The AI visibility gap is becoming a business risk

**In brief:** Artificial intelligence is already being used across large organisations, but many leaders do not have a complete picture of where, how or why those tools are being used. Protiviti reports that 47% of large organisations lack full visibility into employee AI-tool usage—a gap that creates cybersecurity, data protection, accuracy and governance risk.

What is employee-use visibility?

Visibility means more than knowing whether the business has purchased an approved AI platform. It means understanding which tools employees are using, what information is being entered, which processes are being automated and where AI-generated outputs are being relied upon.

Without that visibility, leaders may not know whether sensitive information is being copied into public services, whether confidential customer data is being processed outside approved systems, or whether staff are using unverified tools that create legal, security or operational exposure.

The rise of shadow AI

This is the AI equivalent of shadow IT: employees adopting tools independently because they are useful, fast and easy to access. In many cases, the intention is positive. People are trying to save time and improve the quality of their work.

However, unmanaged adoption can create several risks:

• Cybersecurity risk: sensitive information may be shared with systems that have not been assessed or approved.
• Data protection risk: personal, commercial or client information may be processed without the right controls, contracts or retention arrangements.
• Accuracy risk: AI outputs can be incomplete, misleading or confidently wrong.
• Operational risk: a process may become dependent on an individual tool, account or workflow that the organisation cannot properly monitor.
• Governance risk: the business may be unable to demonstrate how decisions were made or how information was handled.

Visibility must be matched by practical governance

Blocking every AI tool is unlikely to be a sustainable answer. Employees will continue to look for ways to work more efficiently, and an overly restrictive policy can encourage further hidden use.

A better approach is to combine visibility with practical guidance. Organisations should identify approved tools, define what information may be entered, establish clear human-review requirements and provide training that reflects the way people actually work.

They should also consider monitoring usage, reviewing third-party terms, controlling access, recording important AI-assisted decisions and creating a simple route for employees to ask questions before using AI with sensitive information.

AI should be treated as a business capability

AI is not only an IT issue. It affects finance, HR, operations, sales, customer service, legal compliance and senior leadership. Responsibility therefore needs to be shared across the organisation.

The businesses that gain the most from AI will not necessarily be those that adopt the largest number of tools. They will be the organisations that create enough structure to use AI confidently while retaining human accountability.

The first step is straightforward: find out what is already happening. You cannot govern AI use that you cannot see.

A practical route for UK organisations

For organisations exploring an approved business workspace, ChatGPT Business partner pricing and setup support can replace scattered personal subscriptions with central billing, clearer data boundaries and rollout guidance from AI Build Group.

Source: [Protiviti — Nearly Half of Large Enterprises Lack Full Visibility Into AI Use by Employees](https://www.protiviti.com/us-en/press-release-ai-pulse-half-enterprises-lack-ai-visibility).