‘No single control catches every scam or every mistake, so it’s essential for employees to understand how their actions can affect the organization’
Years into the explosion of artificial intelligence among workplaces, far too many workers are still using the technology without proper training from employers – exposing organizations to multiple risks, according to a recent report.
Nearly half of Canadian office workers say their employer has never shown them how to use AI safely at work. Cybersecurity specialists warn that this gap in AI training leaves organizations open to data leaks and AI-enabled fraud.
Of 1,042 Canadian office workers surveyed by Angus Reid Forum on behalf of ISA Cybersecurity, 48% said they had received no such guidance.
“Canadian workers have adopted AI faster than their employers can enable and train them to use it safely,” said Andrew Buckles, executive vice-president, services, at ISA Cybersecurity.
Why the AI training gap matters to employers
The data shows how fast that adoption is moving. Nearly half of respondents (47%) use AI tools for work at least a few times a week. In the past year, 71% increased their use, and 39% use free or personal accounts on the job.
Those personal accounts are the first exposure Buckles identified. “When an employee pastes confidential client information into a free AI tool, the company loses sight of where that data goes, who can access it, and how long it’s kept,” he said. “Security teams can’t protect data they can’t see.”
The second risk sits inside approved tools, which can inherit an employee’s full access rights. “If an employee can reach more data than their role requires, so can the AI assistant working on their behalf,” Buckles said. Yet only half of respondents said their employer has a clear AI-use policy.
Other research shows a similar shortfall
The training gap is not new. The 2026 TD AI Insights Report, conducted by Ipsos among 2,501 Canadian adults in February 2026, found that only 37% report receiving adequate employer-provided AI training on how to use AI tools at work.
The same report found that nearly one in three (32%) admit they have exaggerated their AI skills to colleagues. HRD has previously reported on how the AI skills gap in Canada widens as worker confidence lags. We have also covered why personal AI use at work poses new governance risks for HR.
Workers want employers to act. The Harris Poll surveyed Canadian job seekers for Express Employment Professionals in November 2025, and the results were released in April 2026. In that survey, 79% of Canadian job seekers said companies need to formally train employees on how to use AI, rather than expecting them to learn on their own.
What should AI training cover?
Lewis Curley, a partner in the people and change practice at KPMG in Canada in Toronto, spelled out the stakes in November 2024. “If organizations don’t implement guardrails and provide training around generative AI use, employees could inadvertently enter sensitive company data into generative AI tools, causing risks for their employers,” he said.
Guardrails start with access. The Canadian Centre for Cyber Security (Cyber Centre) co-authored joint guidance published May 1, 2026. It states that agentic AI systems should be deployed only for defined, low-risk and non-sensitive tasks, with least-privilege access controls and human oversight. The guidance shows why tighter controls over AI systems are needed to stop data exposure.
Training then fills the gaps that controls leave. Buckles recommended teaching staff to:
-
verify requests for money or data through trusted channels
-
check which tools can handle which data
-
treat alerts that appear only in AI summaries as unverified
-
report mistakes quickly
“But no single control catches every scam or every mistake, so it’s essential for employees to understand how their actions can affect the organization,” he said. With 70% of respondents expecting AI-enabled scams to rise, the window to act is narrowing.
