# Shadow AI Employee Survey **Organisation:** [ORGANISATION NAME] **Owner:** [NAME / ROLE] **Date:** [DATE] **Version:** 1.0 --- ## Purpose Most organisations discover that employees use far more AI tools than IT has approved, and that sensitive data is flowing into tools nobody has assessed. This survey gives you a structured, low-friction way to build your first honest picture of AI use across the organisation: which tools people use, how often, what data goes into them, and why employees reach for unapproved tools in the first place. The survey is designed around a no-blame amnesty framing. Employees answer honestly when they trust that answers will not be used against them. Every design choice in this template (anonymity, coarse role categories, neutral wording) exists to protect that trust. The output is a baseline you can act on: an exposure score, a prioritised list of tools to assess, and a clear read on the unmet needs that drive shadow AI. --- ## How to Use 1. **Adapt the tool lists.** Review the multi-select options in each survey section and add tools you already know are popular in your organisation. Keep the "Other" free-text fields; they catch what your lists miss. 2. **Commit to anonymity, then say so.** Run the survey anonymously with no IP logging, no email capture, and no unique links tied to individuals. Keep role and department questions coarse (as written) so small teams cannot be identified. State all of this explicitly in the introduction message. 3. **Get visible leadership sponsorship.** Have a senior leader (CIO, CISO, or CEO) endorse the amnesty framing in writing: nobody will be disciplined for anything disclosed in this survey. 4. **Distribute through multiple channels.** Send the introduction message by email, post it in your main chat channels (Slack, Teams), and ask managers to mention it in team meetings. A survey that arrives once by email gets ignored. 5. **Boost response rates.** Keep the survey open for 10 business days, send one reminder at the halfway mark and one 48 hours before close, and share a completion-rate leaderboard by department if your culture supports it. Aim for at least a 60 percent response rate before treating results as representative. 6. **Analyse and share back.** Use the analysis guide below to segment results and compute the exposure score. Share a summary of findings with all staff within a month; people who give honest answers deserve to see what changed because of them. 7. **Repeat on a cadence.** Run the full survey every 6 to 12 months, or a short pulse version quarterly. AI tool adoption changes fast enough that an annual snapshot alone goes stale. --- ## Survey Introduction Message (Ready to Send) Copy, adapt the bracketed fields, and send by email or chat. > **Subject: 5 minutes to help us support your AI use (anonymous survey)** > > Hi everyone, > > AI tools like ChatGPT, Copilot, and meeting notetakers are now part of how many of us work. That is a good thing, and we want to support it properly: with approved tools, clear guidance, and licences the company pays for. > > To do that, we first need an honest picture of what is actually being used today. So we are running a short, completely anonymous survey. > > **The important part: this is an amnesty.** There are no wrong answers and no consequences for anything you disclose. We do not collect names, email addresses, or anything that could identify you, and role questions are deliberately broad. Nobody will be contacted about their answers. We are not looking for rule-breakers; we are looking for the gaps in what we provide. > > The survey takes about 5 to 7 minutes: [SURVEY LINK] > > It closes on [DATE]. Results will be shared with everyone, along with what we plan to do about them. > > Thank you for helping us get this right. > > [SPONSOR NAME], [SPONSOR ROLE] --- ## The Survey Question types are marked as: **[Single choice]**, **[Multi-select]**, **[Likert 1-5]** (1 = strongly disagree, 5 = strongly agree), or **[Free text]**. ### Section A: AI Tools You Use **Q1. Which general-purpose AI assistants have you used for work in the last 3 months?** [Multi-select] - ChatGPT (OpenAI) - Claude (Anthropic) - Microsoft Copilot - Google Gemini - Perplexity - DeepSeek - Grok (xAI) - Meta AI - Mistral / Le Chat - None of these - Other: [free text] **Q2. Which AI writing, content, or design tools have you used for work in the last 3 months?** [Multi-select] - Grammarly - Notion AI - Canva AI features (Magic Studio) - Gamma - Jasper - Copy.ai - Midjourney or another image generator - None of these - Other: [free text] **Q3. Which AI coding tools have you used for work in the last 3 months?** [Multi-select] - GitHub Copilot - Cursor - Claude Code - Windsurf - Replit - Tabnine - Not applicable to my role - None of these - Other: [free text] **Q4. Which AI meeting, transcription, or notetaking tools have you used for work in the last 3 months?** [Multi-select] - Otter.ai - Fireflies.ai - Fathom - Read AI - Granola - Zoom AI Companion - Microsoft Teams intelligent recap - None of these - Other: [free text] **Q5. Have you used AI features built into other software you use for work (for example CRM assistants, helpdesk suggestions, email drafting, spreadsheet formulas)?** [Single choice] - Yes, regularly - Yes, occasionally - No - Not sure **Q6. List any other AI tools you use for work that were not covered above.** [Free text] ### Section B: Frequency and Tasks **Q7. How often do you use AI tools for work tasks?** [Single choice] - Several times a day - About once a day - A few times a week - A few times a month - Rarely - Never **Q8. Which tasks do you use AI for?