There are still plenty of businesses that haven't invested in an enterprise AI subscription yet, and in most of them the marketing team will have been among the first to start using AI anyway. That makes complete sense when you think about what these tools are best at, because they produce written content and marketing needs a constant supply of it, from blogs and website pages through to the social posts that go out every week. If the business hasn't provided an approved tool and hasn't blocked access to the public ones, the obvious thing happens and people sign up for a free account and get on with their work.
The research bears this out. Deloitte's 2026 GenAI Workforce Survey of 25,000 UK workers found that 31% of people using generative AI for work were doing so without their employer's knowledge, 46% were using free tools and 17% had paid for at least one work-related AI tool out of their own pocket. Marketing sits near the top of the list, too. Deloitte found that 26% of marketers use generative AI several times a day, more than double the 12% average across the UK workforce, and in Turbotic's survey of 1,004 UK AI decision-makers, 28% reported unauthorised AI use in marketing, putting it third behind only IT and customer service.
Most of them won't realise they're doing anything they shouldn't, and that's usually because nobody has told them. Around half of the people in Deloitte's research who use generative AI at work had never had any formal training, and 65% said they hadn't seen convincing leadership on how it should be used. If a business hasn't communicated an AI policy, there's no reason for someone in marketing to know how a free plan treats their data, and it's quite different from what you get on a business account.
On ChatGPT's Free, Plus and Pro plans, conversations can be used to train OpenAI's models by default, and you have to go into the data controls and switch off a setting called “Improve the model for everyone” to stop it. Claude has worked in a similar way on its consumer plans since September 2025, with training switched on unless you turn it off, and on a personal Google account Gemini saves conversations and uses them to improve Google's models, with a sample read by human reviewers and kept for up to three years even if you delete your history. The business versions of all three work differently, because by default they don't train on what you put in.
Where the data lives is the other piece people rarely think about. OpenAI does now offer data residency in the UK and Europe, but only for eligible Enterprise, Edu and API customers, so anyone on a personal plan has no say over where their conversations are stored and none of the contractual protection a business agreement gives you. For a UK business whose own customers ask hard questions about where their data goes, that matters.
So if people have been using AI, and in most marketing teams they will have been, the next question is what they've been putting into it. In the KPMG and University of Melbourne study of attitudes to AI, 39% of UK workers said they had uploaded company information, such as financial, sales or customer data, into a public AI tool. It might be a customer case study before it's been approved, campaign results with company figures in them, or a CRM export pasted in to get a quick read on a segment, and any of that could now be sitting in a training pipeline or a chat history the business has no control over. That's really the heart of the Shadow AI problem in marketing, and for IT teams it's made harder by the fact that they usually have no visibility of what's been shared or where it went. Most businesses haven't caught up yet either. The government's latest Cyber Security Breaches Survey found that only 24% of businesses using or considering AI had any security practices in place to manage AI risks.
It's worth remembering why people are doing this in the first place; because they're trying to do their jobs better. They want to produce better quality work and get it done faster, and AI genuinely lets people do things they couldn't do without it, so the benefits are real and people will keep looking for a way to get them. In Microsoft-commissioned research, 28% of UK employees said their employer didn't provide a work-approved option, so the gap is often as simple as nobody having been given anything better. Blocking the public tools and leaving it there tends to push the behaviour somewhere even harder to see, so the more useful job is supporting people with the right tools under central governance, which for most businesses already on Microsoft 365 means Copilot.
The governance side is the obvious win. Microsoft 365 Copilot runs under the same data protection terms as the rest of your Microsoft 365 agreement, and your prompts, its responses and the business data it draws on aren't used to train the underlying models. Even before you buy any Copilot licences, staff signed in to Copilot Chat with their work account get that same enterprise data protection, which makes it a sensible place to point people while you plan the wider rollout.
What is more interesting is that the benefits of AI are multiplied once you're using Copilot, because it has the context of your emails, your Teams messages and the files sitting in SharePoint and OneDrive. It regularly surfaces something you may not realise was relevant, or wouldn't have thought to put in the prompt, and uses it to make the output better. It only ever shows people what they already have permission to see, which is reassuring until you remember how many old SharePoint sites are accessible across the whole company, and that's exactly why getting your data in order before you roll it out matters so much.
We were lucky enough to be early adopters of Copilot in our business, largely because we help our customers with Copilot demos, adoption plans and rollout plans, so it made sense for us to be using it ourselves. We've created things this year that I genuinely wouldn't have been able to create without AI, and the quality of that work has been higher because of the extra context Copilot brings in. At the same time I've got friends whose companies still haven't rolled it out, and others who are only just doing it now, with very different levels of adoption planning and some very different approaches to the rollout itself.
That variation matters, because the opportunity here is to help people create better work than they could before, and a rollout without proper adoption support tends to leave most of that value on the table. Hand someone a licence without showing them what it's good for and there's a fair chance they'll use it as a slightly better search engine.
If I were advising a business that hasn't made the move yet, I'd say trial Copilot with a group of people who are already using AI, which in most businesses will include the marketing team. Get your data right before you widen it, because tidying up permissions and old SharePoint sites is far easier before Copilot starts surfacing what's in them, and choose a partner who will help with the adoption and the rollout as well as the licences. Then check in with your employees regularly about how they're using AI, because those conversations tell you where the guidance isn't clear yet and where people need more help.
Upskilling is the part I'd push hardest on for marketing teams, because there's far more to AI than the chat window. CIM's research with YouGov found that 47% of marketing decision-makers were operating without a defined AI skills strategy, so plenty of teams are starting from a low base. You can build web apps with it now, create custom Copilot agents for the tasks your team repeats every week and set up workflows that take low-value work off people altogether. A lot of it is also already baked into the software marketing teams use every day, HubSpot being an obvious example, and simply learning how to configure what the AI does inside those platforms is often where the quickest gains are.
None of this has to happen in one go, and the first step costs very little. Point people at Copilot Chat on their work accounts and have an honest conversation about what they've been using and what should never go into a personal account. You'll learn a lot from it, and the people who've been quietly finding their own way round the problem will usually be the ones who make the rollout work.
Deloitte, GenAI Workforce Survey press release (September 2026)
Deloitte, GenAI Workforce Survey (2026)
Turbotic, Shadow AI in UK businesses (September 2026)
KPMG and University of Melbourne, UK attitudes to AI (2025)
DSIT, Cyber Security Breaches Survey 2025/2026
Microsoft UK, Rise in shadow AI tools (October 2025)
CIM, Marketing leadership in the age of AI (2026)