How Organizations Are Giving Employees AI: Efficiently and Safely (2025–2026)

TL;DR#

• The winning pattern is "buy, don't build, and channel everyone through a sanctioned front door." Most enterprises now provide AI through per-seat enterprise SaaS (Microsoft 365 Copilot, ChatGPT Enterprise/Business, Claude, bundled Gemini) for breadth, plus governed cloud-API access (Azure OpenAI, AWS Bedrock, Google Vertex) behind an internal gateway for custom apps. A sanctioned tool with contractual no-training/zero-retention terms is itself the primary security control against rampant "shadow AI."
• Cost efficiency comes from tiering and consumption discipline, not from picking one vendor. Put power users on premium seats, everyone else on cheaper pooled/consumption access; right-size models (route cheap queries to small models); and use prompt caching (Anthropic bills cache reads at ~10% of the standard input rate, i.e. 90% off), batch APIs (~50% off) and model routing (40–70% savings). Self-hosting open-weight models rarely "pencils out" below very high, sustained token volumes.
• Data protection is mostly contractual + configuration, not model choice. All major commercial tiers already contractually promise no-training-on-your-data; the real work is buying the right tier (ZDR/BAA where needed), fixing permission "oversharing" before switching on enterprise search, and layering DLP/CASB and AI-specific governance (Purview, Netskope, Zscaler, Prompt Security/Witness AI) plus policy, so the biggest risk (unsanctioned use) shrinks.

Key Findings#

1. Shadow AI is the dominant risk and the core reason to provide a sanctioned tool. Surveys consistently find the large majority of employees already use AI at work, much of it unsanctioned: an IBM-sponsored study found 80% of US office workers use AI but only 22% rely solely on employer tools; WalkMe found 78% use unapproved AI; UpGuard found 81% of employees and 88% of security leaders use unapproved AI tools. Verizon's 2026 Data Breach Investigations Report states that "Shadow AI is now the third most common non-malicious insider action detected in our data loss prevention (DLP) dataset in 2025, a fourfold increase in percentage from the previous year," with regular AI use on corporate devices jumping from 15% to 45%, 67% of that use going through non-corporate accounts, and source code the most common data type uploaded (across 858,440 DLP events analyzed). Providing an approved tool with monitoring is the single most effective control.

2. Enterprise spend is exploding but ROI measurement lags. Menlo Ventures' 2025 State of Generative AI in the Enterprise (Dec 9, 2025, survey of ~500 US decision-makers) found "enterprise AI investment tripled in a single year, from $11.5 billion to $37 billion," a 3.2x increase up from just $1.7B in 2023. Coding/developer tools accounted for $7.3B of that and general-purpose copilots for $8.4B. The Federal Reserve Bank of Atlanta's May 2026 Policy Hub reports firms "spent $1,358 per employee in 2025 and are anticipated to increase spending this year to $2,068 per employee"; cross-industry benchmarks put financial services near $3,200/employee. Yet 86% of enterprises plan to increase AI budgets while only 45% can quantify their AI ROI, and MIT NANDA's "GenAI Divide" report found 95% of enterprise GenAI pilots delivered no measurable P&L impact.

3. Deployment models are complementary, not either/or. Big enterprises (JPMorgan, TELUS) build an internal gateway/portal that fronts multiple providers; regulated firms (Moody's, Novo Nordisk, Mayo Clinic) run custom apps on hyperscaler APIs inside their own tenancy; nearly everyone also buys SaaS seats for general productivity.

4. The permission/"oversharing" problem is the sleeper governance issue. Copilot-style enterprise search respects existing permissions but surfaces content users technically could access but never should, making latent permission sprawl suddenly exploitable. Decryption Digest Fixing permissions and sensitivity labels before rollout is essential.

5. Agents/MCP introduce a new risk class. Prompt injection, tool poisoning, and non-human identity sprawl are now real, documented enterprise incidents, Checkmarx requiring agent-specific governance (least privilege, tool allowlists, human-in-the-loop).

Details#

1. Deployment models and tradeoffs#

A) Enterprise SaaS seats (fastest, lowest effort, breadth).

