A bid coordinator in Bristol has a routine she has never mentioned in a meeting. Before writing a tender response, she pastes the buyer’s questions into a chat window. Then a stripped-down version of the last winning bid. Then a list of the answers her firm keeps losing marks on. She has refined the sequence over eight months. It turns a three-hour job into forty minutes, and the win rate has moved. Her employer does not know the routine exists, which is roughly where much of Britain’s enterprise AI workforce currently sits. The scene is illustrative. Researchers have now documented the behaviour behind it.
In June 2026, PagerDuty published survey work conducted by Wakefield Research. The researchers questioned 1,250 office professionals in non-technical roles, at companies with annual revenues above $500 million, across the United States, the United Kingdom, Australia and Japan. Two-thirds, 66%, said they had used AI tools at work while believing it broke company policy.
The same study found that 88% had shared work-related information with public AI services. Nearly a third, 31%, had pasted in financial information or confidential company documents and strategies. Read those numbers together and a familiar management assumption collapses.
The enterprise AI workforce nobody hired
The assumption is that adoption starts at the top and travels down. It does not always work that way.
Research from TrustedTech, based on a March 2026 Censuswide survey of 2,001 UK and US employees, found senior decision-makers were more than twice as likely as employees below decision-maker level to use unapproved AI tools: 65% against 31% across the full sample.
The UK-specific findings were similar. Sixty-two per cent of UK senior leaders used shadow AI, compared with 31% of employees below decision-maker level.
So the people writing the policy can also be among the people working around it. That is awkward. But it is also a signal. Senior staff often see where work hurts, and some are automating those points themselves.
MIT’s NANDA initiative described a similar divide in its State of AI in Business 2025 research. The preliminary study reviewed more than 300 publicly disclosed AI initiatives, interviewed representatives from 52 organisations and surveyed 153 senior leaders. About 95% of enterprise GenAI initiatives in its sample showed no measurable P&L impact, while workers at more than 90% of surveyed companies reported regularly using personal AI tools for work.
The official programme often stalled. The unofficial one kept moving.
Britain’s official picture also suggests that formal adoption remains relatively shallow. In July 2026, the Office for National Statistics reported that improving business operations was the most common use of AI, reported by around three-fifths of adopting businesses. Developing new products or services and exploring new markets were much less common.
That suggests much formal adoption remains focused on improving existing work rather than redesigning the business. Shadow-AI research indicates that some employees are experimenting more deeply on their own.
What a private prompt is really telling you
Most companies treat this as a security incident. Fair enough, given the 31% figure.
But an incident-only response throws away the more valuable half of what is happening.
Every persistent private routine is a clue.
Somebody found a task slow and repetitive enough to solve without permission, budget or help. In some cases, employees have already iterated those routines against real work and kept using the versions they found useful.
Consultants charge real money for that kind of process insight. Here, a mid-sized firm may be generating it internally without ever capturing it.
The Bristol bid coordinator has not only saved herself two hours. She has produced something close to a specification: which documents matter, in what order, judged against which criteria. Nobody wrote that brief. She discovered it.
From private habit to governed capability
The route to something a company owns runs through four stages.
A personal prompt becomes a repeatable procedure once someone writes down the inputs, the sequence and the quality test.
That procedure becomes a connected worker once it can reach the systems holding the real data. The routine no longer depends on repeatedly copying sensitive information between tools.
That worker becomes a governed capability once the company sets who may run it, what it may change and where the record lands.
Each stage adds something the last one could not. The procedure can survive the employee leaving. The connection reduces the copy-and-paste that created much of the security problem. Governance turns a clever habit into something an organisation can supervise and audit.
Skipping one of those stages can leave the automation fragile.
How to find your enterprise AI workforce
None of this necessarily requires a new product.
It requires a conversation many organisations are not yet having, and enough psychological safety for employees to answer honestly.
Ask people what they have already built. Ask which task they would automate first, and what they reach for when the official tools fall short.
Then treat the answers as a shortlist ranked by evidence.
The most frequently reused routines have at least passed one useful test: an employee found them valuable enough to keep using.
Riophany runs this discovery step before writing automation, mapping the manual routines people have created and then examining which are worth connecting to company systems. We made