Employees hide their AI use because disclosure costs them. Admit it and colleagues call the work cheating. Be overheard and the employer bans the tool. Each rule makes sense alone, and together they make silence the rational choice. So someone on your team may be three times faster than they were eighteen months ago and will not tell you why.
Two rules that punish disclosure
First, using AI still counts as cheating. Nobody writes this down.
Part of the disdain is taste, because real professionals write their own drafts. Part is protecting their turf, and part is fear dressed up as principle. Whatever the motive, admitting AI use invites a quiet reassessment of the work, and of you.
Second, once management hears about it, it gets banned. Disclosure rarely starts a policy discussion. It produces a ban, a blocked domain and a colleague who now works around both.
Together, the two rules shame you if you admit it and block you if you are overheard. Coming forward never leaves a person better off, so they stay quiet about the method. The organization then concludes that nobody there uses AI.
That conclusion is false in every organization I have looked at.
The ban is a reasonable response
A firm that blocks AI tools is usually answering real duties: client confidentiality clauses, data protection law, sector regulators and professional insurers. It often cannot answer one question either: what has already left? A blanket ban is crude, but it is a rational response to a flow you cannot see.
In 2023, Samsung restricted generative AI tools on its internal networks after employees were reported to have pasted confidential material, including source code, into a chatbot. Nobody acted maliciously. Once the material had left, there was no way to get it back.
So two parties, both acting sensibly, produce an outcome worse for both. The employee hides skills the firm pays for, and the firm writes policy for behaviour it cannot observe. The fix is to lower the cost of disclosure.
Efficiency wins once someone is accountable
A comforting argument says efficiency always wins, so hiding is a phase that will pass. That is mostly true, but not in the fields where it counts. Law, medicine, audit and engineering have long limited efficiency on purpose, through licensing, mandatory process and personal liability. A lawyer ten times faster gains nothing if the bar decides the output cannot be attributed to anyone.
Look at the AI scandals in the professions: invented case citations and reports full of confident errors. Each sanction punished a person who signed output they had not checked. So efficiency wins once a person can answer for the output.
Three changes that end the standoff
First, use is disclosed, not confessed. The shaming targeted the wrong thing. The real offence was always unreviewed work going out under someone's name, and anyone handed a fluent, wrong draft knows the risk.
Punish that instead. The rule is sharper and catches people who never use AI.
| What gets punished today | What should get punished |
|---|---|
| Using AI at all | Sending work nobody reviewed |
| Being fast in a way that is hard to explain | Being unable to defend the output |
| Telling your manager | Not knowing what left the firm |
Second, responsibility becomes what you are paid for. If a machine can produce the draft, you are paid to say "I stand behind this" and to lose something if it is wrong. As we have argued, a machine can never be responsible for anything, because it has nothing at stake.
That job is harder, because you cannot review work you could not have done yourself. Judgement becomes the part that counts.
Third, compliance becomes possible. Most AI data protection policies govern data use nobody can see, and a control cannot apply to hidden behaviour. Once use is disclosed, the question becomes what is leaving the firm. That has a practical answer: remove the identities before the text goes anywhere, keep the substance, and put the names back on your own machine afterwards.
The AI does not need your client's name to analyse their contract, and the risk when it gets the name is real. Acceptance comes first and protection second. Nobody can secure a workflow that officially does not exist.
When the approved path is slower
The common mistake is to accept AI in principle, then require a form, a ticket to legal and a two-week review. At the end comes an approved tool worse than the one people already use quietly. They keep the faster tool and keep not telling you.
The channel that works for us is a browser extension, which a knowledge worker can add without asking anyone. The demand we see is for protection that needs no meeting first. The safe option has to be the quickest one.
What to do first
If you use AI: share the method with the output, once, with one person who will not punish you. Say what AI drafted, what you checked and what you changed. You need nobody's permission, and it shows a person reviewed the work.
If you manage people: assume it is already happening, and declare an amnesty you will keep. You only get one shot at that promise. Otherwise, confidential data you answer for keeps going into chat windows, pasted by people who would like to tell you.
Common questions
Why do employees hide that they use AI?
Admitting it invites the charge of cheating, and being overheard often leads to a ban. Staying quiet is the one move that leaves them better off.
Can an AI policy work if the use is undisclosed?
No, because a control cannot apply to behaviour nobody can observe. Disclosure comes first, and it turns the question into what exactly is leaving.
What should a manager do first?
Declare an amnesty and keep it, then make the approved path faster than the hidden one. Our map of how companies protect personal data shows where each option fits.