** [Multi-select] - Drafting or editing emails and documents - Summarising documents, threads, or meetings - Research and finding information - Analysing data or spreadsheets - Writing or reviewing code - Translating text - Creating images, slides, or designs - Brainstorming and planning - Drafting responses to customers or clients - Other: [free text] **Q9. "AI tools save me meaningful time in a typical week."** [Likert 1-5] **Q10. Roughly how much time do AI tools save you in a typical week?** [Single choice] - None - Under 1 hour - 1 to 3 hours - 3 to 5 hours - More than 5 hours ### Section C: What Data Goes In **Q11. Which of the following types of information have you ever entered into an AI tool for work? Select all that apply, including one-off cases.** [Multi-select] - Publicly available information only - Internal information (meeting notes, internal documents, project plans) - Confidential business information (strategy, financials, contracts, unreleased plans) - Customer or client personal information (names, contact details, account data) - Employee personal information (HR matters, performance, payroll) - Source code, system configurations, or technical documentation - Passwords, API keys, or other credentials - Health information or other sensitive personal information - None of these - Not sure **Q12. Have you ever pasted or uploaded an entire document, spreadsheet, or file into an AI tool?** [Single choice] - Yes, often - Yes, occasionally - Once or twice - Never - Not sure **Q13. Before entering work content into an AI tool, do you check it for sensitive details (names, financials, confidential material)?** [Single choice] - Always - Usually - Sometimes - Rarely - Never **Q14. "I am confident I know which types of data are safe to enter into AI tools."** [Likert 1-5] ### Section D: Accounts and Access **Q15. Which type of account do you mainly use for AI tools at work?** [Single choice] - A company-provided or company-paid account - A personal free account - A personal paid account - A mix of company and personal accounts - Not sure **Q16. Have you signed up for any AI tool using your work email without going through IT or procurement?** [Single choice] - Yes - No - Not sure **Q17. When no company-approved option was available, have you used a personal AI account to get work done?** [Single choice] - Yes, regularly - Yes, occasionally - Once or twice - Never **Q18. Have you connected any AI tool to company systems (email, calendar, file storage, CRM) by granting it access or installing an integration?** [Single choice] - Yes - No - Not sure ### Section E: Browser Extensions and Meeting Bots **Q19. Do you have any AI browser extensions installed in the browser you use for work?** [Single choice] - Yes - No - Not sure **Q20. If yes, which types of AI extensions?** [Multi-select] - Writing or grammar assistants - Page or video summarisers - AI search or sidebar assistants - Screen recording or screenshot tools with AI - Coding assistants - Not applicable - Other: [free text] **Q21. Have AI notetakers or meeting bots attended your work meetings?** [Single choice] - Yes, I have added one myself - Yes, others have brought them to my meetings - Both of the above - No - Not sure **Q22. Have AI notetakers been present in meetings with external parties (customers, partners, vendors)?** [Single choice] - Yes - No - Not sure - Not applicable ### Section F: Your Role Context These questions stay deliberately broad to protect anonymity. **Q23. Which best describes your area of work?** [Single choice] - Engineering, IT, or data - Sales, marketing, or communications - Finance, legal, HR, or risk - Operations, support, or service delivery - Leadership or general management - Other **Q24. Do you manage other people?** [Single choice] - Yes - No ### Section G: Unmet Needs and Blockers **Q25. What stops you from using company-approved AI tools more? Select all that apply.** [Multi-select] - I do not know which tools are approved - The approved tools lack features I need - Getting a new tool approved takes too long - There is no approved tool for my kind of task - The approved tools produce lower-quality results - Nothing stops me; the approved tools cover my needs - Other: [free text] **Q26. What work task do you most wish you had a better AI tool for?** [Free text] **Q27. "If the company provided an approved tool of similar quality, I would happily switch from the tools I currently use."** [Likert 1-5] ### Section H: Policy Awareness **Q28. Does the organisation have a policy on using AI tools at work?** [Single choice] - Yes, and I have read it - Yes, but I have not read it - No - Not sure **Q29. Do you know how to request approval for a new AI tool?** [Single choice] - Yes - No - Not sure **Q30. "I feel comfortable being open with the organisation about the AI tools I use."** [Likert 1-5] **Optional closing question. Anything else you want to tell us about AI at work?** [Free text] --- ## Analysis Guide ### Segment the results Analyse responses in these cuts, and never report a segment with fewer than 10 responses (collapse it into a broader group instead): | Segment | Questions to cut by | What it tells you | |---------|--------------------|-------------------| | Function | Q23 | Where adoption and risk concentrate (engineering vs finance look very different) | | Usage intensity | Q7 | Heavy users are your power users and your biggest exposure | | Account type | Q15 | Personal-account usage marks data leaving company control | | Policy awareness | Q28, Q29 | Whether governance gaps are knowledge gaps or provision gaps | | Manager vs non-manager | Q24 | Whether leaders model the behaviour policy expects | ### Red-flag answer patterns Treat these combinations as priority findings, not individual answers in isolation: - **Confidential or personal data plus personal accounts.