70% of employees already use AI with no training: the real risk isn't the usage

68% of French employees already use AI tools in their work. At the same time, 70% of them have received no training on the topic, and only 32% say they were trained by their employer. These figures come from a Cegos survey conducted in 2026 among more than six thousand respondents across eleven countries. The gap between the two figures describes a precise situation, AI usage has outpaced, widely and quickly, companies' ability to put a framework around it.

This gap deserves a careful reading, because the problem is not the usage itself. An employee using AI to draft an email or summarize a document saves time, with no particular issue arising from that. The problem is the absence of guardrails to tell what is harmless apart from what is not. An employee left to their own devices decides alone, often without realizing it, what they can enter into a consumer tool, a contract excerpt, customer data, an internal confidential document, and how much trust to place in the output before reusing it as is.

This situation is partly explained by a tight talent market. AI skills have become, for the first time, the most sought-after and hardest to recruit worldwide, ahead of traditional engineering skills, according to a ManpowerGroup study published in 2026. An SMB trying to close this gap through hiring alone would run into a widespread shortage. Training the teams already in place remains, in this context, the most realistic and fastest option to implement.

Training an entire company at once is neither necessary nor effective. The most useful priority is identifying, first, the employees already using AI with no defined framework, a short anonymous internal survey is usually enough to spot them, simply asking which tools are used, for what purposes, and whether any guidance has been given on the topic. The gap revealed by that survey is almost always wider than what leadership imagined beforehand.

A catch-up training does not need to be exhaustive to have an immediate effect. Three elements are enough for a solid first level, what should never be entered into a consumer AI tool, customer data, confidential information, documents under a non-disclosure agreement, how to check a result's reliability before reusing it without review, and who to contact internally when in doubt about a particular use. This minimal foundation does not replace an in-depth, job-specific training, but it closes the most immediate risk window in the meantime.

The stakes go beyond productivity alone. An employee who shares confidential data with a consumer AI tool, with no data processing agreement between the company and the tool's publisher, potentially puts their employer in a GDPR non-compliance position, often with leadership entirely unaware of it. This legal risk exists independently of the quality of the work AI itself produces, it stems solely from the absence of a framework around what can or cannot pass through these tools.

This situation is not unique to large companies, it affects SMBs even more, whose HR or IT teams often have neither the time nor the explicit mandate to look into this topic outside a formally launched AI project. This is precisely why the gap between usage and training has stayed invisible for so long in most small structures, no one was officially tasked with measuring it.

It sits at the interplay between two steps, the inventory, which reveals the real gap between AI uses already present in the company and the existing level of framing, and change management, which then plans job-specific training to close that gap. Waiting for a complete training plan before acting means letting one more week of unframed usage slip by. A five-business-day diagnostic pinpoints exactly where this gap sits in your company.