See where everyday AI use may be creating risk in your organisation.
A short, confidential staff AI Risk Profile shows where checking, judgement, data use and ownership need attention, so your business or council can act early.
Why this matters now
AI risk does not come only from the tools you approve or buy. It also comes from how people use AI day to day: what they trust, what they check, what they upload, what they disclose and what they let pass into real work.
The issue for leaders is not whether people use AI. They already do. The real question is where that use may already be creating risk, and whether you can see it early enough to act.
Among employees who use AI at work, 66 per cent report relying on AI outputs without critically evaluating them, 56 per cent report making mistakes because of AI and 72 per cent report putting less effort into work because they know they can rely on AI.1
In a July 2025 survey of 1,000 US working adults who use AI at work, 78 per cent said they use AI tools their employer has not approved.2 In a separate US and Canada survey, 93 per cent admitted entering information into AI tools without confirming company approval.3
Verification and effort
66%1
AI-using employees who relied on AI outputs without critically evaluating them
56%1
AI-using employees who made work mistakes because of AI
72%1
AI-using employees who put less effort into work because they could rely on AI
Shadow AI and approval gaps
78%2
US workers using AI at work who use tools their employer has not approved
93%3
US and Canada employees who entered information into AI tools without confirming approval
These figures come from different studies with different populations, so they are not directly comparable.
Research involving 319 knowledge workers found higher confidence in generative AI was associated with lower reported critical-thinking effort (Microsoft Research and Carnegie Mellon, Lee et al., 2025).4 Australia’s privacy regulator also says organisations using commercially available AI products need to manage privacy risk actively, and advises that personal information should not be entered into publicly available generative-AI tools as a best practice.5
These findings are not a measurement of your organisation. They do show that AI risk is often being shaped by ordinary, hard-to-see behaviour long before it shows up as an incident, complaint, breach or governance issue.
What this means for a business
Most organisations do not need more AI noise. They need a clearer view of where AI is actually being used, where weak practice may matter most, and where existing controls may not be reaching real work.
Sources
- KPMG and the University of Melbourne (2025). Global study of trust, attitudes and use of AI. assets.kpmg.com/content/dam/kpmgsites/xx/pdf/2025/05/trust-attitudes-and-use-of-ai-global-report.pdf
- SAP and WalkMe. Survey of US working adults who use AI at work, July 2025.
- ManageEngine. Survey of employees in the US and Canada.
- Lee et al., Microsoft Research and Carnegie Mellon University (2025). Study of 319 knowledge workers on generative AI and critical thinking.
- Office of the Australian Information Commissioner. Guidance on privacy and the use of commercially available AI products. oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-the-use-of-commercially-available-ai-products
What the AI Risk Profile does
The AI Risk Profile gives you a practical read on how people are using AI at work, where that may be increasing exposure, and what to check next.
It is not a review, a compliance sign-off or a claim that a specific incident has occurred. It is a structured screening tool that helps leaders see where behaviour may be creating risk, where to look more closely and where to strengthen practice first.
It combines three useful lenses:
Behaviour
How people report using AI in recent work.
Exposure
How often AI is used and how consequential that use is.
Performance
How well people distinguish flawed and sound AI outputs in a short exercise.
What it looks at
The AI Risk Profile shows patterns across five areas:
Checking AI outputs
Whether people check facts, summaries, references and claims against original sources before others rely on the work.
Reliance and own judgement
Whether people keep independent reasoning active rather than defaulting too quickly to AI recommendations.
Safe data and tool use
Whether work information stays out of personal, public or unapproved tools and accounts.
Ownership and speaking up
Whether people disclose material AI use, own AI-assisted work and raise problems early.
Spotting AI mistakes
A short performance exercise that tests both noticing real problems and not raising false alarms on correct outputs.
Each area is reported as a band: Needs attention, Mixed practice or More consistent practice. These bands are management signals. A Needs attention result may point to a gap worth investigating. A More consistent practice result is positive, but it does not mean every workflow is controlled or every use is safe.
- Needs attention
- Mixed practice
- More consistent practice
What you get
The AI Risk Profile helps leaders move from broad concern to something more useful: a clearer starting point for action.
It helps answer practical questions such as:
- Where may AI-assisted work be going out without enough checking?
- Where may people be accepting AI recommendations too quickly or with too little challenge?
- Where may work information be entering personal, public or unapproved tools?
- Where may accountability, disclosure or escalation be weaker than leaders assume?
- Where may people struggle to detect plausible AI mistakes, even when the output looks polished and convincing?
How to use the result
Used well, the profile helps you read four things together:
Who is represented
Whose experience is in the result.
Where exposure is highest
How often AI is used and how consequential that work is.
Which behaviours may need attention
Where practice looks safer, mixed or weaker.
What to verify next
Which workflows, tools or habits deserve closer review.
That gives you a better basis for:
- prioritising training, guidance and workflow controls,
- reviewing higher-consequence or client-facing uses of AI,
- tightening approval rules, ownership and escalation paths,
- and supporting better conversations across leadership, legal, risk, IT, HR and operational teams.
Built for practical decisions
The AI Risk Profile supports action that is specific and proportionate. Depending on the result, you may decide to tighten verification rules, clarify which tools and data types are approved, assign clearer ownership for important AI-assisted decisions, improve reporting of near misses, or preserve manual practice where independent expertise still matters.
A practical process
The AI Risk Profile is designed to be simple to run and easy to use.
Staff survey
A short, confidential survey completed online.
Team dashboard
Results by area and team, with team results suppressed for groups with fewer than five responses.
Focused guidance
Practical controls to consider for the areas needing most attention.
Short explainer videos
Plain-English guidance on what each signal may indicate, what exposure it can create and what to verify next.
Read it as a signal, then verify it
The value of the AI Risk Profile is not that it pretends to give certainty. The value is that it shows where to look more closely, then gives you a better basis for testing that signal in real workflows, alongside tool approvals, incident records and control checks.
That helps organisations act earlier, focus effort better and avoid treating AI governance as a paper exercise.
Why organisations use it
Organisations use the AI Risk Profile to:
- get earlier visibility of hidden AI-related exposure,
- see where behaviour may be undermining what existing controls are meant to achieve,
- focus governance effort where it matters most,
- build a more credible picture of how AI is really being used across work,
- and act before weak practice becomes an incident, control failure or board-level problem.
See where to look first
Most organisations already have an AI risk profile. The value is seeing it early enough to do something useful about it.