One in six people who use AI at work pay for a tool themselves, an estimated £958m a year across the UK. Most haven't mentioned it to their employer, and 64 per cent of weekly users worry the tool makes them look replaceable.
Your Staff Are Buying Their Own AI, and Keeping Quiet About It
One in six people who use AI at work pay for at least one tool out of their own pocket. Across the UK that adds up to an estimated £958 million a year, according to Deloitte's GenAI Workforce Survey, which ran to 25,000 workers and which Deloitte describes as the largest study of workplace AI use conducted in a single country. Deloitte plans to repeat it every six months, so next year's figure will be a measurement rather than a forecast.
Sixty-three per cent of UK working adults say they knowingly use AI for work, and almost a quarter use it every day. That is ordinary working behaviour now.
Most of the coverage has run with the national total, which no business can act on.
Sixty-four per cent of weekly users worry their manager will think the AI could do their job. People who feel that way don't tend to volunteer what they're using, and the survey puts almost a third of AI users working without their employer's knowledge.
What the money is telling you
A personal subscription to one of the main assistants runs at about £20 a month, which is roughly £240 a year out of taxed income that nobody reimburses.
Deloitte's respondents reckon the tools save them around 70 minutes a week. Most of that recovered time goes back into doing more work for the same employer. Allowing for holiday, that's something like 50 hours a year per person, bought privately and handed over.
Your staff are paying a supplier so they can get more done for you. The business pays nothing towards it and holds no contract with the supplier involved.
Thirty-four per cent of AI users are already on external tools their employer pays for, against 46 per cent using free ones. Having a licence available changes what people reach for.
That's a demand signal with a price tag attached. If one in six of your AI users has reached for their own card, the question of whether the business should adopt AI has already been settled by the people who work for you. What's still open is whether it runs on your systems or on theirs.
Why nobody has mentioned it
Just under a quarter of workers think there's a stigma attached to using AI at work. Among people using it every week, the worry is sharper and more specific: that saying so out loud invites the conclusion that the tool could replace them.
Between them those two findings explain the behaviour. Someone who has found a tool that makes them faster, and who suspects that admitting it will make them look replaceable, has every reason to keep quiet and pay the £20 themselves.
A wider finding sits underneath this one. Sixty-five per cent of AI users report a lack of convincing leadership on how the technology should be used where they work. Where nobody senior has said what good use looks like, people form their own view about whether to mention it, and a cautious view means saying nothing.
None of that makes the security risk any smaller. We wrote earlier this month about why blocking shadow AI doesn't work, which covers the risk itself and how to find what your people are already signed into.
What a personal subscription costs you
The business pays nothing for these tools. It also gets none of the things that come with buying software properly.
The spend sits on a personal card, so no review of company spending will ever surface it.
There's no admin console, which means nobody can see which documents have been uploaded, and nobody can switch an account off.
There's no contract between your business and the vendor. If a client's personal data goes into a personal account, the data processing arrangement you'd need under UK GDPR simply doesn't exist, and you'd be relying on consumer terms written for someone's private use.
And the account belongs to the employee. When they leave, the history, the uploaded files and whatever prompts they've refined over a year leave with them. The contract is between that person and the vendor, so the business has no standing to ask for a copy.
None of this is new in shape. We covered shadow IT last year, when the same pattern ran through personal Dropbox accounts and project tools nobody had approved. The difference now is that a file-sharing account holds the documents you put into it, while an AI account holds those documents and everything anyone typed about them.
Half of them have had no training
Forty-nine per cent of people using AI at work say they've received no formal training on how to use it safely or effectively.
The most common uses are entirely ordinary. Searching for information and drafting emails account for 43 per cent each, and writing summaries for a further 31 per cent. Ordinary work is also where client names, contract terms and payroll details live. A contract gets pasted into a consumer chat window by someone drafting a quick reply, and it now sits in an account the business has no rights over.
Capable people given no guidance will work the boundaries out for themselves, and some of those boundaries will end up in the wrong place.
What to do about it
Say that using it is expected. A short message from whoever runs the business, making clear that AI use is welcome and that nobody will be thought less of for admitting to it, removes the incentive to hide, and it can be done today.
Then ask. A question from a manager who has already said the answer carries no penalty gets a truthful reply. One that arrives as an audit doesn't.
Buy the licences. If people are already paying around £20 a month, the business tier costs roughly the same per seat and brings the admin console, the data protection terms and the ability to switch an account off when somebody leaves. Our comparison of the main AI plans for UK businesses sets out what each tier includes, and our breakdown of what Copilot costs in practice covers the licensing side.
Move the work across before you switch anything off. Somebody with a year of refined prompts and reference material in a personal account will help you migrate it into a licensed one. The same person will resist having it taken away, and the material is worth keeping.
Give people an hour. Enough to cover which information can safely go into these tools, and what to do when something has already gone in that shouldn't have.
The honest summary
Your staff have already decided that AI is worth paying for. A good many have also decided that telling you about it carries a risk they'd rather not take.
While that second calculation holds, client information sits in accounts you have no rights over, and a year of someone's refined working method walks out of the building on their last day.
If you'd like to know which AI tools are already being signed into with your work accounts, and what it would cost to bring them onto licences you control, book a discovery call and we'll go through it with you.
