Your Staff Already Use Generative AI. Make It Official.

Your staff are very probably using generative AI for work more than your organisation is. In 2025, 37.1% of Dutch working people used a generative AI tool for their job, while 16.3% of Dutch companies ran AI that generates text, speech or code, according to our analysis of Eurostat data. That gap is good news: it is demand you no longer have to create. The task is to give it a sanctioned tool, clear data rules and training, so shadow AI becomes an advantage you can see and audit.

This post is for the IT manager, CIO, informatiemanager or security officer at a Dutch or Flemish organisation of 250 to 5,000 FTE who has to turn that demand into something governed. Crux Digits designs and builds AI systems alongside your ICT partner or internal IT team; we do not run your tenant, licences or helpdesk.

Do your staff already use generative AI more than your organisation does?

Almost certainly: in every one of the 27 EU member states, more working people use generative AI for work than there are companies running text-generating AI.

Across the EU the figures are 21.8% of working people against 8.8% of companies, a gap of 13.0 percentage points. In the Netherlands the gap is 20.8 points: 37.1% of workers against 16.3% of companies, a company figure Eurostat flags as a break in series. Belgium is at 32.7% of workers and Germany at 20.8%. The people figures come from Eurostat table isoc_ai_iaiu, the first year Eurostat asked individuals about generative AI; the ranks and gaps are our own calculation, set out in full in the study.

A worked example, labelled as such: an organisation of 1,200 people at the Dutch national rate would have about 445 staff using generative AI for work. That is arithmetic on a national average (37.1% of 1,200), not a measurement. Your own share depends on sector, age profile and role mix, which is why the first move below is to measure it.

Why is staff use of generative AI good news for an IT department?

Because staff have already shown which tasks benefit: in the Netherlands 59.4% of everyone who uses generative AI uses it for work, the second highest share in the EU.

Most AI programmes struggle with adoption. Yours has the opposite starting position. Dutch people use generative AI for work almost as often as privately (26.6% against 28.1% of everyone aged 16 to 74), the closest balance in the EU. In most countries the tools arrived as a personal habit and are moving into work; in the Netherlands they are already there.

Larger organisations also start ahead. Across the EU, 31.7% of companies with 250 or more persons employed run text-generating AI, above the 21.8% worker rate. Large Belgian companies are at 53.4%, third in the EU, and large Dutch ones at 41.8%. If you already license a governed tool, the work is not to introduce AI. It is to move the use you cannot see onto the tool you can.

What is the real risk of unsanctioned generative AI use?

The risk is personal data leaving your control: the Autoriteit Persoonsgegevens has received data breach notifications caused by employees pasting patient and customer data into AI chatbots.

In its August 2024 warning, the Dutch DPA describes a GP practice employee who entered patients' medical data into a chatbot against the agreements made, and a telecom employee who entered a file with customer addresses. The AP draws a distinction that matters for policy. When employees use a chatbot on their own initiative and against the employer's agreements and enter personal data, that is a data breach. When chatbot use is the organisation's own policy, it is not a breach, but it is often not permitted by law. Organisations need to prevent both.

The AP's remedy is practical, not prohibitive: make clear agreements about whether chatbots may be used, state which data may and may not be entered, and consider arranging with the provider that entered data is not stored. When a leak happens anyway, notifying the AP and the people affected is mandatory in many cases. Read that as a design brief for a sanctioned tool, not as a reason to ban one.

What should a CIO do about it in the next twelve months?

Five moves, each tied to a finding: measure your gap, sanction one tool, write the data rule, train by role outside IT, and build on your own documents.

1. Measure your own gap. Finding: staff use runs 13.0 points ahead of company adoption across the EU. Ask your staff the Eurostat question: did you use a generative AI tool for work in the last three months? Then ask your ICT partner for the technical view. In a Microsoft estate, the cloud app catalog in Defender for Cloud Apps has a Generative AI category that lists the AI apps in use with a risk score per app. The difference between the survey, the discovery report and your licences is your own gap.

2. Sanction one default tool. Finding: large companies already lead, at 41.8% in the Netherlands and 53.4% in Belgium for text-generating AI. Pick one tool your ICT partner administers and your security officer can review, check the provider's retention terms against the AP's advice, and announce it as the place for work use. A sanctioned tool that is easy to reach removes most of the reason to use another.

3. Write a one-page data rule, and educate before you block. Finding: the AP distinguishes use against the agreements from use under policy, so the agreements must exist. State which data classes may go in (public, internal) and which may not (personal data of customers, patients or staff, unless the tool is approved for it). Microsoft documents that an app tagged Unsanctioned is blocked on devices onboarded to Defender for Endpoint, and that a security team can choose to warn and educate users instead. Start with the warning; it redirects people to the sanctioned tool rather than pushing them to a private phone.

4. Train by role, starting outside IT. Finding: in the Netherlands 60.0% of ICT professionals use generative AI for work, against 43.0% in other non-manual occupations and 9.2% in manual ones. People aged 25 to 64 with higher education use it four times as often as those with low formal education (49.2% against 12.4%). The largest unused room sits in frontline, manual and older groups, who are least likely to teach themselves. Training there also documents your measures under the AI Act's literacy article.

5. Build on your own documents for the tasks that recur. Finding: most Dutch users already use generative AI for work tasks. The questions that come back every week (a procedure, a contract clause, a product specification) are better answered from your own sources than from a public chatbot. A private AI assistant answers only from your documents, shows its source every time, and runs where your data already lives.

What does the AI Act ask of you on staff use?

Article 4 requires deployers to take measures to support the AI literacy of their staff, without guaranteeing any individual's level of literacy.

Article 4 was rewritten by the Digital Omnibus on AI. The current text asks providers and deployers to take measures to support AI literacy of staff and others operating AI on their behalf, taking into account their knowledge, experience, training and the context of use, and states that this does not require guaranteeing a specific level for any individual. Under Article 113, Chapter I, which contains Article 4, has applied since 2 February 2025. A sanctioned tool, a written data rule and role-based training are exactly the kind of measures that sentence describes, and they are easy to evidence in an audit.

What could 2027 look like if staff use keeps leading?

Nobody can put a number on it: 2025 is the first year of Eurostat's individuals table, so there is no trend yet.

What we can say is what is already in the data. The incoming workforce is at home with these tools: 63.8% of EU 16 to 24 year olds used generative AI in 2025, the highest share of any age group. Every intake of graduates and trainees will bring that habit with them. And on 2 December 2027, the AI Act's obligations for high-risk systems under Annex III start to apply, which includes AI used for recruitment and for decisions on work-related relationships. An organisation that has its sanctioned tools, data rules and AI register in place by then meets that date from a position of control.

The positive scenario is within reach of any IT department that acts this year: the measured gap shrinks because staff moved to the sanctioned tool, not because they stopped using AI. You can check that in your own next survey.

Where does Crux Digits fit?

Crux Digits designs and builds AI systems and the software around them, alongside your ICT partner or internal IT team.

We are not an ICT partner. We do not administer your Microsoft 365 tenant, your Defender policies or your licences; your ICT partner does. Where staff use has run ahead of the organisation, we help turn the recurring tasks into governed systems on your own documents and processes, with the evidence your security officer needs, and we hand over code you own. The people side, from role-based training to the literacy measures under Article 4, is on our page on AI training for companies.

Last updated: 28 October 2026.

Frequently asked questions