Enterprise AI controls cover less than a fifth of actual AI use. That is the finding from CultureAI's analysis of nearly 1.7 million AI interactions across 40 organisations over six months, published today.
The research, titled The 81%, found that only 19% of workplace AI activity ran through enterprise accounts. The remaining 81% came from personal paid accounts (25%), free or unauthenticated access (22%), or applications where no enterprise licence could be identified (34%). Data processing terms, retention limits, training opt-outs and offboarding apply to less than a fifth of what employees actually do with AI.
CultureAI observed 1,064 distinct AI applications across the 40 organisations, with around 113 in active use in the average organisation. Despite that breadth, 93% of prompt activity went to five tools: ChatGPT alone accounted for 55%, followed by Google Translate, Claude, Microsoft Copilot and Google AI Search.
Blocking AI tools did not reduce their use. Where organisations restricted AI applications, personal account use rose by around 50%. The demand persisted; blocking moved it out of visibility.
Sensitive data exposure was recorded 252,480 times across 100 data types, roughly once in every seven prompts. Around 40% of detections were rated medium or high risk. HR records were disclosed in 90% of organisations, company strategy in 85%, health and medical data in 82%, and financial information in 72%. Credentials, the risk category most organisations focus on, made up under 1% of all detections.
The compliance implications extend beyond GDPR. From December 2027, high-risk AI systems used in recruitment and employment decisions face EU AI Act requirements including human oversight and record-keeping. The research follows a case this year in which a solicitor triggered a data breach by submitting client documents to ChatGPT, prompting regulatory disclosure.
To stay across the latest in cloud, AI and enterprise tech analysis from Compare the Cloud, subscribe to our weekly newsletter at https://www.comparethecloud.net/newsletter
