Canadian workers outpace AI safety guidance at work

Almost half of Canadian office workers have never received guidance from their employer on using artificial intelligence safely at work, according to a survey commissioned by ISA Cybersecurity. The poll also found that two in five expect to rely more heavily on AI in 2027.

The survey of 1,042 office workers found that 48% had received no training or guidance on safe AI use from their employer, even as workplace use has risen sharply over the past year.

Nearly half of respondents, 47%, said they use tools such as ChatGPT, Claude, Copilot and Gemini for work at least a few times a week, including 24% who use them daily. Over the past year, 71% said their use of AI at work had increased moderately or significantly.

Among those who use AI at work, the most common tasks were research and answering questions, cited by 59%, and writing or editing emails and documents, cited by 56%. Another 44% use AI to summarise documents, meetings or research, while about 30% use it to analyse data or spreadsheets, or to create presentations, images or other content.

The findings point to a gap between employee adoption of AI and the policies and controls employers have put in place. The poll found that 39% use free or personal AI accounts at work, creating potential risks when company or client information is entered into systems outside an employer's oversight.

"Canadian workers have adopted AI faster than their employers can enable and train them to use it safely," said Andrew Buckles, executive vice president of services at ISA Cybersecurity.

Buckles said the risks arise both when employees use tools their employer does not manage and when approved systems are given access to more information than a task requires.

"When an employee pastes confidential client information into a free AI tool, the company loses sight of where that data goes, who can access it, and how long it's kept," he said.

"Security teams can't protect data they can't see."

Policy gaps

Half of those surveyed said their employer has a clear policy on how AI tools can be used. Another 18% said a policy exists but is unclear, 17% said their employer has no policy, and 15% were unsure whether one exists.

The survey also suggests workers expect AI-related threats to grow. Seven in 10 said they expect the number of AI-enabled scams targeting their workplace to rise in the coming year, while 59% believe their employer will increase investment in AI security.

Buckles said existing controls still matter as businesses expand their use of AI tools.

"The controls most organizations already have around email security and unapproved apps still work - they just matter even more now," he said.

"The harder problem is the AI tools companies have approved. If an employee can reach more data than their role requires, so can the AI assistant working on their behalf."

Access concerns

He said employers should focus on limiting access to data and systems so employees, and the AI tools acting with their permissions, can reach only what is necessary for a specific task. The Canadian Centre for Cyber Security has also advised against giving AI agents broad or unrestricted access, especially to sensitive information.

ISA Cybersecurity said companies should pay close attention to governance, access controls, workflows, usage monitoring, incident detection and response, and how AI systems are built and deployed.

"Maintaining secure operations requires organizations to commit to robust governance across key areas like access control, workflows, usage monitoring, incident detection and response, and AI engineering," Buckles said.

The survey was conducted among working adults in Canada employed by companies with at least 20 staff who use a computer as part of their job for at least six hours a week on average. Respondents were members of the Angus Reid Forum, and the research covered all provinces except Quebec.

The advice highlighted included confirming unusual requests through a trusted channel, checking which AI tools are permitted to handle which kinds of data, avoiding sharing passwords with AI systems, limiting permissions to what is needed for a task, and reporting suspected scams quickly.

"AI policies and security controls help protect a company and its customers," Buckles said. "But no single control catches every scam or every mistake, so it's essential for employees to understand how their actions can affect the organization."