Ask a room of business owners whether their staff use AI at work and about half say no. Ask the staff in the same businesses and the number changes. Not because anyone is lying, but because nobody has been asked in a way that makes an honest answer safe.
This matters more than it sounds. Unreported use is not a discipline problem. It's an information problem: you can't set a sensible rule about something you can't see, and you can't size your exposure from a guess.
Why it stays hidden
The reasons are mundane, and none of them involve bad intent.
- It doesn't feel like using a tool. Someone rewrites an awkward paragraph in a chat window on their phone. That doesn't register as "using AI at work" any more than using a calculator does.
- It started before there was a rule. Which means admitting to it now sounds like admitting to breaking a rule that didn't exist at the time.
- It looks like cheating. In professional work especially, there's a quiet worry that using AI implies the work wasn't really yours.
- It's working. Nobody volunteers information that might get a useful thing taken away.
That last one is the important one. Most unreported AI use is people solving a real problem, usually a writing problem, usually at night. Treating the discovery as a misconduct investigation guarantees you'll find nothing and change nothing.
The two questions that actually work
Drop the word "allowed" and ask about the work instead.
Which parts of your job involve writing something from scratch that's roughly the same shape every time?
When you're stuck on how to word something, what do you do?
Nobody has to confess to anything. You get a list of tasks and a list of habits, and the AI use falls out of the answers naturally. Someone will say "oh, I just put it in ChatGPT and tidy it up" in the middle of describing a quoting process, because in that context it's a method, not an admission.
Ask about the work, not the tool
- Which jobs involve writing the same shape of thing repeatedly?
- Where does information get retyped from one system into another?
- What gets done after hours because it needs quiet?
- When you're stuck on wording, what do you do?
- Which documents do you read in full when you only need three facts out of them?
What you're actually looking for
Three things, in order of how much they should worry you.
1. Which account. A personal free account and a business account with a paid plan are not the same exposure, even when they're the same product. What happens to the text you paste in differs between vendors and between tiers of the same vendor, and the free tier is usually the one people reach for first. This is the single highest-value fact to establish, and it's the one people don't think to mention. We wrote about why the same tool gives two different answers about your data separately.
2. What kind of information went in. Not "was it confidential" — that question produces a defensive no. Ask what the document was: a client email, a report draft, a tender response, a case note, a quote. The category tells you what you're dealing with.
3. Whether it's load-bearing. Some AI use is a convenience. Some of it has quietly become the way a job gets done, and if you banned it tomorrow something would stop working. Knowing which is which stops you from writing a policy the business can't actually follow.
The failure mode: the clean sheet
The worst outcome of this exercise is a set of answers that says nobody is doing anything. It feels like a good result. It's usually a sign the question landed as a threat, and now you have a policy built on a false premise and no way to check it.
If you get a clean sheet from a team of more than about five people doing document-heavy work, assume the question was wrong rather than the answer. Try again from the task angle, ideally in one-on-ones rather than a meeting, and ideally from someone who isn't the person who signs off performance reviews.
What to do with what you find
Resist the urge to write a long policy. The useful version is short enough that people remember it without looking it up, and it answers four questions:
- Which tool and which account people should use for work — naming it, not describing it.
- What never goes in, in concrete terms, with examples from your actual work rather than generic categories.
- What has to be checked by a person before it leaves the building, and who that person is.
- Who to ask when something isn't covered — a name, not a process.
That's the shape we work through in writing your team's AI policy, and the starting drafts are on the policy templates page. Mark one up with your objections; it's faster than starting from nothing.
If the honest version of this conversation would go better with someone from outside the business asking the questions, that's what a policy and audit engagement is for.
Start an enquiryThe part that surprises people
Once the rule exists, use usually goes up, not down. Not because the rule encourages anything, but because the people who were quietly avoiding it — the careful ones, often the most senior — now know where the line is and stop treating the whole category as risky.
That's the actual return on doing this properly. You don't get less AI use. You get the cautious half of your team using it for the right jobs, in the right account, on work where being faster genuinely doesn't cost you anything.