Don't Ask, Don't Tell: How American Workers Really Use AI on the Job

Cover Memo

This report draws on the AI@Work survey (CHIP50 Wave 38.6), a survey of 23,462 U.S. adults (weighted n = 23,485) fielded June 21–July 13, 2026 to boost statistical power on artificial-intelligence questions. Percentages in this report are weighted to U.S. Census population targets and are population-representative; unweighted respondent counts are reported alongside each figure as a reliability guide only.

These are interim estimates. The AI@Work survey launched June 21, 2026 and data collection is ongoing; the figures in this report reflect responses received through July 13, 2026 and will be revised in a later release.

The findings below concern workers who use AI for their jobs and, for the closing section, business owners. The core "shadow AI" battery (disclosure, perceived approval, data entry) was asked only of employed respondents who report using AI for work at all — an analytic base of roughly 6,900–6,930 respondents depending on the item. Workplace-context items (whether the employer has an AI policy; whether AI is used in the workplace; how aware the employer is of employee AI use) were asked of a wider employed sample of roughly 8,800–10,980. The owner-side items — whether AI is relevant to the business, how much it uses AI, and whether the owner suspects unsanctioned employee use — were asked of respondents who own a business (roughly 750–1,240, a smaller base treated with corresponding caution). Each figure and table below states its own base.

A methodological note on measurement direction: two items in this supplement are coded in reverse of their on-screen display order — the perceived-approval item (ai_shadow_norm) and the job-importance item (ai_importance). Both directions were verified against the questionnaire and against the data before analysis. See Methods.

Key Takeaways

Introduction

Artificial intelligence has arrived in American workplaces faster than the norms and rules meant to govern it. Within a couple of years, chatbots like ChatGPT, Gemini, Copilot, and Claude have gone from novelty to daily tool for a large share of the workforce — but the organizational scaffolding around them, from disclosure expectations to formal policies to data-handling rules, has not kept pace. The result is a distinctive pattern that security researchers have begun to call "shadow AI": widespread, semi-visible use that sits outside official oversight.

Industry surveys have flagged the phenomenon. A 2024 UpGuard survey of 1,500 workers across seven countries found that more than 80% use unapproved AI tools and that 70% were aware of colleagues sharing sensitive data with them (UpGuard, via Cybersecurity Dive). A January 2025 study of 1,000 U.S. employees at large enterprises found that 57% had entered sensitive company data into public AI assistants and that only 29% said their organization had clear AI guidelines (TELUS Digital, via Tech Monitor). These studies, however, typically draw on convenience or enterprise-only samples.

The AI@Work survey offers a large, population-representative complement: a general-population measurement of how American workers actually use AI on the job — whether they tell anyone, whether their workplace has rules, and what kinds of information they put into these tools. The picture that emerges is not one of rebellious employees hiding AI from hostile bosses. It is one of a technology that has become unremarkable to its users while remaining almost entirely ungoverned by their employers.

Most workers don't mention it — and don't think they have to

AI use at work is only loosely disclosed — but it isn't being hidden.

Among workers who use AI for their jobs, fewer than three in ten (29%) say they tell their supervisor every time they use it. Another 20% disclose only for big tasks and 16% only for small ones, while 21% "usually do not mention it unless asked" and 10% "never" disclose their AI use. Put simply, about a third of AI-using workers routinely keep it to themselves.

Yet this quiet is not secrecy. Asked whether their employer would approve of how they use AI, 70% say their employer would approve (40% strongly), 24% are neutral, and just 6% think their employer would disapprove. And 84% believe their employer already knows, definitely or probably, how they use AI. The workers who under-disclose are, overwhelmingly, not the workers who fear being caught.

Their own stated reasons confirm it. Among those who do not always tell a supervisor, the most common explanations are that "AI is just a tool like a calculator" (37%), that "my boss only cares about the end result" (38%), and that "there is no policy about disclosing AI use" (38%). Fear-based and reputational reasons trail well behind: 12% worry they would "get in trouble," 12% don't want to "seem lazy or less hardworking," and 8% don't want to "draw attention to a tool that might replace" them. AI has become, for most of its workplace users, an ordinary implement not worth flagging — closer to spellcheck than to a secret.

