AI adoption in Europe outpaces workplace policies & training

Research from ISACA shows that use of artificial intelligence in European workplaces is rising significantly, but formal governance and policies are failing to keep pace.

According to the findings, 83% of IT and business professionals in Europe believe employees within their organisation are actively using AI. Despite this widespread adoption, only 31% of organisations have put in place formal, comprehensive policies to guide or regulate the use of AI at work.

The ISACA study surveyed 561 business and IT professionals across Europe, and collected data worldwide. It found that generative AI, a subset of artificial intelligence capable of creating text, images, or other media, is increasingly present: nearly three out of four European IT and cybersecurity professionals reported staff use of the technology—a notable rise of ten percentage points over the past year.

Policy lag

Although AI is clearly taking root in businesses, the report highlights a significant gap between the speed of adoption and the creation of formal governance. Less than a third of respondents' organisations have a comprehensive AI policy, exposing businesses to potential security and ethical risks where clear rules and protocols are lacking.

ISACA warns that as employee engagement with AI increases, best practice would see organisations proactively regulating its use; this has not yet been realised in the majority of workplaces. The mismatch between AI's prevalence and the rate of policy adoption stands out as a key concern.

Productivity benefits and risks

AI use is showing tangible benefits: 56% of those surveyed said AI had improved organisational productivity, while 71% cited efficiency gains and time savings. A further 62% expressed optimism about a positive impact from AI on their organisation over the next year.

At the same time, the rapidly advancing capabilities of AI are proving attractive to cybercriminals, with 63% of professionals expressing extreme or heightened concern about generative AI being used against their organisation. Additionally, 71% anticipate that deepfakes will become more sophisticated and widespread in the coming year, while only 18% of organisations are currently investing in tools to detect such threats.

"The UK Government has made it clear through its AI Opportunities Action Plan that responsible AI adoption is a national priority," says Chris Dimitriadis, ISACA's Chief Global Strategy Officer. "But while awareness is growing, many organisations are still falling behind when it comes to taking action and adopting it. At the same time AI threats are evolving fast, from deepfakes to phishing, and without adequate training, investment and internal policy, businesses will struggle to keep up. Bridging this risk-action gap is essential if the UK is to lead with innovation and digital trust."

Upskilling and education

The research underscores the importance of both policy and staff training. While formal guidance provides a framework, organisations also need employees equipped to recognise risks such as deepfakes or inappropriate uses of AI. According to the data, 42% of professionals believe they will need to improve their AI skills within the next six months to maintain or progress in their roles—an increase of 8% since last year. Looking further ahead, 89% expect upskilling to be necessary within two years.

"Without guidance, rules or training in place on the extent to which AI can be used at work, employees might continue to use it in the wrong context or in an unsafe way. Equally, they might not be able to spot misinformation or deepfakes as easily as they might if they were equipped with the right knowledge and tools. Technology is evolving, and bad actors are continuously keeping pace with changes to weaponise them, carrying out more sophisticated and advanced attacks.

"That's why upskilling can't wait. AI training must be prioritised and properly budgeted for, and at the same time, workplaces must work to embed formal and comprehensive policies that are understood by all as employees continue to experiment with AI in their day-to-day. With more skilled employees, businesses will have a workforce with a better understanding of best practice. These employees are more likely to champion the embedding of policies, making sure regulations are adhered to and upheld to a good standard."

The report concludes that both preparation and investment are needed to ensure the potential of AI can be harnessed while limiting exposure to new and evolving threats. Without the combination of formal policies and a trained workforce, organisations are likely to face mounting risks as AI use becomes even more embedded in daily work practices.