An October for Safe AI in Operations

October is Security Month

The European Cybersecurity Month has taken place every October since 2012. It is coordinated by the EU agency ENISA. At this year’s launch event on September 25 in Luxembourg, the focus was on the human factor.

For small and medium-sized enterprises, it is worth examining a habit that has long since become part of everyday office life. Someone needs to quickly draft a proposal or summarize a lengthy set of minutes. To do so, they open the AI ​​assistant they use for personal tasks on their mobile phone. Experts call this "shadow AI" because its use bypasses the company’s official systems.

When rules are missing

A survey of 795 professionals conducted by Tieto Austria and TQS Research & Consulting reveals just how widespread this practice is. According to the findings, 17 percent use AI at work without their employer’s knowledge. Only 23 percent work exclusively with company-approved tools. Just under a quarter avoid AI altogether because their organizations lack clear guidelines.
This lack of rules creates a twofold hindrance: one segment of the workforce operates covertly, while another steers clear of these new possibilities entirely. Both approaches come at a cost. In the first scenario, customer names, prices, and internal figures end up on servers outside the company's control. In the second, opportunities to easily save time go unutilized.

What the Krems study measures

At IMC Krems, a team led by Professor Michael Bartz surveyed office workers across Austria about their experiences with generative AI—referring to programs like ChatGPT or Perplexity that generate text and organize information upon request. The survey was conducted in the second half of 2025; 1,196 people participated, and 1,016 valid responses were analyzed.

The results can be expressed in terms of hours. Around one-fifth of users save between 10 and 20 percent of their working time each week. Based on a 40-hour workweek, this equates to four to eight hours—or half a day to a full day of work. Yet, most are only just getting started: nearly 70 percent have less than a year of experience with AI, and fewer than 30 percent use it daily. The research team estimates that companies are currently realizing barely a third of the potential time savings. "Generative AI is already making a measurable contribution to productivity today," says Bartz.

Most of the time saved is reinvested into work. According to the study, 64 percent of respondents answer inquiries faster, and 63 percent complete more tasks per day. Just over half use the time gained for more demanding activities. AI most frequently assists with revising and summarizing texts, conducting research, translating, and organizing information.

Why Approved Tools Matter

The study also examines the factors that determine success within an organization. Managers and colleagues who visibly use AI in their daily work—and inspire others to do the same—play a major role. Approved tools and clear guidelines are equally important. If a suitable solution is lacking within the company, employees are more likely to turn to personal or unauthorized applications.

This presents a clear task for organizations. Simply banning tools without offering an alternative rarely works, as work still needs to be completed on schedule. Providing a corporate account with clear ground rules brings usage out into the open. Only then can management see where time is being saved and strategically expand those areas.

Three steps for your business

First, openly ask which AI programs are already being used by your team. Asking this without assigning blame elicits honest answers and reveals where the needs lie.

Next, authorize the use of an AI assistant with a corporate account. Ensure that the provider does not use your inputs to train its AI.

Finally, create a one-page document outlining which information is off-limits—such as customer names, health data, or passwords. Also, designate a team member to answer questions and share successful use cases. This also helps meet a requirement in effect since February 2025: under the EU AI Act, companies using AI must ensure their employees possess sufficient AI literacy.

The contact person for the study is Michael Bartz (michael.bartz@imc.ac.at).