Half of UK firms fear employees are sharing sensitive company data with AI
Senior decision-makers say they cannot see which AI tools their people use or what data goes into them. Here is what that means for keeping company data inside the company.
Summary
Research by Turbotic, reported by Workplace Journal in September 2026, found that 51% of UK businesses are concerned about staff sharing sensitive information with AI, and 88% believed employees used AI tools without formal approval or oversight. Visibility into what leaves the company is the missing piece.
- 51%
- of UK businesses are concerned about staff sharing sensitive information with AI
- 88%
- believed employees used AI tools without formal approval or oversight
- 38%
- cited regulatory or compliance breach concerns
- 27%
- had not heard of "shadow AI" before the survey
Turbotic research, UK decision-makers
Each dot is 1%
88%
of UK decision-makers believe employees use AI tools without approval or oversight.
01
51%
fear staff are sharing sensitive information with AI.
02
38%
name a compliance or regulatory breach as the worry.
03
27%
had never heard of "shadow AI" before the survey.
Figures are as reported by the sources linked below.
The research
Turbotic surveyed senior decision-makers involved in AI projects at UK businesses. The findings were reported by Workplace Journal in September 2026. The sample size was not stated in the coverage.
The risk: company data leaving through AI tools
51% of businesses said they are concerned about staff sharing sensitive information with AI tools. 38% named regulatory or compliance breaches as a worry, and 36% were concerned about employees using AI without management oversight.
Every prompt can carry customer details, contracts, source code or credentials. When it is pasted into an AI tool, that data has left the company.
Leaders believe it is already happening
88% of respondents believed employees used AI tools without formal approval or oversight. Meanwhile 27% had not heard of the term "shadow AI" before the survey, so a large share of decision-makers are still catching up to a problem their staff already have.
"organisations don't know which tools their people are using, what data is being put into them"
Visibility has to come before policy
Bergqvist argues that visibility, governance and trust need to be part of deployment. A policy that nobody can check is a hope, not a control. To stop data leaving you need to see each request and act on it before it goes out.
64% of respondents also said most or all of their AI pilot projects had moved into day-to-day operations, so the exposure is growing, not shrinking.
What this means for your team
- Assume staff already use AI tools you have not approved.
- Check prompts, files and screenshots before they leave the device.
- Block or redact sensitive data by rule, so work is not interrupted.
- Log every event per person so compliance questions have answers.
Inveil is data loss prevention (DLP) for AI. It checks prompts, files and screenshots on each employee's machine before they reach an AI tool, blocks or redacts sensitive data by your rules, and logs every event.
Common questions
- How many companies worry about employees sharing sensitive data with AI?
- In research by Turbotic, 51% of UK businesses said they were concerned about staff sharing sensitive information with AI tools.
- What is shadow AI?
- Shadow AI is employees using AI tools without formal approval or oversight from the business. In the Turbotic research, 88% of respondents believed this was happening, and 27% had not heard the term before the survey.
- How do you stop company data leaving through AI tools?
- Check each prompt, file and screenshot before it is sent and block or redact sensitive data by rule, with a log of every event. Inveil does this on each employee's device.