Staff using AI on personal accounts: what a company should do

AI adoption has turned into AI leakage.

On 4 and 5 November, Latvia's Central Statistical Bureau (CSP) published two studies on AI use. Put them side by side and this is what I see.

18.5% of Latvian companies with 10 or more employees use at least one AI solution. Small ones 15.3%, large ones 62.9%.

Meanwhile, 58.2% of internet users already use AI. For work, 24.8%, up from 15.5% a year ago.

In short, people are not waiting for management to decide. They start on their own.

The CSP does not count which account this happens in or what data goes in, but the scene is familiar. Someone in sales drops a client's quote into "the chat", the bookkeeper rewrites an email, a project manager pastes in a contract "to get the gist faster".

On a personal account, with no rules, with client data.

Large companies are already deciding who gets which tool. Goldman Sachs, Bloomberg reports, took AI coding tools such as Claude Code away from most of its traders and bankers. Now only engineers keep them. A bank spokesperson cites several reasons, including productivity and risk management. The experimentation phase is said to be over.

What to do this week: ask your team, anonymously, which AI tools they use and for what. Then decide three things: which tool, what data may go into it, and who is responsible for it.

What share of your team do you think already uses AI at work? Write down your guess. Below are the numbers behind that post, and a survey to ask the team itself.

I posted this on LinkedIn on 9 November. Checked: 9 November 2026.

The numbers in full

Companies

The CSP's enterprise survey, released on 4 November: in 2026, 18.5% of companies with 10 or more employees use at least one AI solution. That is 6.3 percentage points more than in 2025. By company size:

• small (10 to 49 employees): 15.3%;
• medium (50 to 249): 28.8%;
• large (250 and more): 62.9%.

The most common use is analysing written language, at 13.8% of all companies.

People

The CSP's household survey, released on 5 November: 3,635 people aged 16 to 74, interviewed in the first half of 2026.

• 58.2% of internet users use AI, 23.1 percentage points more than a year earlier.
• 24.8% use it for work (15.5% in 2025).
• Among employed people, 62.6% use AI and 33.2% use it for work. The CSP does not say whether that is a share of all employed people or only of those who use the internet.

The company and people figures come from two surveys with different samples, so one cannot be divided by the other. That people start using AI on their own before their company has decided is my conclusion. The CSP does not measure it.

Latvia and the EU

Eurostat's 2025 figures allow a comparison with the EU on one method. 12.2% of Latvian companies with 10 or more employees used AI, against an EU average of 20.0%. In the same year, 33.4% of Latvian residents used generative AI, against an EU average of 32.7%. Among companies, Latvia was well below the EU average; among residents, it was level with it. Eurostat has no 2026 company figure yet.

What staff do elsewhere

I found no Latvian or Baltic study of which accounts people use AI in. The closest data is international.

The University of Melbourne, with KPMG, surveyed 32,352 employees in 47 countries, Latvia included, between November 2024 and January 2025. The authors report:

• about 70% of those who use AI at work use free public tools;
• 48% of those who use AI at work have uploaded sensitive company or customer information to public AI tools;
• only 34% say their employer has a policy on generative AI.

In the Latvian part, 47% admitted using AI at work "in inappropriate ways" (KPMG Latvia, May 2025). That is a wider term than "against company policy", and the Latvian sample size is not given.

In Microsoft and LinkedIn's own 2024 study (31,000 knowledge workers in 31 markets), 78% of AI users brought their own AI tools to work, and 80% at small and medium companies.

What happens to data in a personal account

A personal account is an agreement between the vendor and one person. The company is not a party to it. Here is what four vendors say on their help pages.

For Copilot on a personal account there is no clear answer. In 2024 Microsoft said it would not train on consumer data from the European Economic Area "until further notice". A new Copilot app arrived in August 2026, and I could not confirm whether the 2024 commitment covers it. So open the settings and check for yourself.

On Claude's personal plans the choice has been the user's since August 2025. Anthropic's help pages now call the switch "Model Improvement"; the label in the app may differ.

