The answer to the question "Is AI being used at our company?" may differ from what most management teams assume. Even if the organization has not chosen an official tool, employees are trying out generative AI tools on their own to summarize text, draft emails or pull data together. In that case, the real question stops being "Should it be used?" and becomes "How should it be managed?"
The topic is on the agenda today because of new data. According to the Artificial Intelligence Statistics bulletin that TÜİK (the Turkish Statistical Institute) published on October 2, 2026, the share of individuals who say they use generative AI was 19.2% in 2025 and rose to 37.6% in 2026. In this article we look at what this figure says from a workplace perspective and how you can bring unchecked use into a governance framework. We examined the personal data and KVKK (Türkiye's data-protection law) dimension separately in our article on the internal company policy; here the focus is on making usage itself visible and manageable.
The data: individuals move fast, organizations are more cautious
The TÜİK bulletin gives not only the overall rate but also the purpose of use. Of the individuals who use AI, 86.4% use it for private purposes, while 37.3% say they use it for professional purposes. Use is higher in the younger age groups: the rate is 64.9% in the 16–24 age group and 55.7% in the 25–34 age group. The generations newly entering the workforce are bringing these tools to work as an everyday habit.
On the enterprise side, the same bulletin paints a more cautious picture. Among enterprises with 10 or more employees, the rate of using any AI technology in 2026 is 14.0%. Because these two rates measure different units (individuals and enterprises), they cannot be compared directly. Even so, the signal it gives is noteworthy: employees' individual use may be running ahead of corporate adoption.
The reasons for organizations' caution can also be seen in the bulletin. Enterprises that do not use AI but are considering it cite, alongside a lack of expertise, uncertainty about legal consequences at 66.4% and data protection and privacy concerns at 65.4%. When an organization decides to wait because of these concerns, usage does not stop; it only drops out of the organization's field of view.
The picture is not unique to Türkiye. According to data the OECD published in January 2026, 41.1% of employed people across the OECD use generative AI tools.
Where does the risk of unchecked use lie?
According to a survey Gartner conducted with 302 cybersecurity leaders between March and May 2025, 69% of organizations suspect that employees are using prohibited public generative AI tools or have evidence of it. Gartner states that unapproved tools can lead to intellectual property loss, data exposure and security risks, and it predicts that by 2030 more than 40% of organizations will experience a security or compliance incident linked to unauthorized use.
The risk profile specific to generative AI from the US National Institute of Standards and Technology (NIST) describes these risks in more concrete terms. Among the risks in the profile are the leakage or unauthorized use of personal or sensitive data, the production of content that is presented with confidence but is incorrect, and people placing excessive trust in the system. When an employee sends a text or a calculation produced by a tool to a customer without checking it, all three of these risks can come into play at once.
In the same announcement, Gartner also points to a less visible risk: excessive dependence on AI can, over time, erode expertise and judgment within the organization. Unchecked use is not only a data problem but also a competency problem.
Managing instead of banning
In this picture a complete ban may look attractive, but the Gartner data shows that a ban does not end use on its own. Gartner's recommendation falls under three headings: a clear tool-use policy across the organization, regular audits of unapproved use, and adding generative AI risk to software-as-a-service (SaaS) evaluation processes.
The steps below are a general framework derived from these recommendations and from the implementation suggestions in the NIST profile. The NIST framework is intended for voluntary use; each organization needs to adapt it to its own scale, sector and regulatory obligations.
- Build an inventory. The NIST profile recommends that the organization's generative AI systems be included in the AI inventory. You can start with a short, non-accusatory survey asking employees which tools they use, for which tasks and with which account. AI features added inside your existing software should also go on this list; we covered this topic separately in our article on embedded AI.
- Enrich the inventory record. According to NIST, the record can include human oversight roles, special considerations relating to the personal, confidential or sensitive data being processed, and the version of the underlying foundation model used together with its access mode. Assigning a business-unit owner to each tool makes it easier to keep the record current.
- Publish an approved tool list and acceptable-use rules. The NIST profile recommends establishing transparent acceptable use policies for generative AI. It is practical to build the list in three tiers: tools that can be used freely, tools approved for specific tasks, and tools that should not be used. When no approved option is offered, employees become more likely to turn to a tool they found themselves.
- Apply the rules to external stakeholders too. NIST recommends that usage policies be updated to also cover contractors, consultants and other third-party personnel. Everyone who works on the organization's behalf should be subject to the same rule.
- Provide role-based training. Training should not stop at how to use the tool; it should also explain what information must not be entered into it, how to verify the output and where human judgment is indispensable. Gartner recommends determining in which tasks human judgment is required.
- Monitor usage and audit regularly. The NIST profile recommends monitoring deployed generative AI systems, particularly for incorrect content and cyber risks. Usage reports from approved tools and periodic checks of unapproved-tool traffic can be considered together. The purpose of monitoring should not be to punish, but to update the list according to real needs.
- Define the incident-reporting path. NIST recommends establishing roles, policies and procedures for communicating incidents arising from generative AI to the relevant people. Whom an employee who has accidentally entered confidential information should notify, and within what time, must be written down in advance; staying silent makes the problem worse.
Conclusion
The TÜİK data shows that generative AI has become a widespread individual habit in Türkiye within a year, and that a significant share of those who use it also use it at work. While organizations act cautiously out of legal and data protection concerns, employees' use continues. The first step is therefore not a ban but visibility: an inventory, an approved tool list, training and monitoring. When these four elements are in place together, the tools employees already use can turn into an auditable source of productivity.
From Orient Global's perspective, for most organizations a sound starting point is a short usage inventory and a three-tier tool list.
Why logistics experience matters here. Anyone who has run a warehouse knows that you cannot manage stock you have not counted, and the same logic applies to AI tools: the inventory comes first, followed by an approved list, role-based training, routine audits and a written escalation path, which are controls that logistics operations run on every day. One of Orient Global's consultants is a senior executive with more than 30 years in operations, logistics and supply chain, including managing nationwide warehouse and transport operations and building and leading teams of 100+ people. An industrial engineer, he now brings that supply-chain discipline to SMEs through AI and automation. Meet our consultants.
This article is for general information purposes only and is not a substitute for legal advice.
#interimmanagement #forwarddeployedengineering