Comparative Context

The survey's disclosure pattern echoes enterprise-focused findings that shadow AI is the norm rather than the exception: UpGuard reported that a majority of workers use unapproved tools and that regular use is highest among managers and executives, not the rank and file (Cybersecurity Dive).

A governance vacuum

Most workers using AI have no clear rules to follow.

Only 27% of workers say their employer has a formal AI policy and that they are clear on what it allows; 12% say a policy exists but they are unclear on the rules; 44% say there is no formal policy at all; and 17% do not know. Nearly three-quarters (73%), in other words, are operating without clear guidance. The same vacuum appears when workers are asked which tools they may use: 38% say there is no policy on the question, 18% may use any tool, 20% are restricted to approved tools, 7% are told they may use none, and 17% don't know.

This is the structural counterpart to the disclosure pattern above. When there is no policy requiring disclosure, "there's no policy about disclosing" becomes a leading reason not to disclose — and indeed the two move together. Non-disclosure is far more common where rules are absent: 46% of workers with no formal policy usually or never mention their AI use, versus just 18% of workers who have a clear policy (Figure 4). Whether clear rules cause more disclosure or simply travel with workplaces that have a culture of openness, the association is strong and consistent.

Comparative Context

The independent TELUS Digital enterprise survey found nearly identical policy numbers — only 29% of employees reported clear AI guidelines and 44% were unsure whether any policy existed — lending external validity to the survey's estimate that roughly a quarter of workers have clear rules (Tech Monitor).

Sensitive data is flowing in

A majority of AI-using workers have put confidential information into AI tools.

Asked whether they had ever entered specific kinds of information into AI tools for work, 36% of AI-using workers said financial data such as internal budgets or sales figures, 30% said internal emails or meeting transcripts, 26% said proprietary code or internal documents, and 25% said client or customer details. Only 38% selected "none of the above" — meaning 62% have entered at least one category of sensitive work information into an AI tool.

The relationship between this exposure and workplace rules is counterintuitive and important. Sensitive-data entry is higher, not lower, where a policy exists: 74% among workers with a clear policy and 82% among those with a policy they find unclear, versus 49% where there is no formal policy. The reason is that having a policy is largely a marker of how deeply AI is embedded in a workplace — where AI is central to the work, people use it more and feed it more. The uncomfortable implication is that formal policies, as they currently exist, are not preventing sensitive data from going into AI tools. Even among workers restricted to "only approved tools," 70% have entered sensitive data; in the small group told they may use no AI tools at all, 83% have done so anyway.

Comparative Context

The 62% figure sits just above the 57% of enterprise employees who admitted entering sensitive data into public AI assistants in the January 2025 TELUS Digital study, and the survey's ranking of data types (financial, internal communications, code, client data) broadly tracks that study's mix of project, customer, and financial information (Tech Monitor).

Who is most exposed

The workers feeding the most sensitive data into AI are the youngest, the heaviest users, and — even after accounting for how much they use AI — men and Republicans.

Two different demographic stories run underneath the aggregate numbers, and they point in opposite directions.

Non-disclosure is remarkably evenly spread. In a weighted logistic regression predicting whether a worker usually or never discloses AI use, demographics explain very little (McFadden pseudo-R² = 0.02) — the behavior is close to universal rather than concentrated in any group. What variation exists runs counter to the intuition that young people are the furtive ones: older AI-using workers are the most likely to keep quiet, with the odds of non-disclosure rising steadily from workers in their 30s up through those in their 60s and 70s. Political independents are somewhat more likely than Republicans to under-disclose, and women slightly more likely than men, but these are modest gaps.