Even with training off, a personal account stays personal. The company has no contract with the vendor for that data, cannot see what was entered, and cannot delete it. When the person leaves, the chats leave with them.

What the regulator and the law say

On 17 July 2026, Latvia's Data State Inspectorate (DVI) explained (in Latvian) whether an employee may enter personal data into an AI tool. Its example is an employee who, "on their own initiative", puts a client complaint containing personal data into a public AI tool. It is the same scene my post started with.

The DVI names two risks: the input may be used to improve the service, and it may leak through vulnerabilities or incidents. The organisation is responsible for the lawfulness and security of the processing, whether the tool is public or its own. The DVI recommends:

• before entering personal data, asking whether the task needs it at all, and using anonymised information where possible;
• keeping out employment contracts with names and personal ID codes, client lists with contact details, health data, children's data and copies of ID documents;
• setting an internal procedure: which tools may be used, for what, and which data stays out;
• reading the vendor's data processing terms and checking the privacy settings;
• looking after staff AI literacy;
• checking whether a data protection impact assessment is needed.

What follows is our reading of the GDPR, not a legal opinion. For client and staff data used at work, the company is the controller. If a vendor processes that data on the company's behalf, Article 28 of the GDPR requires a processor contract. A personal account gives the company no such contract, and no document to support transferring the data outside the EU. Vendors offer these agreements on their business plans.

The second rule is Article 4 of the EU AI Act. Since 2 February 2025, a company that uses AI at work (a "deployer" in the Act) has had to take measures for its staff's AI literacy. Since the amendments that took effect on 27 July 2026, no specific level of literacy has to be guaranteed, but the measures are still required. Written rules and a short training session are, in our view, proportionate measures for a small company.

This is not legal advice. The final word on your company belongs to your lawyer or data protection officer.

Decide, don't just ban

In the post I wrote that large companies are already deciding who gets which tool. The Goldman Sachs story has another side.

In June 2025 the bank rolled out its own AI assistant, the GS AI Assistant, to all staff after a pilot with more than 10,000 employees (as reported by Fox Business and NBC News). In October 2026 the bank's internal guidelines kept advanced AI coding tools, such as Claude Code, for engineers only (Bloomberg, cited by The Decoder on 2 November). A spokesperson cites "a variety of factors including productivity and risk management". The reports do not say whether the October decision affects the assistant for everyone.

So the bank decided which tool goes to which employees. A ten-person company can make the same decision.

A ban sounds simpler, but surveys suggest many people would not put the tools down:

• In a survey commissioned by Software AG (6,000 knowledge workers in the US, UK and Germany, September 2024), 46% said they would keep using their own AI tools even if their employer banned them.
• Among its own customers, mostly large companies, the security vendor Netskope saw two things in the year to October 2025. Personal AI apps were used by 47% of generative AI users (78% a year earlier), and company-managed accounts by 62% (25% before). These are two trends at the same time, and Netskope has not shown that one causes the other. I read them as people moving to a company account once there is one.

The first step: an anonymous team survey

Before you choose a tool or write rules, find out what is happening now. Below is our own survey: eight questions, about five minutes. Set it up in Google Forms or Microsoft Forms without sign-in, and tell the team nobody will be penalised for their answers. Without that, the answers will be about as accurate as your guess at the end of the post.

After the survey, decide three things

• Which tool. One business plan for everyone who uses AI at work. Choose it by where the team already works: Microsoft 365, Google Workspace, or neither. Question 2 shows which tool people already like.
• Which data. Start with the DVI's list: no personal ID codes, client contact lists, health data or document copies, and replace names before pasting, for example with "Client A". Question 5 shows where the biggest risk is today.
• Who is responsible. One named person who approves tools, keeps the list of allowed tools and takes reports of mistakes.

All three answers fit into a one-page AI usage policy: allowed tools, data that stays out, company and personal accounts, and the person responsible. It should also carry the line the survey depends on: a mistake reported in time is not punished.

This is the work we do with companies at RRN: we set up a Claude Team account, where the data stays under the company's control, and train the team to work in Claude with its own files. If you would like to go through your survey results with us, book a free 30-minute call.