ai risk today logo svg bl font
Menu
SUBSCRIBE
SUBSCRIBE
ai risk today logo svg bl font
Menu

Enterprise AI

Visualization of AI governance and browser activity illustrating violations of company AI policies.

48.3% Of U.S. Employees Admit To Breaking Company AI Policies

, , , , , , , , , , , ,

Nearly seven in 10 employees also reported pasting sensitive company data into AI tools, suggesting many organizations face an enforcement problem rather than an awareness problem.

Key Takeaways

  • 48.3% of U.S. employees knowingly breach their company’s AI policy.
  • 68.7% said they pasted internal, sensitive, or regulated data into AI tools in the last three months.
  • 70.9% use AI tools daily for work.
  • 42.3% reported using approved and unapproved AI tools side by side during the same browser session.
  • 49.3% said they would use an unapproved AI tool if their preferred tool was not authorized.

Neon Cyber’s report, Quantifying Shadow AI Risk in the Browser, suggests many organizations face a growing AI governance challenge that extends beyond policy development. The survey of 227 U.S. employees who use AI at work found that nearly half knowingly violate their employer’s AI policies despite understanding those rules.

The report argues that the problem is no longer whether organizations have AI policies. Instead, it suggests many organizations struggle to enforce them where employees actually use AI.

Policy is not changing behavior

Among respondents, 63.0% said their organization has a clear AI policy they understand. Of those employees, 48.3% admitted they knowingly breached that policy.

The report also found that 39.6% knowingly used unapproved AI tools, while another 15.0% said they might have. Nearly half (49.3%) said they would simply switch to another unauthorized AI tool if the one they wanted was not approved by their employer.

According to the report, employees often prioritize productivity over internal approval processes, particularly as AI tools become a routine part of daily work.

Sensitive company data continues flowing into AI

The survey found that 68.7% of respondents pasted or uploaded internal, sensitive, or regulated information into AI tools during the last three months, including financial information, customer data, and login credentials.

Shadow AI is becoming routine

More than 70% said they use AI tools daily, while 51.1% reported using them multiple times each day. Nearly two-thirds described AI as essential or very necessary to their jobs.

At the same time, 42.3% said they use both approved enterprise AI tools and unapproved AI services in the same browser session, using the same corporate data. The report argues that this makes it difficult for organizations to detect unauthorized AI activity using traditional security controls.

Browser habits also contributed to the risk. Nearly 70% reported using the same browser profile for both work and personal activities, while 63.0% said they mix personal and work accounts within the same browsing session.

Neon Cyber conducted the survey in May 2026 among 227 self-identified U.S. employees who use AI at work.

IBM report cover examining AI sovereignty, vendor lock-in, and governance risks for enterprise AI systems.

IBM Finds AI Sovereignty Gap Raising Governance Risks

, , , , , , , , ,

Only 9% of executives say they have an excellent understanding of their AI dependencies as organizations face growing vendor lock-in and operational resilience challenges.

 

Key Takeaways

  •         Only 9% of executives say they have an excellent understanding of their AI dependencies.
  •         71% say switching their primary AI vendor or model would be difficult today.
  •         72% would accept a 20% cost increase to maintain multiple AI vendors for strategic flexibility.
  •         81% say a seven-day outage at a primary AI vendor would have a severe or critical impact on operations.
  •         Organizations with stronger control across data, models, and infrastructure protect 55% more operating profit from AI-driven disruption.

 

The IBM Institute for Business Value released a new report examining how organizations are managing AI sovereignty as AI becomes increasingly embedded in business operations.

Based on a survey of 1,000 senior executives, the report found that many organizations are expanding AI adoption while struggling to maintain visibility into the vendors, models, infrastructure, and data dependencies that support those systems.

The findings suggest AI sovereignty is emerging as a governance issue as organizations seek greater control over the technologies driving operational decisions.

Organizations lack visibility into AI dependencies

Only 9% of executives said they have an excellent understanding of their dependencies on AI vendors, models, and infrastructure.

At the same time, 71% said switching their primary AI vendor or model would be difficult if required today. IBM said the findings highlight the growing challenge of maintaining flexibility as organizations become increasingly reliant on AI services and providers.

The report defines AI sovereignty as an organization’s ability to move data, swap models, and shift workloads across environments when technical, commercial, or regulatory conditions change.

These dependencies have become more complex over the past two years, with executives reporting unexpected price increases, usage restrictions, service deprecations, changes to data-handling practices, and geographic access limitations.

Vendor concentration creates resilience concerns

The study found that 81% of executives believe a seven-day outage affecting a primary AI vendor would have a severe impact on business operations.

In addition, 75% of executives who switched or attempted to switch AI vendors over the past two years said the process was difficult due to data portability issues, model revalidation requirements, compliance obligations, and being tied to a specific vendor’s technology.

Despite those challenges, many organizations are willing to invest in flexibility. The report found that 72% of executives would pay 20% more to maintain multiple AI vendors if doing so improved strategic freedom and reduced dependence on a single provider.

IBM noted that 28% of organizations already use four or more AI vendors as part of a strategy to maximize flexibility and avoid lock-in.

Governance and control linked to business outcomes

The report found that organizations with the strongest control across data, models, infrastructure, and applications protect 55% more operating profit from AI-driven disruption than organizations with less control.

The report also found that 57% of executives said replacing a core AI model would require significant decoupling or even a complete system rebuild. In comparison, 56% said moving core AI systems and applications to a different vendor would take at least six months.

As AI systems become more deeply embedded in business operations, IBM said organizations are increasingly evaluating how much control they maintain over the data, models, and infrastructure that support those capabilities.