Generative AI at work  Why governance must catch up

CLA’s latest research report Content Use, Copying and Generative AI at Work, based on an online survey of 1,000 UK professionals conducted in February 2026, provides a clear snapshot of how deeply embedded these tools have become in UK workplaces and where the pressures on policy and governance are beginning to show.

The headline finding is no surprise. Generative AI is now mainstream in the workplace. The research shows that 78% of UK professionals use generative AI at work, up from just 31% in 2024. Three quarters of respondents said that generative AI is already integrated into their workplace in some way, and almost 60% reported increased organisational investment in AI tools.

Generative AI is no longer something on the horizon, it is embedded in everyday working life. That shift creates real opportunities for productivity and efficiency, but it also brings new governance challenges into sharp focus.

The rise of shadow AI

One clear theme emerging in the research is permission. Only 53.5% of professionals said they have official permission to use generative AI at work, rising to about two thirds if those expecting permission within the next three months are included.

However, when these responses are compared with reported behaviour, a gap emerges. Around 11.5% appear to be using generative AI at work despite saying they do not have formal permission.

This so‑called “shadow use” does not automatically reflect bad intent. Instead, it highlights how demand for AI tools has often outpaced organisational policy. Employees are adopting tools because they are useful, accessible and increasingly expected, even where formal guidance has not yet caught up.

For organisations, this should be a warning. Where policies fail to keep pace with behaviour, risk does not disappear, it merely becomes more difficult to identify and manage.

Generative AI as part of an expanding content ecosystem

The research shows how generative AI now sits within a wider content environment at work. Traditional sources such as government information, news, books, journals and industry publications continue to be widely reused and shared across workplaces.

What has changed since 2024 is the scale of AI use. Generative AI outputs have become a major content source, ranking alongside government information and ahead of several traditional formats.

But it’s important to bear in mind that this isn’t about AI replacing other sources. The overall content mix has stayed largely stable. Rather, AI has become an additional layer in an already complex information landscape, so professionals are drawing on a broader range of sources, not fewer.

The feedback loop

The most significant behavioural shift identified in the research is what happens after AI is used.

When AI users were asked what they feed into generative AI tools, the most common input cited was prior AI outputs, selected by 34.7% of respondents.

Those AI outputs are then reused and repurposed for everyday tasks such as presentations, summaries, internal training materials and briefings and often re‑entered as prompts, combined with other third-party material.

As this feedback loop develops, the traceability of third‑party content within workflows can decline. Employees are not always aware of the prompts, third‑party material or prior AI outputs that have shaped the content they are working with. Yet the underlying copyright considerations have not disappeared.

This is not a debate about ownership of AI outputs, it reflects a practical reality of modern workflows, where content moves faster, further and with less friction than before.

Attitudes are shifting alongside tools

Alongside these behavioural changes, the research highlighted a subtle shift in attitudes.

While most professionals say they have some understanding of copyright, fewer now say they would seek permission before copying (down five points since 2024). Fewer see copyright infringement as a business risk (down 5.2 points). At the same time, more say they would copy or share content if work demanded it, up 6.1 points.

In 2026 terms, 71% still say they would seek permission if unsure, and 67% still recognise infringement as a business risk. However, 54% say they would not hesitate to copy if work required it.

This does not suggest indifference, but it does show how ease of use can soften perceived risk. When friction drops, governance must become clearer.

Why governance matters now

This is why generative AI has become a governance question, not simply a technology decision. Governance is not about restricting innovation. It is about enabling confident, compliant use at scale.

A strong AI governance framework should consider:

• Generative AI usage policies: Establish clear, enforceable guidelines on how generative AI tools can be used within the organisation, specifying approved use cases, tools, and any restrictions.
• Content governance and licensing: Define what types of content and data can be used as prompts or inputs in generative AI tools, and ensure appropriate permissions and licences are in place to support the lawful use of third-party published content protected by copyright.
• Employee training and accountability: Implement regular training programs to educate and inform employees on generative AI, responsible uses, and ethical and copyright considerations when prompting generative AI tools.
• Tool evaluation and security: Assess the security credentials of a generative AI tool before authorising its implementation and use in the workplace, and do this on a continual basis to ensure that the tool not only complies with the organisation’s data and security requirements and controls, but that content and data inputted will not be used to train the tool’s underlying algorithm.
• Monitoring and auditing: Establish processes to track usage of generative AI tools within the organisation, ensure compliance with the policy by users, and identify and address potential risks early on.

Licensing plays a practical role here. CLA’s updated workplace generative AI permissions provide organisations with clarity around the lawful reuse of opted‑in published content when prompting AI tools, helping governance frameworks translate into day‑to‑day practice.

There is no room for doubt, generative AI is now woven into the fabric of everyday work, reshaping how information is created, combined and circulated across organisations, and in doing so it makes content flows more complex, reuse more iterative, and risk harder to manage.

The organisations that will thrive are the ones who act decisively by investing early in clear governance, licensing and law frameworks that enable people to innovate responsibly.