** Q11 shows confidential business, customer, or employee data AND Q15 shows personal accounts. This is your highest-priority exposure. - **Credentials entered anywhere.** Any Q11 selection of passwords, API keys, or credentials warrants immediate follow-up communication (to everyone, preserving anonymity) and a credential rotation reminder. - **Whole-file uploads at frequency.** Q12 "often" or "occasionally" combined with Q13 "rarely" or "never" means unchecked bulk data is flowing out. - **Connected integrations nobody assessed.** Q18 "yes" answers reveal standing OAuth grants and API connections; these persist even when the employee stops using the tool. - **Meeting bots in external meetings.** Q22 "yes" means third-party AI may be recording customers and partners, often without documented consent. - **High usage, low awareness.** Q7 daily-or-more combined with Q28 "no" or "not sure" indicates governance has not reached your most active users. - **Approval friction as the top blocker.** If Q25 "takes too long" or "do not know which tools are approved" dominate, your shadow AI is a process problem before it is a people problem. ### Compute a simple shadow-AI exposure score Score each response, then average across all responses for an organisation-level score out of 12. | Component | Source | Points | |-----------|--------|--------| | Data sensitivity | Q11 | 0 = public or none; 1 = internal; 2 = confidential business or source code; 3 = customer or employee personal data; 4 = credentials or health data (take the highest selected) | | Account exposure | Q15, Q16 | 0 = company account; 1 = mix or not sure; 2 = personal account or unsanctioned work-email signup | | Usage intensity | Q7 | 0 = rarely or never; 1 = weekly or monthly; 2 = daily or several times a day | | Standing access | Q18, Q19, Q21 | 1 point each (maximum 2) for connected integrations, AI browser extensions, or self-added meeting bots | | Awareness gap | Q13, Q28 | 0 = checks content and knows the policy; 1 = one gap; 2 = both gaps | Interpret the average, and track the percentage of individual responses scoring 8 or more: | Average score | Rating | Suggested response | |---------------|--------|--------------------| | 0 to 3 | Low | Maintain guidance, re-survey in 12 months | | 4 to 6 | Moderate | Prioritise the top red-flag segments this quarter | | 7 to 9 | High | Launch a formal shadow AI programme within 30 days | | 10 to 12 | Critical | Treat as an active data-exposure incident; brief executives now | --- ## From Survey to Programme Survey results decay quickly. Turn them into a standing programme with these steps: 1. **Publish or refresh the AI usage policy.** Make it short, practical, and centred on data types rather than tool names. Reference your data classification scheme directly. 2. **Stand up an approved-tool catalogue.** Publish the list of approved tools with what each is approved for, and pair it with a fast, visible approval request path. Q25 and Q26 answers are your procurement shortlist. 3. **Close the top unmet needs first.** Approving one good tool for the most requested task eliminates more shadow AI than any amount of blocking. 4. **Fix the standing access.** Review OAuth grants, integrations, and meeting-bot permissions surfaced by Section D and E answers; revoke what nobody owns. 5. **Train against the specific gaps found.** Target training at the awareness gaps the survey exposed (Q13, Q14, Q28), not generic AI content. Align the programme with a recognised framework such as ISO/IEC 42001 or the NIST AI Risk Management Framework if you operate one. 6. **Move from snapshots to continuous discovery.** Surveys capture what people remember and admit on one day; automated discovery platforms such as [Aona](https://aona.ai) replace point-in-time surveys with continuous visibility of the AI tools actually in use and the data flowing into them. 7. **Re-survey to measure movement.** Repeat the survey (or a short pulse version) after 6 months and compare exposure scores. The trend matters more than the level. --- ## Worked Example: Filled Summary Table A hypothetical mid-size organisation (420 staff, 287 responses, 68 percent response rate) summarised its results like this: | Area | Headline finding | Score input | Priority action | |------|------------------|-------------|-----------------| | Tools (A) | 41 distinct tools named; 9 approved | n/a | Assess top 10 unapproved tools | | Frequency (B) | 52% use AI daily or more | Intensity avg 1.4 | Recognise AI as core tooling in budget | | Data (C) | 31% entered confidential data; 6 credential reports | Sensitivity avg 1.9 | Credential rotation notice, DLP rules | | Accounts (D) | 44% mainly personal accounts; 58 unsanctioned integrations | Account avg 1.2 | Company licences for top 3 assistants | | Extensions and bots (E) | 37% run AI extensions; bots seen in client meetings | Access avg 0.9 | Meeting-bot consent rule, extension review | | Needs (G) | Top blocker: "no approved tool for my task" (49%) | n/a | Fast-lane approval path, publish catalogue | | Policy (H) | 61% unaware any AI policy exists | Awareness avg 1.1 | Relaunch policy with manager briefings | Overall exposure score: **6.5 out of 12 (Moderate, trending High)**. The organisation committed to a 90-day plan: approve three assistants under company licences, publish the tool catalogue, add meeting-bot consent rules, and deploy continuous discovery to replace the annual survey baseline. --- *Provided free by [Aona AI](https://aona.ai). Aona discovers every AI tool in use across your organisation, monitors what data flows into them, and keeps your AI inventory audit-ready.*