• Microsoft 365 Copilot: historically $30/user/month (annual) as an add-on to M365. In 2026 Microsoft restructured: a "Microsoft 365 Copilot for Business" tier listed at a promotional $18/user/month (standard $21). Data protection is Copilot's strong suit for Microsoft shops: it honors existing M365 permissions and Purview sensitivity labels, keeps data in the tenant/compliance boundary, does not train foundation models on tenant data, and provides audit logs. Adoption has been mixed: one analysis reported Copilot's US paid-subscriber share fell from 18.8% (July 2025) to 11.5% (Jan 2026), Tech Insider and Microsoft added consumption-based "Copilot Chat" in Jan 2025 to address resistance to the flat $30 seat. Samexpert
• ChatGPT Enterprise: quote-only; 2026 procurement reports converge on $45–75/seat/month ($60 typical), a ~150-seat minimum, annual prepay, implying a ~$108,000/year floor; large (5,000+ seat) deals fall toward ~$40. ChatGPT Business is $20/user/month annual (cut $5 on April 2, 2026), 2-seat minimum, but no HIPAA BAA (Enterprise required). Enterprise adds SSO/SCIM, EKM (bring-your-own-keys), data residency across ~10 regions, a Compliance API, SOC 2 Type 2, ISO 27001, and no-training-by-default. ZDR available via API.
• Claude (Anthropic): Team ~$25/seat/month (annual, 20-seat floor for the sales-assisted enterprise path); Enterprise is quote-based (reference deals ~$30–35/seat at 500+ seats). IntuitionLabs Anthropic holds SOC 2 Type I/II, ISO 27001:2022, and was among the first to earn ISO/IEC 42001:2023 (Jan 2025). No training on commercial data by default; API data auto-deleted within 30 days; Layer3Labs ZDR available via a security addendum (and for Claude Code on Enterprise via separate enablement). HIPAA BAA available.
• Google Gemini for Workspace: Google discontinued standalone Gemini add-ons ($20/$30) in March 2025 and bundled Gemini into Workspace plans (~$7 Starter, ~$14 Standard, ~$22 Plus per user/month, annual); the catch is you pay for everyone on the plan with no per-user cost toggle. No training on Workspace data; data stays in the customer boundary; retention configurable (90/540/1,080 days or indefinite); Enterprise Plus adds DLP over Gemini output. A separate "Gemini Enterprise" agent platform (launched Oct 2025) starts ~$21/seat. GoSearch

B) Cloud API via hyperscalers (control + residency, more effort). Azure OpenAI (in Azure AI Foundry), AWS Bedrock, and Google Vertex AI all contractually commit that prompts/responses do not train foundation models, Technologymatch and support private networking (VNet/PrivateLink/VPC endpoints), customer-managed keys (CMEK/BYOK), and regional residency. FedRAMP High is the deciding filter for US government: Bedrock and Azure qualify; Vertex generally does not yet. All three support HIPAA with private endpoints (clinical pipelines often route Claude through Bedrock's VPC endpoint so PHI never traverses the public internet). Choice usually follows existing cloud footprint; model-quality gaps between platforms are small (5–15%), so compliance, residency, pricing, and integration drive the decision.

C) Internal gateway / LLM proxy (central control at scale). Companies front multiple providers with a gateway: LiteLLM (open-source, MIT; enterprise tier ~$250/mo to ~$30k/yr adds SSO/RBAC/audit and PII masking via Presidio), Portkey (managed; semantic caching cited at 30–50% savings; Atlan Palo Alto Networks acquired it May 2026 into Prisma AIRS), Kong AI Gateway, Cloudflare AI Gateway, plus OpenWebUI/LibreChat chat UIs. Gateways deliver virtual keys, per-team budgets/hard caps, spend attribution/chargeback, request logging, LiteLLM PII redaction, and guardrails (jailbreak/prompt-injection filters, secret-hiding). Caveat: a March 2026 LiteLLM supply-chain incident (malicious PyPI package v1.82.7–1.82.8, removed within ~40 minutes) is a reminder to pin versions and use air-gapped/pinned installs.

D) Self-hosted / open-weight (Llama, Mistral, Qwen, DeepSeek, gpt-oss). Economics rarely favor self-hosting except at very high sustained volume or where data rules forbid external processing. Break-even estimates vary widely by comparison point: roughly 5–10M tokens/month vs premium frontier APIs, Aipricingmaster but against budget open-weight APIs (e.g., ~$0.14–0.50/M tokens) the crossover runs into billions of tokens/month. Utilization is the killer variable: at ~10% GPU utilization, real cost/token can run ~10x the headline rate, and hidden ops/DevOps costs add a 3–5x multiplier, plus re-quantization/testing/redeploy cycles (~3–4 weeks, ~$12k engineering time) every model update. (Hugging Face moved Text Generation Inference to maintenance mode Dec 2025; vLLM/SGLang are the 2026 serving stack.) A useful formula: break-even tokens ≈ GPU monthly cost ÷ blended API price/token.

