Nearly half of Canadian office workers have never received guidance from their employers on how to use artificial intelligence (AI) safely at work, according to a new survey from ISA Cybersecurity, raising concerns about data exposure as workplace AI adoption continues to accelerate.

The survey, conducted in October among 1,042 members of the Angus Reid Forum, examined Canadian office workers' awareness of cybercrime and their use of AI in the workplace. It found that 48% of respondents had never received employer guidance on safe AI use, while two in five expect to depend more heavily on AI in 2027.

“Canadian workers have adopted AI faster than their employers can enable and train them to use it safely,” said Andrew Buckles, executive vice president of services at ISA Cybersecurity.

Buckles pointed to two primary security concerns stemming from the gap between AI adoption and employee training. Workers may share sensitive information through AI tools that their employers do not manage. Meanwhile, employer-approved AI tools may inherit access to more data and systems than employees need to complete specific tasks, potentially expanding an organization's exposure.

The survey found that 39% of respondents use free or personal AI accounts for work. Buckles warned that sharing confidential information through these accounts can leave organizations without visibility into where their data goes, who can access it or how long it is retained.

“The controls most organizations already have around email security and unapproved apps still work – they just matter even more now,” Buckles said. “The harder problem is the AI tools companies have approved. If an employee can reach more data than their role requires, so can the AI assistant working on their behalf.”

He emphasized that organizations must ensure employees have access only to the data and systems necessary for their roles. While employees have a responsibility to use AI safely, Buckles said companies carry the primary responsibility for managing associated risks through governance covering access control, workflows, usage monitoring, incident detection and response, and AI engineering.

The findings illustrate how quickly AI has become part of everyday workplace activities. Nearly half (47%) of respondents said they use AI tools such as ChatGPT, Claude, Copilot and Gemini for work at least a few times a week, including 24% who use them daily. Additionally, 71% reported moderately or significantly increasing their workplace AI use over the past year.

Research and answering questions were the most common applications, cited by 59% of respondents who use AI at work. Writing or editing emails and documents followed at 56%, while 44% use AI to summarize documents, meetings or research. Roughly 30% use the technology to analyze data or spreadsheets or create presentations, images and other content.

Looking ahead, 70% of respondents expect AI-enabled scams targeting their workplaces to increase over the coming year. Meanwhile, 59% anticipate their employers will increase investments in AI security.

Employer policies may not be keeping pace with adoption. Although half of respondents said their employer has a clear policy governing AI use, 18% said their company's policy is unclear and 17% reported that their employer has no policy. Another 15% were unsure whether their organization has one.

“AI policies and security controls help protect a company and its customers,” Buckles said. “But no single control catches every scam or every mistake, so it’s essential for employees to understand how their actions can affect the organization.”

To help employees recognize AI-enabled scams and use workplace AI tools more safely, ISA Cybersecurity outlined several recommendations. Employees should verify suspicious requests for money, data or account access through trusted communication channels rather than relying on information provided in a potentially fraudulent message. Organizations can also establish shared code words to help employees identify fraudulent requests.

Workers should understand which AI tools are approved for specific types of information and avoid sharing passwords or unnecessary company data. AI assistants should also receive only the permissions needed to complete their assigned tasks, with unnecessary access disabled when the task is finished. The Canadian Centre for Cyber Security advises against providing AI agents with broad or unrestricted access, particularly to sensitive information.

The company also cautioned that attackers can hide instructions in emails that manipulate AI-generated summaries to display fraudulent password warnings or phone numbers. Employees should treat alerts, links or phone numbers appearing only in AI summaries as unverified.

Finally, ISA Cybersecurity encouraged employees to report suspected security incidents quickly, even if they have already clicked a suspicious link. Early reporting can help organizations limit damage and address mistakes before they escalate.