So Now We’re Uploading PII to AI?
A July 2026 research report from Zapier found that 79% of workers have entered sensitive info like PII!, trade secrets, and login credentials into AI; and a full 50% of employees ignore their workplace’s AI restrictions. Remember when marketers had to fight to get a Buffer
Zapier interviewed 1,005 U.S. workers at companies with 500 or more employees to understand how business data is being handled in the age of AI.
July 2026 research findings from Zapier concluded that “79% of workers have shared sensitive info like logins with AI.”
Take that in for a sec. Logins, financials, PII, client data all into AI; and 50% of workers have ignored their workspace's AI restrictions. Yikes. Some will argue the problem lies with companies that keep tools from employees that would speed up whatever they’re working on. Sure that’s true, it’s an easy argument to make.
My bigger concern is the risk posed by employees not having the criteria or judgement to understand that sharing PII, confidential client financial data, or logins is dangerous. AI exists to keep you engaged and learn from you, that’s why all of your ideas are good ideas when it comes to your conversations with a chatbot or an LLM. This isn’t necessarily a challenge around systems thinking but instead critical thinking and data governance.
Key findings from Zapier:
31% of workers say they enter login credentials or API keys into AI
50% of workers have ignored their workplace's AI restrictions
36% of workers aren't fully confident they know what's ok to share with AI
Data Governance
Marketers have been in data governance jail for years—rightly so—to ensure we sunset contacts who haven’t engaged with our emails or SMS, to not email those who haven’t explicitly double-opted into the email campaign we’ve crafted, to understand the email rules in the EU, and more.
Employees, their rogue AI use, and data transgressions is astounding. I can still recall the now-naive conversations I had with corporate IT re data security in 2000 when I was approved to sync my Palm Pilot 3e to my Outlook calendar, contacts, and my Office Docs using Docs2Go and a serial cable. It was another time, but the kernel at the center of the risk is the same: how do we ensure that proprietary data doesn’t get into a competitor’s hands?
Yeesh. I would imagine that employees of companies with 500 or more FTEs are under NDA or MSA that probably, probably, probably limits their usage of client data.
Back in the early aughts, IT departments made a shift from a focus on teaching to one of control. I remember when internal IT departments that would set-up new PCs and hold sessions on how the new OS or office suite worked.
It seems like that posture shifted with the advent of streaming, where these same teams were called into figure out why expensive on-prem servers didn’t have enough capacity for the Access databases and folders filled with spreadsheets, only to learn that employees had dropped huge volumes of downloaded music Mp3s and, worse still, video on downloaded Mp4s. The Mp4s were bad news: finding a collection of pirated movies on a server would get the in-house counsel, and if one was really unlucky, a nasty letter in the mail from Sony Pictures or MGM.
Looking back, those problems seem quaint next to the sharing of PII, logins, and confidential data with AI. The risk is certainly greater today than it was when companies were worried about their teams sharing and storing feature-length films on department servers. (I see you former colleagues who stored their music and movies on other departments servers!)
What can you do?
As you push your teams to use AI to drive toward bigger, better, faster, more, it's critical to pair governance with training on tools and access.
About James Burdine.
James is a successful marketing leader, strategist, and craftsman who blends proven growth strategies and voice of the customer insights to drive sales and build brands for companies that demand results.
Bishop Linville
Bishop Linville helps leadership teams understand their customers, articulate what makes them different, and build brands and names that accelerate growth.