E) Hybrid / model routing. Route by difficulty: cheap/small models for classification/summarization/routing, frontier models for hard reasoning. Cited savings 40–70% from routing alone; Morph combined with caching/batching/output control, teams report 60–85% total reductions (e.g., RouteLLM showed ~85% cost reduction at ~95% quality).

F) Coding assistants. GitHub Copilot Enterprise $39/user/month (moved to token-metered "AI Credits" billing June 1, 2026; code completions stay unlimited), with IP indemnification, SOC 2 Type II, content exclusion, and enterprise zero-retention. Cursor ~$40/user/month (Standard) with Privacy Mode/ZDR and SOC 2 Type II. Claude Code is HIPAA-ready with ZDR on Enterprise (separate enablement). Tabnine uniquely offers self-hosted/air-gapped ZDR ($39/user/month, enterprise-only). Coding is the breakout enterprise use case: Menlo put coding/dev tools at $7.3B of 2025 spend, and GitHub Copilot reached ~26M users by October 2025.

2. Cost management in practice#

• Right-size seats and tier the rollout. Seat sprawl and low utilization are the top waste sources; put power users on premium seats and everyone else on cheaper pooled/consumption access. Bundled models (Gemini in Workspace) mean you pay for idle users, which is a reason to scrutinize SKU mix. Note the duplication problem: ~34% of shadow-AI spend duplicates tools the company already pays for.
• Seat vs consumption. Seat pricing is predictable and simple; consumption (token) pricing is cheaper for spiky/low-frequency users and lets you meter. Microsoft's Copilot Chat (consumption) and Anthropic's Enterprise shift toward a base seat plus usage-based token billing reflect this.
• Concrete cost levers. Prompt caching (Anthropic cuts cached reads by ~90%, e.g. Claude Sonnet input dropping from $3.00/M to $0.30/M; OpenAI's automatic caching 50–80% off prompts of 1,024+ tokens), Batch API (~50% off), model routing, output-length control (max_tokens; output tokens cost 4–6x input), context compaction. Stacking these commonly yields 60–85% reductions (e.g., a documented $15,000/mo bill cut ~76% without changing models).
• Watch runaway consumption. One report cited Uber's 6,500 engineers exhausting the 2026 AI budget in four months at $500–$2,000/engineer/month, which argues for hard per-team budget caps at the gateway.

3. Data protection and governance#

• Contractual controls: no-training clauses (default on all commercial tiers), Layer3Labs zero-data-retention addenda, DPAs/SCCs, sub-processor terms, regional/EU residency, HIPAA BAAs. Buy the right tier: free/consumer tiers are where training happens.
• Technical controls: private networking, CMEK/BYOK, PII/secret redaction at the gateway, and DLP/CASB coverage of AI apps. Vendors include Microsoft Purview, Netskope One (DLP with 3,000+ classifiers + AI Guardrails, and a Cloud Confidence Index risk-rating 1,800+ GenAI apps), Zscaler, Nightfall, Prompt Security, and Witness AI (redaction + audit trails, including MCP/tool-call coverage).
• The oversharing problem. Microsoft and Gartner frame this as AI making latent permission errors "visible and actionable at scale"; Gartner projects that by 2027, 60% of businesses will fail to realize anticipated AI value due to incohesive data frameworks. Documented incidents include "EchoLeak" (CVE-2025-32711, a zero-click Copilot exfiltration chain) and a Copilot bug (CW1226324) that summarized labeled-confidential emails, bypassing DLP for a window. Remediation before rollout: SharePoint Advanced Management oversharing assessment, remove broad "Everyone-except-external-users" grants, apply sensitivity labels (Highly Confidential labels can block Copilot summarization), and start with least-privilege pilots on low-risk sites.
• Agent/MCP risks. Prompt injection, tool poisoning, confused-deputy failures, and non-human identity sprawl. A 2026 disclosure reportedly exposed up to 200,000 vulnerable MCP instances; CVEs hit Cursor (CVE-2026-22708), core MCP infra (CVE-2025-6514, CVSS 9.6), and Anthropic's own Git MCP server. Endor Labs found 82% of 2,614 MCP implementations use file operations prone to path traversal. One survey found 88% of organizations reported confirmed/suspected AI-agent incidents while 82% of executives believed existing policies protected them. Controls: agent inventory, tool allowlists, scoped/incremental consent, mandatory auth for remote MCP servers, network segmentation, tamper-resistant logging, and human-in-the-loop for consequential actions.
• Regulatory frame. EU AI Act: GPAI-model obligations live since Aug 2, 2025 (technical documentation, copyright policy, training-data summary); high-risk-system obligations and all financial penalties from Aug 2, 2026; full application (AI embedded in regulated products) Aug 2, 2027. Penalties up to €35M or 7% of global turnover for prohibited practices, €15M/3% for high-risk non-compliance. The Act has extraterritorial reach (like GDPR). Add GDPR, sector rules (HIPAA, FINRA/SEC), and voluntary frameworks ISO 42001 and NIST AI RMF (with NIST's AI Agent Standards Initiative launched Feb 2026), backed by internal AI acceptable-use policies.

