UK workers spent nearly £1bn on GenAI. Shadow AI is now an ops problem.

Author: StJohn Krog — LinkedIn

In mid-September 2026, Deloitte UK published the country’s largest workplace GenAI survey to date: 25,000 workers, fielded May–June 2026. British workers are spending an estimated £958 million a year of their own money on generative AI tools they use for work.

That is not a curiosity. It is a signal that adoption has already happened — often outside the tools your board approved, your IT team can see, or your data-protection notice describes.

For ambitious UK SMEs and scale-ups, the useful question is no longer “Should we allow ChatGPT?” It is: how do we meet demand without letting shadow AI become the default operating system?

What the Deloitte numbers actually say

A few figures from the Deloitte UK GenAI Workforce Survey matter more than the billion-pound round-up:

63% of UK working adults aged 18–70 say they knowingly use GenAI for work.
31% of GenAI users say they use it without their employer’s knowledge — classic shadow AI.
24% of UK workers use GenAI tools every day for work.
17% of GenAI users pay for at least one tool themselves for work.
Nearly half (46%) of users lean on free tools at work; only 34% say they use external tools paid for by the employer.
Users report saving about 70 minutes a week on average — mostly redirected into more work for the same employer.
Around half of GenAI users say they have received no formal training on safe, effective workplace use.
65% of GenAI users report a lack of convincing leadership on how GenAI should be used.

Hayley McKelvey, Deloitte UK’s chief AI officer, put the commercial problem cleanly: workers will not wait for permission. The challenge is meeting demand in a way that is secure, responsible and valuable — for the firm and for the people using the tools.

Why this hits growing businesses harder than enterprises

Enterprise IT can pretend to “block and educate.” Growing firms rarely can. Your team already lives in Microsoft 365, Google Workspace, Shopify, HubSpot, Xero and a dozen browser tabs. Free GenAI sits one click away from every customer email and every spreadsheet export.

Shadow AI creates three practical risks:

Data leakage — customer PII, supplier pricing, unpublished roadmaps and contract terms pasted into consumer chat tools with training-by-default settings you do not control.
Inconsistent customer truth — one adviser drafts a refund reply from ChatGPT; another uses Gemini; neither cites your published policy. Under UK consumer law, you own the outcome either way.
False productivity — time saved on drafting that creates rework or compliance misses does not show up as profit. DSIT’s AI Adoption Research found 75% of AI-using firms report workforce productivity gains, while 77% report no change in revenue. Tools without redesigned work feel busy and leave the P&L cold.

Stigma makes it worse. Deloitte found 23% of workers think there is stigma attached to using GenAI at work, and 64% of weekly users worry managers will think GenAI can do their jobs. People who feel judged hide usage. Hidden usage is the opposite of governance.

What “good” looks like (without a 40-page AI policy)

You do not need an AI centre of excellence. You need a light control layer that makes the sanctioned path easier than the shadow path.

1. Name the approved stack (one page)

Pick tools that match where work already happens:

Microsoft-native teams → Copilot for in-app drafting and summarising.
Google Workspace teams → Gemini in the apps people already open.
Cross-stack reasoning → a paid Team/Business tier with admin controls and a clear “no training on our data” posture.
Workflow automation → Power Automate, Make or similar for repeatable flows — not free consumer chat for production customer replies.

Write the list. Share it. Update it quarterly. Ambiguity drives personal subscriptions.

2. Draw a hard data line

In plain English, ban pasting into consumer tools: customer PII, order and payment details, HR notes, unpublished pricing, contracts, and anything you would not put on a public website. Provide a sanctioned place for work that needs context — with logging, retention controls and a named owner.

3. Train for the jobs people already do

Deloitte’s top use cases are searching for information (43%), drafting emails (43%) and creating summaries (31%). Meet people there. A 60-minute workshop on “how we draft customer emails with AI here” beats a generic awareness deck. Cover when to use AI, how to check facts against systems of record, how to escalate refunds and complaints, and what “good” tone looks like.

4. Redesign one workflow, not every role

If AI only accelerates individual tasks, DSIT’s productivity-without-revenue pattern is predictable. Pick one shared process — enquiry triage, quote assembly, support first-response, weekly ops pack — and embed the approved tool with a baseline metric. Measure cycle time, rework, customer wait and staff trust. Expand only when those move.

5. Make leadership visible

Deloitte’s finding that 65% of users lack convincing leadership on GenAI is an ops failure, not a culture slogan. A short note from the MD — why we use AI, which tools are approved, what success looks like — does more than another software licence.

A 30-day shadow-AI clean-up for UK SMEs

Week 1 — Discover (without witch-hunts)

Anonymous pulse: which tools do people use, for what, with which data? Promise no punishment for honest answers this month.

Week 2 — Decide

Approve 1–2 tools. Publish the data line. Name an owner (ops lead or MD is fine under 50 people).

Week 3 — Enable

Provision seats. Run one workflow workshop. Turn on admin settings that matter (retention, sharing, logging).

Week 4 — Embed

Move one high-volume process onto the sanctioned path. Sample outputs weekly. Kill the free-tool habit for that process first.

By day 30 you should have less secret spend, fewer unmanaged prompts with customer data, and one measurable workflow — not a glossy “AI strategy” document.

Practical takeaway

Shadow AI is not proof your people are reckless. It is proof demand outran enablement. Deloitte’s £958m figure is what happens when individuals buy capability the organisation refused to provide. Close the gap with approved tools, clear data boundaries, short training tied to real jobs, and one redesigned workflow. That is how UK growing firms turn GenAI from a private expense into a shared operating advantage.

Clarity Growth works with UK businesses that want AI and automation to show up in operations — not only in personal browser tabs. We help teams choose a proportionate approved stack, connect it to systems of record, and put light governance around customer-facing work so productivity gains can become commercial ones. If shadow AI is already in your company, the next step is a measured enablement plan, not a blanket ban.

Hero — “Shadow vs sanctioned”

Two laptops on a shared desk: one shows a generic consumer chat window (blurred), the other a tidy ops dashboard / approved workspace. Bright UK SME office, natural light, no neon “AI brain” clichés.

Search: Unsplash/Pexels — “two people laptops office collaboration”, “small business desk dual monitors”.

Credit: Unsplash / Pexels photographer + alt: “Colleagues reviewing work on two laptops in a bright UK office.”

Why this matters for Clarity Growth

Sources

Start with the friction. Build the capability.

Clarity Growth helps organisations identify, design and implement practical automation opportunities across existing systems and workflows.

Discuss an automation opportunity