Sensitive-data entry, by contrast, is strongly structured (pseudo-R² = 0.06, rising to 0.12 once intensity of AI use is included). It falls sharply with age: 72% of workers aged 21–30 have entered sensitive data, versus 50% of those in their 50s and 41% of those aged 61–70. Men are far more likely than women to do so (67% versus 54%; odds roughly 1.6 times higher net of other factors), and urban and suburban workers more than rural ones. The single largest driver is simply how much someone uses AI at work — but notably, a partisan gap persists even after that is accounted for: Republican workers remain the most likely to enter sensitive data (69%, versus 63% of Democrats and 53% of independents), and this difference does not wash out when use intensity is controlled. This is not a simple left-right split — pure independents, not Democrats, sit lowest — and is better read on the full 7-point party scale as a strong-partisan/engagement pattern than as a Republican-vs-Democrat difference: the companion party7 audit finds the peak among strong Republicans, tracking AI-use intensity rather than ideology, with the pure-independent trough marking disengagement. The mechanism is unclear — it may reflect occupation or differing attitudes toward data — and warrants further study rather than over-interpretation.

Comparative Context

That regular, intensive AI use — and the exposure that comes with it — concentrates among more senior and technical workers rather than the youngest entry-level staff is consistent with UpGuard's finding that executives show the highest rates of regular shadow-AI use (Cybersecurity Dive); the survey data add that raw exposure is nonetheless greatest among younger and male workers, who use these tools most heavily.

The view from the other side of the desk

Workers think the boss knows; most bosses suspect there's more going on than they can see. Both are right.

So far this report has been told from the worker's seat. The supplement also asked employers, and the two vantage points frame the same phenomenon from opposite sides. From the employee side, the perception is of a workplace that is broadly aware: 70% of workers say their employer is at least somewhat aware of whether and how employees use AI (35% "very aware"), against 30% who say not very or not at all. That awareness is not evenly distributed — it tracks governance closely. Where a worker's employer has a clear AI policy, the weighted mean on the awareness scale is 3.39 (near "somewhat-to-very aware"); where there is no formal policy, it falls to 2.66. Awareness and formal rules travel together, reinforcing the report's central link between governance and visibility.

The owners tell a more anxious story. Among business owners whose companies use AI at all (an analytic base of roughly 750, so read as indicative rather than precise), 67% suspect their employees are using AI without their knowledge — 31% think this happens "frequently" and 37% "occasionally." Only a quarter (25%) are confident their employees do not use AI behind their backs, and just 8% think their employees don't use AI at all. These are not disengaged owners: 60% say AI is relevant to their business, and among those, 88% report their business already uses it at least somewhat (38% "a lot"). They are, in other words, owners who use AI themselves and nonetheless assume there is a layer of employee use they cannot see.

The two readings are less contradictory than they first appear, and that is the point. A worker can reasonably believe the boss knows about their own AI use — 84% do (Figure 3) — while an owner can just as reasonably assume that, across the whole workforce, some use is escaping notice. Individual use is semi-visible; its full extent across an organization is not. The shadow in "shadow AI" is not a single hidden act but the aggregate blur that forms when a technology diffuses faster than any manager can track — and, tellingly, the people running these businesses already sense it.

Comparative Context

This owner-side anxiety mirrors the enterprise-security literature that named shadow AI in the first place: UpGuard found that a majority of workers use unapproved tools and that 70% were aware of colleagues sharing sensitive data with AI — the same sense, from inside organizations, that AI use is running ahead of oversight (Cybersecurity Dive).

Conclusion

The dominant story of AI in the American workplace is not one of employees sneaking a forbidden tool past wary managers. It is one of a technology that has become ordinary to the people using it while remaining almost invisible to the institutions around them. Most workers who use AI think their employers know and would approve; most simply don't consider it worth mentioning, in part because no rule tells them to. That casual normalization would be unremarkable were it not paired with two facts: nearly three-quarters of these workers have no clear policy governing their AI use, and a clear majority have already entered confidential information — financial data, client details, proprietary code, internal communications — into tools their employers may neither sanction nor see.