4. Practical rollout patterns#

• Staged rollout: pilot cohort → measure → expand. MIT found large enterprises take ~9 months to scale vs ~90 days for mid-market; the successful 5% scope tightly, target high-value workflows, and partner externally. Per MIT NANDA's The GenAI Divide: State of AI in Business 2025 (52 executive interviews, 153 leader surveys, 300 public deployments), external partnerships reached deployment ~67% of the time vs ~33% for internal builds (roughly 2x), and generic tools hit 83% adoption for trivial tasks but stall where workflows need context/memory.
• Center of Excellence + AI champions, approved-tool catalogs with allow/deny lists, and training + acceptable-use policy as combined cost/risk levers. (Caveat: some research finds training alone can breed overconfidence, so pair it with technical controls.)
• Measurement: adoption rate, hours saved, task throughput, and workflow-specific KPIs. Forrester estimated 116% three-year ROI / ~$19.7M NPV / ~9 hours saved per user per month for a 25,000-employee Copilot deployment (vendor-commissioned; treat with caution). IDC/Microsoft cite ~$3.70 returned per $1 spent on average; Accenture reports $4.60 for mature programs vs $1.20 for pilot-phase.

5. Named case studies (especially regulated industries)#

• Morgan Stanley (wealth management): Built private RAG apps ("AI @ Morgan Stanley Assistant"/"Debrief") on OpenAI GPT-4 for ~16,000 advisors over a knowledge base of 100,000+ documents. Per OpenAI's case study, "over 98% of advisor teams actively use AI @ Morgan Stanley Assistant" and "Access to documents has jumped from 20% to 80%." CTO Jeff McMillan's framing: "an ecosystem that's private to Morgan Stanley that's controlled by Morgan Stanley." (First OpenAI wealth-management strategic partner, March 2023.)
• JPMorgan Chase "LLM Suite": In-house, model-agnostic secure portal fronting OpenAI and Anthropic models (refreshed ~every 8 weeks); 200,000+ employees onboarded within ~8 months (half using it several times a day). Built to give "secure access to third-party AI capabilities while protecting client data and internal systems"; won American Banker's 2025 Innovation of the Year.
• Moody's CoPilot: Built on Azure OpenAI Service (plus Fabric and Teams); deployed to all 14,000 global employees in a "secure digital sandbox environment protected from public AI tools."
• TELUS "Fuel iX": Proprietary model-neutral platform (~40 LLMs across Vertex/others plus Claude) used by 57,000+ employees; 13,000+ custom AI solutions; 47 large-scale GenAI solutions drove $90M+ in benefits and 500,000+ hours saved; engineers ship code 30% faster; first ISO 31700-1 "Privacy by Design" certification for a GenAI chatbot. (Now commercialized.)
• Novo Nordisk (pharma): Scaled Microsoft Copilot from a few hundred users (Jan 2024) to 20,000 (Feb 2025), per MIT Sloan; also runs an Amazon Bedrock platform (25,000+ employees, 2,500+ use cases) explicitly scoped to nonregulated processes; reported regulatory-document automation costing "less than the salary of one medical writer" (secondary source, treat as directional).
• US federal government (GSA OneGov): ChatGPT Enterprise at $1/agency for a year (Aug 6, 2025); Claude for Enterprise + Government at $1 across all three branches (Aug 12, 2025); Gemini for Government at $0.47/agency. Claude for Government is FedRAMP High; Lawrence Livermore National Laboratory reports 10,000 scientists using Claude daily. By mid-2026, ~3.4 million federal employees were covered (~120+ agency orders, ~$1.6B claimed savings); the cornerstone $1 deals expire Sept 30, 2026 (a live lock-in/renewal risk, and they excluded API access).
• Commonwealth Bank of Australia: ChatGPT Enterprise rolling out progressively to its 52,000 workforce under a multi-year OpenAI partnership; $90M three-year workforce program with 30,000+ employees already trained. (Note: also drew press for AI-related call-centre job cuts.)
• Mayo Clinic (healthcare): Early adopter of HIPAA-compliant Enterprise Search in Google Vertex AI for clinicians/researchers, with the customer retaining data control.

