Why do employees use unapproved AI tools instead of the Copilot we already pay for?

Table of Contents

The Direct Answer

Because the approved tool loses the moment-of-need contest. Employees reach for whatever is fastest and most familiar when a task is in front of them, and Copilot usually is neither. Surveys put unapproved AI use at 66% of office professionals. Closing that gap takes in-context enablement, not another policy email.

Deeper Explanation

Shadow AI is not a discipline problem; it is an adoption problem wearing a security costume. The scale is now well documented: PagerDuty’s 2026 survey of 1,250 office professionals at large enterprises found 66% had used unauthorized AI tools at work, and 88% had pasted work information into a public model — emails, meeting notes, customer data, financial documents. Those employees are not trying to leak anything. They have a task, a deadline, and a tool they already know how to prompt. The sanctioned option sits one tab away and loses on habit alone.

The second force is that a license is not an onramp. Recon Analytics found that when workers can choose between Copilot and ChatGPT, only 18% pick Copilot while 76% pick ChatGPT — but when Copilot is the only option available, adoption jumps to 68%. Choice is not the villain there; unaided choice is. Nobody showed the user what Copilot does well inside the document they were already editing, so the comparison never happened on fair terms. Meanwhile UpGuard’s shadow AI research found fewer than half of employees understand their company’s AI usage policy, and that the people who best understand AI security requirements are among the most frequent users of unapproved tools. Awareness campaigns are not the missing ingredient.

What is missing is help at the point of work. If the guidance for “summarize this thread in Copilot” arrives as a slide in a rollout deck, it is gone by the time the thread appears. If it arrives as an in-app prompt on the screen where the task is happening, the approved tool gets its fair shot at the habit. That is the whole premise of a digital adoption platform — walkthroughs, tips and nudges delivered inside the application rather than filed in a portal — and it is why IT leaders end up owning this problem: they are the ones holding both the unused licenses and the data-exposure risk.

There is also a visibility problem underneath the behavior problem. IT usually learns about shadow AI from an incident, a procurement surprise, or a survey — never from the moment it starts. Copilot’s own admin reporting tells you who has a seat and who opened the app; it cannot tell you that a user tried Copilot on a proposal, got an answer they did not trust, and finished the task in a public chatbot instead. That abandonment moment is the entire decision point, and most organizations have no instrumentation on it. Without it, enablement effort gets spread evenly across everything instead of aimed at the three or four tasks where the approved tool is actually losing. Seeing where users hesitate, retry, or drop out of a workflow is what turns “our people use ChatGPT” into a specific, fixable list.

The Research

Strategy and Actionable Steps

  • Find out what is actually being used before you legislate. Inventory the AI tools in play through network and browser telemetry rather than a survey. You cannot design a replacement path for behavior you have only guessed at.
  • Identify the top five tasks driving the workaround. Shadow AI clusters around a handful of jobs — drafting, summarizing, rewriting, data lookup. Those five tasks are your enablement backlog.
  • Put the guidance where the task happens. Deliver the Copilot prompt for each of those tasks as an in-app tip or walkthrough on the screen where users do the work, so the approved tool is the path of least resistance instead of the path of most steps.
  • Make the policy answer a question rather than issue a warning. A one-line, in-context “here is what you can and can’t paste” at the moment of use outperforms an annual acknowledgment nobody remembers.
  • Run coached practice, not a launch event. Habits form through repetition on real work. A structured program like Copilot Catalyst — weekly hands-on activation sessions built around real workflows, plus async coaching and governance content across a 30-, 60-, or 90-day window — exists precisely because a single training session does not move usage.
  • Give the workaround a sanctioned exit ramp. When the approved tool genuinely cannot do a job, tell people where to take it — an approved enterprise account, a request queue, a named owner. A policy with no escape valve guarantees quiet non-compliance.
  • Recruit the heaviest shadow users as champions. The people already fluent in public AI are your fastest converts and most credible advocates; enlisting them beats disciplining them, and they will tell you exactly where the sanctioned tool falls short.
  • Measure substitution, not satisfaction. Track Copilot usage on the five target tasks alongside unapproved-tool traffic. The number that matters is the crossover, and it tells you which tasks still need work.

FAQ

Is shadow AI mainly a security problem or an adoption problem?

Both, and the order matters. The exposure is real — a third of surveyed employees have put confidential documents or financial data into public models. But the cause is adoption: people use the unsanctioned tool because it is faster at the moment of need. Blocking without providing a better path just pushes usage onto personal devices where nobody can see it.

Will blocking public AI tools solve it?

Partially, and at a cost. Blocking raises the friction of the workaround but does not lower the friction of the approved tool, so it converts visible usage into invisible usage. PagerDuty’s data also shows 77% of employees believe AI restrictions limit their professional growth — a retention risk worth weighing. Blocking works when it is paired with a genuinely usable sanctioned alternative.

Why does Copilot lose when employees have a choice?

Mostly familiarity and perceived output quality. Users arrive already fluent in a consumer chatbot from personal use, and they have never been shown what Copilot does with the tenant data it can see. The gap closes when users experience Copilot on their own real work rather than in a demo.

How do we know which unapproved tools are being used?

Network egress logs, cloud access security broker reports, browser extension inventories, and expense reports for individual subscriptions. Combine them — no single source catches everything, and personal-device usage stays invisible to all of them, which is another reason enablement beats enforcement.

Does more training fix this?

Not in its usual form. Scheduled training is separated in time from the moment the task appears, so most of it decays before it is needed. What changes behavior is guidance delivered in the application at the moment of use, reinforced by repeated practice on real work.

What should an AI usage policy actually say?

In plain terms: which tools are approved, what categories of data may never leave the tenant, and where to go when the approved tool cannot do the job. Then surface those rules in context rather than in a document. Under half of employees understand their current policy, which suggests the problem is delivery, not wording.

How long does it take to shift usage to the sanctioned tool?

Plan in weeks, not days. Programs that move the needle run 30 to 90 days because habit replacement requires repeated hands-on use across several real workflows. Expect early movement on high-frequency tasks like drafting and summarizing, and slower change on specialized ones.

What does success look like?

Rising Copilot usage on the specific tasks that previously drove workarounds, falling traffic to unapproved tools, and fewer confidential documents leaving the tenant. Seats assigned and training completed are inputs; task-level substitution is the outcome.

Table of Contents