Deloitte Survey Finds UK Workers Use Shadow AI
Shadow AI use is a live APS governance risk - this UK evidence base supports the case for approved tools and training over policy-only responses.
Key points
- Deloitte surveyed 25,000 UK workers; 63% used GenAI at work, 31% without employer knowledge.
- Shadow AI findings are directly analogous to risks APS agencies face as staff adopt consumer tools independently.
- Results are self-reported survey data, not a technical audit - governance gap is indicative, not precisely measured.
Implications for Australian agencies
- Consider APS agencies could assess whether their current AI acceptable-use policies are matched by approved tool availability and staff training, rather than relying on prohibition alone.
- Consider Data governance and security teams may want to consider whether shadow AI risk is adequately addressed in existing agency risk registers and ICT security controls.
Implications are AI-generated. Starting points, not advice — see methodology for how they're framed.
View original source
Copied.
Appeared in:
Weekly digest, 14 September 2026
"Deloitte Survey Finds UK Workers Use Shadow AI"
Source: Let's Data Science – AI Governance
Published: 17 September 2026
URL: https://letsdatascience.com/news/deloitte-survey-finds-uk-workers-use-banned-ai-71be98d5
Deloitte's GenAI Workforce Survey of 25,000 UK workers found that 63% have used generative AI at work, with 31% of those users doing so without employer knowledge. Approximately one in ten workers used a tool their employer had banned or would disapprove of. The survey, conducted between May and June 2026, is self-reported rather than a technical audit, but it describes a well-recognised governance pattern: consumer AI adoption outpaces organisational controls. Deloitte recommends organisations focus on understanding actual usage and supporting responsible use rather than relying solely on prohibition.
Implications for Australian agencies:
- [Consider] APS agencies could assess whether their current AI acceptable-use policies are matched by approved tool availability and staff training, rather than relying on prohibition alone.
- [Consider] Data governance and security teams may want to consider whether shadow AI risk is adequately addressed in existing agency risk registers and ICT security controls.
Retrieved from SIMS, 15 November 2026.