Comparison of deployment models#

Recommendations#

Stage 1: Stop the bleeding (weeks 1–4). Assume shadow AI is pervasive (Verizon's DBIR: 45% of workers now regular AI users on corporate devices, 67% via non-corporate accounts). Stand up at least one sanctioned tool immediately, defaulting to whichever ecosystem you already own (M365 Copilot for Microsoft shops, bundled Gemini for Google Workspace shops, or ChatGPT Business/Team for a fast start). Publish a one-page acceptable-use policy and an approved-tool catalog. Turn on DLP/CASB visibility for AI apps (Netskope/Zscaler/Purview). Benchmark to advance: >50% of target users active on the sanctioned tool within 60 days.

Stage 2: Govern the data foundation (months 1–3, in parallel). Before enabling enterprise search/Copilot broadly, run an oversharing assessment, remediate broad permissions, and apply sensitivity labels. Sign the right contractual tier: no-training is table stakes; add ZDR and a HIPAA BAA where regulated data is involved; specify EU/regional residency if needed. Threshold: do not expand Copilot/enterprise-search access to a business unit until its permission remediation is complete.

Stage 3: Build the gateway and tier costs (months 2–6). For custom apps and developer access, route everything through an internal LLM gateway (LiteLLM/Portkey/Kong) inside your cloud tenancy with per-team budgets, hard caps, spend attribution, PII redaction, and logging. Tier seats: power users on premium, everyone else on pooled/consumption. Turn on prompt caching, batching, model routing, and output caps. Threshold to route more to premium seats: a cohort must show measurable workflow ROI (hours saved or throughput) before upgrading.

Stage 4: Scale what works, measure honestly (months 4–12). Establish a Center of Excellence and AI champions; expand only workflow-integrated use cases with measurable P&L or productivity impact (avoiding the MIT 95%-failure trap; partnerships deploy ~2x as often as internal builds). Reconsider self-hosting only if a specific workload sustains very high token volume (roughly tens of millions of tokens/day against frontier APIs) at high GPU utilization, or data rules forbid external processing.

Cross-cutting for agents: treat agents as privileged non-human identities. Inventory them, scope tool permissions (allowlists), require auth for remote MCP servers, keep humans in the loop for consequential actions, and log to tamper-resistant storage.

Caveats#

• Pricing changes fast and much is quote-only. ChatGPT Enterprise, Claude Enterprise, and Copilot enterprise deals are negotiated; ranges here are drawn from 2026 procurement reports, not rate cards, so verify with vendors before budgeting.
• Vendor/analyst source bias. ROI figures (e.g., Forrester's 116% Copilot ROI; IDC/Microsoft's $3.70-per-$1) are often vendor-commissioned; the MIT 95%-failure and Menlo/Gartner/Fed-Atlanta figures come from surveys with methodology limits. Some case-study numbers (JPMorgan ROI, Novo Nordisk cost claims, NNGPT user counts) come from secondary outlets, so treat dollar/ROI specifics as directional. Seat counts also shift with phased rollouts (TELUS 35k→57k→70k; JPMorgan 200k→250k).
• Break-even math for self-hosting is highly sensitive to model, GPU utilization, and whether you compare against frontier or budget APIs. Cited crossovers range from ~5M to billions of tokens/month.
• Fast-moving facts: the GSA $1 government deals expire Sept 30, 2026 with no publicly named successor plan; model lineups and retention terms (e.g., specific Claude models under GitHub Copilot, which briefly retain prompts for safety classification) shift frequently.