The most actionable finding is that policies as they currently exist are not closing this gap. Where formal AI policies are in place, sensitive-data entry is if anything higher, because those are the workplaces where AI is most embedded. Clear policies do appear to raise disclosure, which may make AI use more visible to management — but visibility alone is not protection. As AI use continues to deepen, the workers most exposed will remain the heaviest users: younger, more male, and more technical. And the gap is not lost on the people in charge: two-thirds of business owners already suspect their employees are using AI out of view. That mutual awareness — workers who think the boss knows, owners who suspect they don't know the half of it — is the clearest sign that the problem is not secrecy but the absence of any shared, visible way to govern a tool everyone is already using. Closing the distance between how workers use AI and how employers govern it will require more than a document in a handbook.

Appendix A — Methods

Data source. AI@Work survey — CHIP50 Wave 38.6 (Civic Health and Institutions Project / COVID States Project). Total unweighted n = 23,462; weighted n = 23,485. The supplement was fielded June 21–July 13, 2026 to increase statistical power on AI questions and to oversample students and adults aged 18–22; it is nonetheless a broad adult sample (about 60% of respondents last attended school more than ten years ago). Data collection was ongoing at the time of this extract — figures reflect responses through July 13, 2026 and are preliminary.

Universe and bases. The workplace-AI ("shadow AI") battery — disclosure frequency, reasons for non-disclosure, perceived approval, whether the employer knows, data entered into AI, who benefits, and job importance — was asked only of employed respondents who report using AI for work at all (ai_work ≥ 2), an analytic base of roughly 6,900–6,930 depending on item and skip logic. The reasons-for-non-disclosure item was asked only of those who did not answer "every time" (n ≈ 4,906). Employer-policy and workplace-penetration items were asked of a broader employed base (n ≈ 10,960–10,980), as was the employer-awareness item (employer_aware; n ≈ 8,824). The owner-side items were asked of respondents who own a business: whether AI is relevant to the business (bus_own_ai; n ≈ 1,241) and — among those whose business uses AI — how much it uses AI (bus_own_ai2; n ≈ 746) and whether the owner suspects unsanctioned employee use (bus_own_know; n ≈ 747). The owner bases are an order of magnitude smaller than the worker bases and are reported as indicative; owner figures are not broken out demographically. Each figure and table states its own base.

Weighting. All percentages, means, and modeled estimates are weighted to U.S. Census population targets and are population-representative. Unweighted counts are reported only as a reliability guide and are never used to compute percentages.

Measures and coding. Question wording is reproduced verbatim in Appendix C. Two items are coded in reverse of their on-screen display order, verified against the questionnaire and confirmed empirically: perceived employer approval (ai_shadow_norm; 5 = strongly approve … 1 = strongly disapprove — confirmed because workers who disclose "every time" score highest on it) and job importance (ai_importance; 5 = extremely important … 1 = not important, with a separate 0 = "I do not use AI at work"). These items were mapped from the authoritative AI@Work survey codebook: employer_aware (4 = very aware … 1 = not aware at all, 0 = not sure) — direction confirmed in-data, its weighted mean rising monotonically with employer AI-policy clarity (3.39 where a clear policy exists vs. 2.66 where none does); and the owner items bus_own_ai (1 = yes AI is relevant, 2 = no), bus_own_ai2 (4 = a lot … 1 = not at all, 0 = not sure — its direction corroborated by the bus_own_ai gate, since owners for whom AI is relevant cluster at "some/a lot"), and bus_own_know (1 = yes frequently, 2 = yes occasionally, 3 = no not without my knowledge, 4 = no they don't use AI — a labeled nominal set, reported categorically). Two binary indicators were derived: non-disclosure (usually does not mention AI unless asked, or never discloses) and entered sensitive data (selected at least one of the four sensitive-data categories rather than "none of the above").

Estimation. Cross-tabulations are weighted shares. Two weighted logistic regressions (survey-weighted GLM, logit link) model non-disclosure and sensitive-data entry on party (3-category), age, gender, education, income, community type, and remote-work arrangement; a third adds AI-use intensity (ai_work) to the sensitive-data model. Standard errors are model-based, not design-based, and should be interpreted accordingly. A difference is described as independent or surviving controls only where the corresponding coefficient is significant at p <.05; raw crosstab gaps are described as descriptive. Cells with unweighted n < 10 are suppressed or flagged (e.g., workers aged 80+, unweighted n = 15).

