Half of Canadian office workers lack AI safety training

Nearly half of Canadian office workers have never received guidance from their employer on how to use artificial intelligence safely at work, according to a survey commissioned by ISA Cybersecurity. The poll also found that two in five workers expect to rely more heavily on AI in 2027.

The survey of 1,042 Canadian office workers found that 48% had received no training on safe AI use, even as the technology becomes a routine part of office work. Conducted among members of the Angus Reid Forum, it covered workers at companies with at least 20 employees in every province except Quebec.

AI tools are already widely used at work. Nearly half of respondents, 47%, said they use tools such as ChatGPT, Claude, Copilot and Gemini at least a few times a week, while 24% use them daily.

Over the past year, 71% said their use of AI at work had increased moderately or significantly. Among those who use AI on the job, the most common tasks were research and answering questions, cited by 59%, and writing or editing emails and documents, cited by 56%.

Document, meeting and research summaries were cited by 44% of users. About 30% said they use AI to analyse data or spreadsheets, or to create presentations, images or other content.

Training gap

Andrew Buckles, Executive Vice-President of Services at ISA Cybersecurity, said the pace of adoption had overtaken employers' efforts to set rules and train staff.

"Canadian workers have adopted AI faster than their employers can enable and train them to use it safely," Buckles said.

He said the gap creates two main risks for employers. Staff may enter sensitive information into AI tools that are not managed by their company. Approved AI systems may also gain access to more data and systems than a task requires if permissions are not tightly controlled.

The survey found that 39% of respondents use free or personal AI accounts at work, highlighting a grey area for employers trying to govern how staff use generative AI tools inside and outside formal company systems.

"When an employee pastes confidential client information into a free AI tool, the company loses sight of where that data goes, who can access it, and how long it's kept," Buckles said. "Security teams can't protect data they can't see."

He also pointed to risks tied to approved workplace tools when access controls are too broad.

"The controls most organizations already have around email security and unapproved apps still work - they just matter even more now," Buckles said. "The harder problem is the AI tools companies have approved. If an employee can reach more data than their role requires, so can the AI assistant working on their behalf."

Policies unclear

The poll suggests many employers are still working out their AI rules. Half of respondents said their employer has a clear policy on how staff can use AI tools, while 18% said a policy exists but is unclear.

Another 17% said their employer has no AI policy, and 15% were unsure whether one exists. In total, half of those surveyed either lack a clear policy or do not know whether their workplace has one.

Respondents also appeared alert to the risks of AI-related fraud. Seven in 10 said they expect the number of AI-enabled scams targeting their workplace to rise over the next year, while 59% expect their employer to increase investment in AI security.

Buckles said companies remain responsible for setting controls around access, monitoring and incident response, even as staff need to understand the risks of sharing information with AI tools.

"Maintaining secure operations requires organizations to commit to robust governance across key areas like access control, workflows, usage monitoring, incident detection and response, and AI engineering," he said.

Scam concerns

The findings come as employers face a broader shift in how office workers handle routine tasks. AI tools are increasingly used not only for drafting and editing, but also for summarising content and assisting with data analysis, raising questions about whether staff can distinguish between safe internal use and risky disclosure of sensitive information.

ISA Cybersecurity said staff should verify requests for money, data or account access through trusted channels if they suspect a message may be part of an AI or voice scam. It also warned against sharing passwords with AI tools or granting AI assistants broad permissions to sensitive systems and data.

The company also highlighted a newer concern around AI-generated summaries. Attackers can hide instructions inside an email so an AI summary produces a false warning or a phone number to call, creating another route for fraud.

For employers, the findings add to pressure to move beyond informal guidance as AI use spreads through office work. With nearly half of workers saying they have had no training, and 40% planning to depend more heavily on AI in 2027, companies face a growing need to match adoption with clearer rules and tighter controls.

"AI policies and security controls help protect a company and its customers," Buckles said. "But no single control catches every scam or every mistake, so it's essential for employees to understand how their actions can affect the organization."