Employees use personal AI accounts for work, study finds

Harmonic Security has published research showing that employees use personal AI accounts for work 64.5% of the time. It also found that 45.6% of personal AI activity takes place on enterprise plans paid for by employers.

The findings are based on an analysis of 1,935,247 classified AI-session minutes across ChatGPT, Claude, Google Gemini, Microsoft Copilot, Perplexity and DeepSeek. The data suggests employees carry out the same kinds of tasks on whichever AI tool is open, rather than choosing a platform based on the nature of the work.

Across all recorded activity, 74.6% of AI use at work had a clear business purpose. Task distribution was similar across all six tools: 47% of AI time was devoted to efficiency and automation, 20% to decision support, 20% to risk and compliance, 7% to revenue and growth, and 6% to innovation.

The figures point to a blurred line between personal and corporate AI use inside organisations. While many employers have introduced licensed AI tools for staff, the research suggests workers continue to move between free, paid and enterprise accounts with little distinction between business and personal settings.

Department split

AI use was not spread evenly across departments. Legal and governance teams accounted for 19.5% of all AI hours, making them the heaviest users in the dataset, and 81% of that activity took place within enterprise plans.

Commercial and operational teams showed a different pattern. Go-to-market functions represented 17.5% of AI minutes, but only 39% of that activity ran through enterprise plans. Operations teams used enterprise plans for just 18% of their AI activity.

The study points to a visibility gap for employers, particularly in sales and marketing roles, where staff may be preparing proposals or conducting competitive research through accounts outside company oversight. It also suggests the risk profile varies by function, with regulated or compliance-heavy teams more likely to stay within managed environments than customer-facing or operational groups.

Session length offered another view of how different tools are used. Claude recorded average sessions of 10 minutes and 12 seconds per task, compared with 5 minutes and 53 seconds for ChatGPT, a gap of 73%.

That matters, Harmonic Security said, because usage minutes may reveal more about potential data exposure than a simple count of prompts or queries. A single long session, such as a contract review, can involve substantially more pasted material and business context than a brief request, even though both might appear as one event in a standard dashboard.

The research also highlighted the issue of data portability when staff use free or personal accounts for work tasks. If an employee leaves, business material embedded in that person's AI history may leave with them, including contracts, strategy documents or deal information stored in accounts the employer neither owns nor controls.

The analysis covered a trailing seven-week period ending in April and classified each AI conversation as personal, business or ambiguous using a large-language-model classifier trained on enterprise AI usage patterns. Plan tiers were identified from account metadata supplied through enterprise reporting interfaces from the relevant AI platforms.

The dataset included ChatGPT Free, Plus, Enterprise and Guest; Claude Free, Pro and Enterprise; Gemini Free, Pro and Business; Microsoft Copilot Free, Pro and M365; as well as DeepSeek and Perplexity.

Alastair Paterson, chief executive officer and co-founder of Harmonic Security, said the results point to a major blind spot for companies trying to manage AI adoption. "Every organization is pouring money into AI right now, and almost none of them know what their people are actually doing with it. This is the first cross-platform analysis of AI use cases at scale, across personal and enterprise accounts together. It is the first genuine look at how AI is actually being used at work," Paterson said.