Canadian workers outpace AI safety guidance at work

ISA Cybersecurity has published survey findings showing that 48% of Canadian office workers have never received employer guidance on using artificial intelligence safely at work. The poll also found that two in five expect to rely more heavily on AI in 2027.

The survey of 1,042 Canadian office workers points to rapid workplace adoption of AI tools alongside uneven controls and training. It found that 47% of respondents use tools such as ChatGPT, Claude, Copilot and Gemini for work at least a few times a week, while 24% use them daily.

Use of AI at work has risen sharply over the past year. Some 71% of respondents said they had moderately or significantly increased their use of AI for work tasks over that period.

At the same time, 39% said they use free or personal AI accounts at work, a practice that can leave employers with limited oversight of what information is entered into external systems. Half of those surveyed said their employer has a clear policy on how staff can use AI tools. Another 18% said a policy exists but is unclear, 17% said their employer has no policy and 15% were unsure whether any policy exists.

Andrew Buckles, executive vice president of services at ISA Cybersecurity, said the gap between adoption and staff guidance was widening. "Canadian workers have adopted AI faster than their employers can enable and train them to use it safely," Buckles said.

He said the risks fall into two broad areas: staff may enter sensitive information into AI systems outside company control, and approved internal AI tools may gain access to more corporate data than a task requires if access rules are too broad.

"When an employee pastes confidential client information into a free AI tool, the company loses sight of where that data goes, who can access it, and how long it's kept," Buckles said. "Security teams can't protect data they can't see."

The findings suggest many workers are already using AI for routine office functions. Among respondents who use AI tools at work, 59% said they use them for research and answering questions, while 56% use them for writing or editing emails and documents. Another 44% use AI to summarise documents, meetings or research, and about 30% use it to analyse data or spreadsheets, or create presentations, images or other content.

Policy gaps

Cybersecurity specialists have increasingly focused on how organisations govern employee access to AI systems and the data those systems can reach. Buckles said companies should pay closer attention to permissions, monitoring and response procedures, rather than treating AI use solely as a staff issue.

"The controls most organizations already have around email security and unapproved apps still work - they just matter even more now," Buckles said. "The harder problem is the AI tools companies have approved. If an employee can reach more data than their role requires, so can the AI assistant working on their behalf."

The survey also found that workers expect AI-related threats to rise. Seven in 10 respondents said they believe the number of AI-enabled scams targeting their workplace will grow in the coming year, while 59% expect their employer to increase investment in AI security.

That reflects broader concern over phishing, impersonation and social engineering attacks that use AI-generated text, audio or automated workflows to appear more convincing. The survey did not measure actual incidents, but it points to rising awareness among employees that AI is changing the threat landscape.

Shared responsibility

Buckles said organisations need governance across access control, workflows, usage monitoring, incident detection and response, and AI engineering. He added that workers still play an important role in reducing risk through day-to-day decisions about what they enter into AI systems and how they respond to unusual requests.

"Maintaining secure operations requires organizations to commit to robust governance across key areas like access control, workflows, usage monitoring, incident detection and response, and AI engineering," Buckles said.

ISA Cybersecurity also highlighted practical steps for staff, including confirming suspicious requests through a trusted channel, checking which AI tools are approved for different types of data, limiting permissions given to AI assistants, and reporting suspected scams quickly. It also warned that attackers can hide misleading instructions in emails that may surface only in AI-generated summaries.

The research covered working adults in Canada employed by organisations with at least 20 staff, excluding Quebec. To qualify, respondents had to work at a computer for at least six hours a week as part of their job.

"AI policies and security controls help protect a company and its customers," Buckles said. "But no single control catches every scam or every mistake, so it's essential for employees to understand how their actions can affect the organization."