The usage gap is already large

Most conversations about AI governance start from the wrong assumption: that unauthorized AI use is rare and can be headed off before it starts. Survey data says otherwise. In a June 2026 study of 1,250 office professionals at companies with $500 million or more in annual revenue, Wakefield Research (for PagerDuty) found that 66% had used an AI tool at work that they believed was against company policy, and 88% had shared work-related information with a public AI tool such as ChatGPT, Claude, or Gemini.

The information employees shared was not trivial. In the same survey, 43% had put emails or correspondence into a public AI tool, 34% had entered customer data, and 31% had shared financial or confidential documents. None of that required a sanctioned workflow, a data agreement, or IT involvement — only a browser tab.

  • 43% shared emails or correspondence
  • 40% shared meeting notes or summaries
  • 34% entered customer data
  • 31% shared financial or confidential information

Policy alone does not close the gap

The same survey found that 81% of employees believe leadership operates under different AI rules than staff, and 77% believe company AI restrictions limit their professional growth. Only 48% of employees who used an unauthorized tool ever faced a formal consequence for it. A policy that is unevenly enforced and widely resented does not function as a control; it functions as a suggestion.

This matters for a workflow team specifically because it changes where the real risk sits. The risk is rarely someone reading the policy and deciding to break it. It is a routine task — drafting a client email, summarizing a call, checking a figure against a document — being faster in a public AI tool than in whatever the business has built, so the public tool wins by default.

Replace the shortcut, do not just prohibit it

A sanctioned workflow only displaces an unsanctioned one if it is at least as fast and at least as available. That means the internal tool needs to be reachable from where the work already happens — the ticketing system, the inbox, the CRM — not tucked behind a separate login that adds a step the public alternative does not have.

It also means governance needs a fast lane for new requests. If getting a new use case reviewed and approved takes months, employees keep finding their own answer in the meantime. A short, recurring intake process for candidate use cases, even a lightweight one, keeps new demand inside a system that can actually govern data handling, instead of leaking into personal accounts.

Ungoverned AI use has a measurable cost

This is not only a workflow-efficiency question. IBM's 2026 Cost of a Data Breach Report, based on Ponemon Institute research across 602 breached organizations studied between March 2025 and February 2026, found that AI-enabled incidents made up 25% of malicious breaches, a 56% increase year over year, and cost an average of $6 million per breach versus $4.99 million for breaches overall. Organizations that used AI and automation extensively in their own security operations cut breach costs by roughly $2 million.

The direction of that data lines up with the adoption survey: AI use inside a business is growing faster than the visibility and controls around it. Closing that gap is a workflow and governance problem, not a model-selection problem, which is why it belongs on the same roadmap as orchestration, evaluation, and human review rather than treated as a separate security initiative.