Your Team Is Already Using AI. Do You Know Where the Information Goes?

Picture a routine email from your largest client. Their security team is updating its vendor review, and there is one new question on the list:

Has any of our information been entered into a generative AI tool? If so, which one?

You forward it to IT. IT can tell you which tools the organization has approved. Nobody can tell you about the Tuesday evening when a senior analyst, up against a deadline, pasted rough notes from that client's file into a free AI assistant, got a clean first draft in under a minute, and sent the work out on time.

The scenario is hypothetical, but the risk is plausible. The analyst meant no harm, and the client was happy with the work. Still, entering client notes into an unapproved tool may create confidentiality and governance risks. The honest answer to the client's question is "we don't know," and that is a difficult answer for an organization trusted with other people's information.

Leaders feel confident. The evidence is less reassuring.

AI is already part of everyday work. In July 2026, Statistics Canada reported that 35.9% of workers aged 15 to 69 had used generative AI tools as part of their main job or business in the previous 12 months, based on its March 2026 survey. The rate was 65.6% in professional, scientific and technical services, and 59.2% in finance, insurance, real estate, rental and leasing.

Those figures measure use, not misuse. They don't tell us whether the tools were approved or what went into them. The concern is narrower: shadow AI, meaning AI tools used for work without the organization's approval or oversight. A free app or personal account isn't automatically shadow AI. What matters is whether the organization has approved the use and can oversee it.

Shadow AI is hard to measure, because surveys depend on people reporting their own behaviour. But one global survey commissioned by Okta, a company that sells identity security products, points to a gap worth taking seriously:

• 90% of the 292 executives surveyed were confident in their organization's visibility into AI tools. In Canada, the figure was 82%.
• 52% of the 492 knowledge workers surveyed, all of whom had recently worked with AI, reported using unsanctioned AI tools. In Canada, the figure was 50%.
• 65% of executives said their AI policies were very clear. Only 43% of knowledge workers agreed.

The executives and workers were separate groups, not matched pairs from the same organizations, so these figures can't tell us whether any executive misjudged their own employees. Canada was only about 12% of respondents, and Okta has a commercial interest in this topic. Treat the results as a warning signal, not a representative measurement of Canadian workplaces.

A separate Canadian survey looked at what goes into public tools. In a KPMG in Canada survey of 2,183 employees in August 2024, 24% of generative AI users said they had entered proprietary, non-financial company data into public AI tools, and 19% said they had entered private company financial data. These groups may overlap, and the survey doesn't establish whether the tools were approved. Fewer than two in ten employees said their employer had a comprehensive policy.

Why this is a leadership problem, not an IT problem

An unapproved upload doesn't automatically mean a public data leak. The immediate problem may be simpler: can you establish which service handled the information, what safeguards applied and who can answer questions about its use?

Canada's privacy regulators say organizations developing, providing or using generative AI are obligated to ensure that their activities comply with applicable privacy laws. They also say personal information, especially sensitive or confidential information, should go into a prompt only where authorized. Professional bodies add their own expectations. The Law Society of Alberta's Generative AI Playbook lists this best practice for lawyers: "Never include confidential or potentially identifying information in prompts." The playbook focuses on publicly available tools, acknowledges that internal or proprietary AI platforms may address some concerns, and still urges extreme caution. This is guidance, not approval of any particular private AI product. The College of Physicians & Surgeons of Alberta says regulated members remain accountable for clinical decisions and patient records, and calls for completing or updating privacy impact assessments before AI tools are introduced into clinical practice.

Different organizations face different privacy requirements, professional expectations and client commitments. The practical first step is to check the rules and agreements that apply to your work, then decide which tools can handle each type of information.

What happens to the information depends on the tool

Public discussion often implies that anything typed into AI becomes public. That isn't accurate, and it leads to poor decisions. What happens depends on the product, the account and the settings:

• With a cloud AI service, the information runs on the provider's infrastructure.
• How long it's kept, and who can see it, varies widely. Google, for example, says a subset of chats in its personal Gemini app is reviewed by humans, and that reviewed chats can be kept for up to three years.
• Whether it trains future models often depends on settings for personal accounts. Google says it can use activity this way when Keep Activity is on, and Anthropic says it does so if the user allows it.

Business versions are often very different. Microsoft says Microsoft 365 Copilot prompts and responses aren't used to train foundation models. Google Workspace says it doesn't use customer data for training without permission or instruction. Anthropic says it doesn't train on commercial inputs or outputs by default, with exceptions such as feedback users choose to send.

So the useful question is more specific: which tool, on which account, with which settings, for which information? Shadow AI is the case where nobody in charge can answer it.

A ban alone may not be enough

Okta also reported why workers used unapproved tools. Among those users, across all countries surveyed, 80% said it was easier to use their own accounts, 57% said the approval process was too slow or difficult, and 49% said the approved tools didn't meet their needs. These are vendor-survey responses, not independently measured causes.

