TL;DR

British workers are collectively paying close to £1bn ($1.4bn) a year out of their own pockets for AI tools to do their jobs, according to Deloitte’s first GenAI Workforce Survey. Roughly one in six buys at least one tool personally, and 31% run generative AI without telling their employer. That is not an adoption statistic; it is a procurement and data-governance exposure.

What the survey found

Ipsos polled 25,000 workers for Deloitte. Two thirds had tried at least one assistant — Claude, Gemini and Copilot among them, alongside ChatGPT — and close to a quarter now reach for one daily. Staff are moving faster than the organisations employing them, buying access their employers have not authorised or funded.

Hayley McKelvey, who holds the chief AI officer post at Deloitte UK, put it plainly: workers “don’t want to wait for permission to use GenAI”, and many either use free tiers or fund premium versions themselves.

The reported time saving is 70 minutes a week on average. The work being saved is mostly lookup, email drafting and summarising, which Deloitte partner Paul Lee described as a relatively basic role for the technology, short of “supporting more complex work”.

Why the shadow figure is the problem

The 31% number should worry anyone responsible for UK data compliance. An employee pasting client material into a personal ChatGPT subscription has taken the organisation’s confidential information outside every control the organisation has: no retention terms, no audit trail, no data processing agreement, no answer if a regulator asks where it went.

That is exactly the failure mode the legal sector has been circling. UK firms have been told to treat AI vendor procurement as a regulatory decision rather than a commercial one, and conveyancers were recently found logging AI use as though each prompt needed consent. Personal subscriptions sit outside all of it.

Looking forward

The cheap reading is that staff are enterprising. The accurate one is that refusing to provide tools does not stop their use; it only moves it somewhere unlogged. Employers now face a straightforward choice between buying licences with contractual terms attached and continuing to receive the risk for free. Lee’s point stands: access alone is not a strategy, and guardrails are what separate the two.