AI at Work: Adoption Is Outpacing the Plan

Use of AI at work rose from 21% of U.S. employees in 2023 to 52% in 2026. Organizations reporting they've integrated AI reached 47% in the second quarter of 2026, up from 41% the quarter before. Gallup calls the distance between those two numbers the integration-adoption lag: close to half of organizations have begun integrating AI, and 30% of employees use it regularly. Implementation doesn't guarantee use.

At the firm level the picture thins further. In the Census Bureau's survey of U.S. businesses, 17% to 20% report using AI in any business function, 37% among firms with 250 or more employees, and 20% to 23% expect to within six months. The same survey finds the diffusion running both ways: at some firms, workers use AI in their tasks with no formal adoption, and some firms report adoption with no worker task use.

The Federal Reserve put three surveys side by side in April and got three different answers to the same question: 18% of firms use AI (Census), 41% of workers use generative AI at work (the Real-Time Population Survey), and 78% of the labor force works at a firm that has adopted it (the Atlanta Fed's survey of executives). Same country, same quarter. Each survey asks someone different, and the distance between what the firm reports and what its people report is the first leak in this issue.

The statute side now has dates, and the dates have moved twice this year. Most of the obligations below apply by where your employees, customers, and applicants are, whatever industry you're in.

State lawmakers introduced 1,561 AI-related bills across 45 states in the first quarter of 2026 (MultiState), and a December 2025 federal executive order directs agencies to challenge state laws that conflict with a national framework. Underneath the calendar sits the rule set that already applied: anti-discrimination law, privacy law, and sector regulation carry no AI exemption. The new statutes name AI. The old ones never had to.

The workforce set the demand. The statutes set the clock. Leadership controls one thing: whether the organization has a plan that answers both.

Firms is the share of firms in the sector using AI in any business function (Census Bureau, May 2026, with the Federal Reserve's year-end 2025 figures where the Bureau's story didn't break a sector out). Workers is the share of the sector's workers using generative AI at work (Real-Time Population Survey, November 2025, as reported by the Federal Reserve Board). Breach cost is IBM's 2025 global average for the industry. The general statutes in the calendar reach every row; the last two columns list what reaches the row specifically, and our read of it. National: 19.8% of firms, 41% of workers.

Every result above is an association from survey data. The sources say "associated with," and so does this issue.

The bridge.

Any one leak looks like a project. Run the three together and the arithmetic changes, because they draw from different pools: breach exposure, hours never returned, and decisions never made. No dollar in one pool appears in another, so the impacts add.

This issue will not publish a combined total. A stacked figure built from national averages is a projection about an organization nobody has examined. It reads as a promise and invites a discount. The only total that matters comes from your user count, your plan, and producing it is measurement work inside your organization.

From the outside you can see the magnitude. At national constants, one stalled use case touching 200 people leaves five figures of hours on the table each quarter, and a single breach where shadow AI runs high costs six figures more than one where it doesn't, on top of a U.S. average measured in millions.

From the outside you can also see the direction and the clock. All three leaks are running now. Use grows each quarter Gallup measures it. The governance calendar adds dates and moves the ones it has. Each pilot that stalls restarts the next one from zero, and each quarter without a written plan is a quarter of decisions made by default. A quarter without one signed view of the three leaks locks in another quarter at today's rate.

Every other analysis of this problem publishes a big number. The number does not exist until it is yours.

The word "plan" carries most of this issue, so it should be defined. A plan for AI adoption, in our view, has five properties. Each one answers a leak the data shows.

Twelve months on, an organization that has done this hasn't transformed anything yet. It has measured, ranked, and written it down. The board packet holds the list. People know which tools they may use and who to ask. The second initiative is on the calendar. Nobody hired a chief AI officer and nobody stood up a transformation office; the pieces stayed with the leaders who already run them.

Know the shape of your own problem before anyone shows you a product.

You can answer each with information your organization holds today. The more revealing test is organizational. Who would own each answer? Would IT, finance, operations, and HR agree on them? And if they did agree, which decision would you make from them?

One version of the test costs nothing: send the three questions down the org chart and watch what comes back. If the answers arrive from one desk, or arrive from four desks and don't reconcile, you've watched the ownership problem show itself in your organization.

That test is where this work usually stalls. Someone builds a slide, three functions dispute the numbers, and the question waits for the next planning cycle. Six months later the user count is higher, the pilot count is the same, and the plan is still a conversation. The risk was never missing data. It was a picture nobody trusted enough to act on, aging while the leaks compound.

Two patterns.

Licenses arrive before use cases. Someone buys the tool, distributes it, and announces it, and whoever picks it up first decides what it's for. Gallup's top barrier to adoption, "unclear use case or value proposition," is the national version of that pattern, and the breadth data is what it costs. The organizations at the 90% end decided where the technology belonged before they handed it out.

The second initiative has no owner. The first pilot had a sponsor, a budget, and a vendor. The follow-on has a committee. Close to half of proofs of concept die in that handoff (S&P Global).

What closing each leak requires.

The first leak takes a written rule and a named owner before the next license ships. The rule says which tools, which data, and who to ask. The owner is one person.

The second leak takes scoping before the demo: the use case, the people it touches, the hours it should return, the owner, and the second step, written down before a vendor is in the room. A pilot with those five things on paper has somewhere to go when it works.

The third leak takes a document three offices sign. Ranked, ranged, owned, sequenced, and findable. Whoever deploys the work is a separate decision, and it should not be made by whoever pitched first.