Those are practical reasons, and a ban doesn't remove any of them. We haven't found strong research comparing bans with other approaches, so this is our judgment rather than a finding: a rule works best when it comes with a better way to do the job. Without one, you may get less visibility rather than less use. The Canadian Centre for Cyber Security takes a similar direction, advising organizations to set policies on how AI is used, build in oversight and review, select vendors carefully, and "avoid providing PII or sensitive corporate data" in prompts.

Governance first, then choose where AI runs

Every option needs clear rules, staff training, approved use cases, an accountable owner and periodic review. Policy is how you govern whichever technology you choose.

Deployment	What it gives you	What it asks of you
Approved enterprise cloud AI	Capable tools, fast rollout, contractual protections and admin controls	Reliance on the provider's infrastructure, terms and connectivity, and careful review of its settings and integrations
Private AI on your own infrastructure	More direct control over where AI runs, what it connects to and how it changes	Hardware, security and operations, handled by your team or a partner
Hybrid	Sensitive work can stay private while approved cloud tools support other tasks	Clear rules on what goes where, and governance across both environments

For many organizations, a well-configured enterprise cloud service is a sound answer. With it, you rely on a provider's commitments, backed by a contract and settings. With private AI, you control the environment itself. Private AI tends to earn its place when one or more of these is true:

• The AI needs your most sensitive knowledge. Polishing an email is one thing. An assistant connected to client files, case histories or engineering records is another. The more it can reach, the more it matters who controls where it runs.
• Some information must stay within tighter boundaries. Client agreements or internal policies may restrict which outside providers can process particular records. Depending on the deployment, keeping AI processing on your own infrastructure can reduce the number of external parties involved.
• You need accountable records. When you run the environment, you can decide which models are approved, who can reach them and what is logged. Those records help explain activity inside approved systems. They can't by themselves reveal whether someone also used an unrelated personal AI account; that takes additional governance and monitoring.
• Your work happens where connectivity doesn't. Remote sites, vessels and restricted networks can't always reach a cloud service. Private AI can be designed to run on a local or air-gapped network.
• You want change on your own schedule. Models and terms evolve. On your own infrastructure, you decide when a new version goes live.

If none of these apply, a cloud service may well be your faster route. Private AI isn't automatically secure, compliant or permitted for every dataset: that depends on how it is configured, governed and operated. For a deeper comparison, see On-Premises AI vs Cloud AI.

What to do in the next four weeks

Week 1: Find out what's happening. Run a short anonymous survey asking which AI tools people use, and for what. Make it clear that nobody is in trouble. You're looking for demand as much as risk.

Week 2: Sort your information. Keep it to three levels your staff can remember:

Level	Examples	Where it can go
Public	Published material, public filings	Tools your policy allows
Internal	Procedures, general meeting notes	Approved business tools only
Confidential	Client files, personal information, financial records	Only tools specifically approved for that data after checking applicable obligations and agreements

Week 3: Give people a real option. Pick the approved tools for each level, including one good enough to replace the workaround. Publish a one-page rule, and create a way to request new tools that takes days rather than months.

Week 4: Assign ownership and test yourself. Name one person accountable for reviewing tools, settings and provider terms. Then write your reply to the client email at the top of this article. Wherever you hesitate, you've found your next piece of work.

Conclusion

Every unapproved AI tool is a request your team never filed: help me do this faster. That is useful information. It tells you where the work is hard and where people will adopt something better.

You don't need a perfect record of everything that has already happened. You need to reach the point where, when a client asks, you can answer in three sentences: here is what we use, here is where your information goes, and here is who is responsible.

At On Premises AI, we design private AI that runs on infrastructure you control. If you're working out what that answer should be for your organization, book a conversation with our team.

This article provides general information, not legal advice. Privacy and professional requirements depend on your circumstances and jurisdiction.

References

1. Statistics Canada. Use of generative artificial intelligence tools among Canadian workers, March 2026. The Daily, July 30, 2026.
2. Okta. AI Agents at Work 2026: Securing the agentic enterprise. May 27, 2026. Vendor-commissioned survey, fielded March 2026.
3. KPMG in Canada. Generative AI use surges in workplaces, posing risks to employers. November 28, 2024.
4. Office of the Privacy Commissioner of Canada, with provincial and territorial regulators. Principles for responsible, trustworthy and privacy-protective generative AI technologies. December 7, 2023.
5. Law Society of Alberta. The Generative AI Playbook. Last updated February 2026.
6. College of Physicians & Surgeons of Alberta. Updated Advice to the Profession: Artificial Intelligence in Clinical Practice. April 9, 2026.
7. Canadian Centre for Cyber Security. Generative artificial intelligence (ITSAP.00.041). December 2025.
8. Google. Gemini Apps Privacy Hub. Last updated October 26, 2026; Privacy Notice dated October 13, 2026.
9. Google. Generative AI in Google Workspace Privacy Hub. Last updated October 6, 2026.
10. Microsoft. Data, privacy, and security for Microsoft 365 Copilot. Accessed November 5, 2026.
11. Anthropic. Is my data used for model training? (consumer). March 16, 2026.
12. Anthropic. Is my data used for model training? (commercial). August 18, 2026.