A whopping 66% of office workers have used an AI tool for work while believing their company didn’t allow it. That jumps to 72% at companies with 1,500 or more employees, and smaller companies still land at 60%. That’s most of your staff. Let that sink in…

So what’s the actual risk?

The risk is what your team pastes into these tools. Forty three percent of workers in the survey admitted entering emails or other work data into a public AI tool. More than a third put in customer information, and 31% uploaded financial data or confidential documents, internal strategy included.

None of it touches your firewall or your backups. It goes to whoever built the tool, under terms of service nobody read, and there is no putting the toothpaste back in the tube.

Think of it like handing out keys to the building without keeping a list of who has one. Nobody meant any harm. Somebody just wanted to get home for dinner.

Why is nobody telling you?

A third of AI users said they’d deliberately avoid telling a manager they used it. About 30% said the policy felt too restrictive or they were worried how coworkers would react. Another 29% simply weren’t sure what the rules were.

Mind you, most of that is confusion wearing a guilty face.

Here’s where it gets sticky: 86% of workers say their company already has an AI policy, and 81% believe leadership plays by a different set of rules than everyone else. If your team thinks the policy bends for the people at the top, they’ll treat it as optional too. Some go as far as switching to a personal device so nobody can see what they’re doing.

Can’t you just ban it?

Contrary to popular belief, a ban makes the problem harder to see. PagerDuty found 72% of workers believe they understand AI better than whoever’s managing it at their company, and at billion-dollar companies that climbs to 80%. People that confident do not stop because a policy told them to. They just get quieter about it.

Stop pretending AI isn’t already in your office. Pick a tool you can control and tell your team what’s off limits everywhere else. Microsoft 365 Copilot, for example, keeps your data inside your existing tenant (your company’s private slice of Microsoft’s cloud) instead of shipping it to a public chatbot. Give people a sanctioned option that’s as easy as the free one they found on their own, and most of them will take it.

Then write down, in plain language, what never goes into any AI tool, which is the heart of preparing your business for AI without handing over your data. Start with customer records and financial data, and put anything covered by an NDA (nondisclosure agreement) on the list too. Two paragraphs is plenty. Nobody reads a twelve page policy.

Would you believe the answer?

If you asked your team today which AI tools they’re using, would you believe what they told you? Or would you get the same “we don’t really use it” you’d hear if you hadn’t asked at all?

Go find the honest answer, because right now your AI policy is either something your team follows or something they work around. If you want help figuring out which one you have, we’ll help you build a policy that fits how your business actually works and pick tools that keep your data where it belongs.