Reproducibility. Every figure in the text maps to a table in Appendix B; every table value is copied verbatim from the underlying tabulations. Item wording is sourced from the Qualtrics instrument via the project's AI@Work survey crosswalk and verified-updates companion.

Appendix B — Data tables

Adding AI-use intensity (ai_work) to the sensitive-data model (n = 6,904): intensity OR = 1.41 per step (p <.001), pseudo-R² = 0.12; Democrat OR = 0.83, Independent OR = 0.58 — the partisan gap persists.

At least somewhat aware (very + somewhat) = 70.3%. Weighted mean by employer AI-policy status (1 = not aware … 4 = very aware): clear policy 3.39, unclear 2.86, no formal policy 2.66, don't know 2.64 — confirming the coding direction.

Suspect unsanctioned use (frequently + occasionally) = 67.3%.

Appendix C — Question wording (verbatim)

Wording is consequential for this report because interpretation depends on the exact phrasing and response scales; full wording is therefore included.

• ai_work — "How often do you use AI for your work?" (Never; I tried once or twice; About once a month; About once a week; Multiple times a week; Once or twice a day; Several times a day)
• ai_shadow_reveal — "When you use AI tools to help with work tasks, how often do you let your supervisor or manager know?" (I disclose my AI use every time; I tell them for big tasks, but not small ones; I tell them for small tasks, but not big ones; I usually do not mention it unless asked; I never disclose my AI use; Other)
• ai_shadow_why (select all) — "Why don't you always tell your supervisor when you use AI?" (AI is just a tool like a calculator, no need to mention it; My boss only cares about the end result; There is no policy about disclosing AI use; I am worried I would get in trouble; The tasks are too small to mention; It is none of their business how I get my work done; I do not want to seem lazy or less hardworking; I do not want to draw attention to using a tool that might replace me; Other)
• ai_shadow_norm — "Would your employer approve or disapprove of the ways that you use AI for work?" (Strongly approve … Strongly disapprove; coded 5 = strongly approve … 1 = strongly disapprove)
• ai_shadow_know — "Does your employer know how you use AI for work?" (Definitely yes; Probably yes; Probably no; Definitely no)
• ai_policy — "To the best of your knowledge, does your employer have a formal policy or set of guidelines regarding the use of AI tools (like ChatGPT, Copilot, etc.) for work purposes?" (Yes, and I am clear on what is allowed vs. prohibited; Yes, but I am unclear on the specific rules; No, there is no formal policy; I don't know)
• ai_which — "Does your employer specify the AI tools that you can use?" (Any AI tool; Only specific, approved AI tools; Not allowed to use any AI tool; No policy or guidance about which AI tools to use; I don't know)
• ai_data_risk (select all) — "When using AI tools for work, have you ever entered into them…" (Names or details of clients/customers; Financial data (internal budgets, sales figures etc.); Proprietary code or internal documents; Internal emails or meeting transcripts; None of the above)
• ai_prod_benefit — "When AI makes workers more productive in your workplace, who do you think benefits the most?" (Mostly workers; Mostly employers; About equally; Not sure)
• employer_aware (employed base) — "How aware is your employer of whether and how employees use AI?" (Very aware; Somewhat aware; Not very aware; Not aware at all; Not sure)
• bus_own_ai (business owners) — "Is AI relevant to your business?" (Yes; No)
• bus_own_ai2 (business owners whose business uses AI) — "How much does your business use AI?" (A lot; Some; Not so much; Not at all; Not sure)
• bus_own_know (business owners whose business uses AI) — "Do you suspect that your employees use AI without your knowledge?" (Yes, frequently; Yes, occasionally; No, they don't use AI without my knowledge; No, I don't think they use AI at all)