What NAVEX Survey Findings on AI Use at Work and GRC Frameworks in Japan Reveals

1. Managers outpace non‑managers in AI adoption

Four in ten employees use AI, with managers outpacing non‑managers in adoption.

Regarding AI use at work, the combined share of respondents who said they use AI was 43%. This includes “use it every day” (11%), “use it several times a week” (20%) and “use it several times a month” (12%). This was lower than the combined 57% who said they do not use it, including “rarely use it” (21.6%) and “do not use it at all” (35.4%).  

Among managers, over half (59.4%) said they use AI at work. Including “use it every day” (16.7%), “use it several times a week” (28.7%) and “use it several times a month” (14%). This is substantially higher than non-managerial employees (36%). The results show that while AI use remains limited overall, it is progressing among managers.

2. AI training isn’t keeping pace with AI use

AI training participation remains below 20% overall, suggesting that education has not kept pace with AI us. 

Regarding receiving training for safe AI use, the combined share of respondents who said they had “received specialized training” (2.6%) or “received simple internal guidance” (13.6%) was 16.2%. Far below those who said they “have not received training” (65.2%).  

Among managers, the combined share for “received specialized training” (5.3%) and “received simple internal guidance” (19.3%) was 24.6%, almost twice the figure of non-managerial employees (12.5% combined). Among non-managerial employees, 70.3% said they had “not received training, suggesting that education about AI use is not sufficiently reaching the frontlines. 

When training is insufficient, employees have no choice but to rely on their own judgment to determine “what constitutes a risk” and “which uses are appropriate.” Combined with the unclear approval flows discussed below, this raises concern that a structure is emerging that makes self-directed AI use more likely. 

Please note that this question was multi-select, percentages add up to over 100%.

3. More human review of AI-generated outputs is needed

More than 30% “rarely or never verify” AI-generated output, highlighting insufficient ethical checks. 

Regarding verification of the ethical appropriateness of AI-generated output when using it for work, a combined 66.3% said they perform some form of verification: “always verify” (22%), “verify in many cases” (21.4%) or “verify only some parts” (22.9%). At the same time, a third of respondents said they “rarely verify” (21.7%) or “do not verify at all” (12.1%).  

As AI use advances, the thoroughness of verification varies, suggesting that many Japanese companies lack clear policies, guidelines, and training around its safe use.

4. Overconfidence in understanding AI risks may be an issue across the workforce

While most have not received training, nearly half say they understand the risks associated with AI use, suggesting possible overconfidence in risk understanding.

Regarding understanding of risks associated with AI use, such as information leakage and the spread of misinformation, a combined 46.2% said they “understand sufficiently” (10.8%) or “understand to some extent” (35.4%), indicating that nearly half perceive themselves as understanding the risks. Among managers, a combined 62.7% said they “understand sufficiently” (14.0%) or “understand to some extent” (48.7%), significantly higher than non-managerial employees (39.1% combined).  

This result diverges from the training participation rate identified in question two (16.2% combined; 24.6% among managers, 12.5% among non-managerial employees), suggesting the possibility that some employees are using AI while merely believing they understand the risks. Among non-managerial employees, a majority lack sufficient understanding, suggesting that limited educational opportunities and overconfidence based on personal judgment may be weakening risk management at the frontline level. 

Meanwhile, a combined 53.8% said they “do not understand very well” (31.8%) or “do not understand at all” (22.0%), indicating that many people are aware they do not understand the risks. 

The gap between self-assessed understanding and professional education can reduce the accuracy of risk judgments among both managers and non-managerial employees, potentially amplifying the shadow AI risks discussed below.

5. Use of “shadow AI” is more common among managers

Experience with “shadow AI,” using AI at one’s own discretion without company permission, is significantly higher among managers (36.7%) than non-managerial employees (15.8%). 

Regarding experience with using AI without authorization, a combined 22% reported such experience: “always” (3.6%), “frequently” (5.8%), or “occasionally” (12.6%).   

Among managers, they responded “always” (6%), “frequently” (8%) and “occasionally” (22.7%). They therefore use AI without permission more than twice as often (36.7%) compared to non-managerial employees (15.8% combined).  

Using AI without formal approval could unintentionally expose the business to a broader risk landscape – a blind spot in AI governance. In addition, while non-managerial employees show a stronger tendency to follow rules, when combined with the “lack of understanding” shown in the previous question, the results also suggest employees may be polarizing into those who avoid using AI due to shallow understanding and those who use AI at their own discretion despite shallow understanding.

6. Opportunity losses caused by risk management deficiencies appear to be limited

Actual opportunity losses caused by risk management or compliance deficiencies remain limited, but more than 10% recognize potential risk, especially among managers.

A minority of respondents reported missed business opportunities, such as failure to win customers, contracts, investments or partnerships due to deficiencies in risk management or compliance: “actually happened multiple times” (1.2%) or “actually happened about once” (2.4%), a combined 3.6%. When including those who said “it has not actually happened, but I have felt there was a risk of missing opportunities” (9.6%), the percentage reached 13.2%. 

However, overall, 64.2% of respondents have not experienced this issue, suggesting that Japanese employees have high confidence in their organization’s ethical practices.  

Among managers, the combined share of “actually happened multiple times” (3.3%), “actually happened about once” (5.3%) and “have felt there was a risk” (16.7%) was 25.3%, far higher than among non-managerial employees (8% combined).

7. AI guidance is not reaching the front lines

More than two-thirds say AI usage guidelines are “not provided” or “unknown,” revealing a clear lack of penetration to the frontlines. 

Regarding guidelines for using AI tools safely and responsibly, the combined share of respondents who recognized the existence of guidelines was only 32.8%: “guidelines exist and are very easy to understand” (11.8%), “guidelines exist but are not very easy to understand” (12.6%) and “guidelines exist but are not at all easy to understand” (8.4%). 

Meanwhile, the combined share of those who said “guidelines have not been provided” (37%) or “I do not know whether guidelines exist” (30.2%) reached 67.2%. 

Among managers, the combined share for “guidelines exist and are very easy to understand” (12.7%), “guidelines exist but are not very easy to understand” (15.3%) and “guidelines exist but are not at all easy to understand” (12.7%) was 40.7%, higher than non-managerial employees (29.4% combined). While managers are more aware of the existence of guidelines, the results highlight insufficient communication of governance information at the frontline level.

8. AI approval processes are often unclear or unknown

Almost three-quarters of respondents said approval or confirmation processes for AI do not exist or are unknown.

Almost three-quarters (72%) of respondents said approval or confirmation processes for AI use were “not established” (41.6%) or that they “do not know” (30.4%). The combined share of respondents who said such processes were “clearly established and in operation” (10.2%), “established but not sufficiently operated” (6.8%) or “currently being developed” (11%) was 28%. 

Among managers, the combined share for “clearly established and in operation” (12.7%), “established but not sufficiently operated” (8%), and “currently being developed” (18.7%) was 39.4%, compared with 23.1% among non-managerial employees. While managers are more likely to be aware of the existence of such processes, the results also highlight a structure in which information is not sufficiently shared with non-managerial employees. This is also consistent with the lack of awareness of guidelines shown in the previous question. 

If AI use advances in the workplace but approval flows remain unclear, it could easily lead to risks such as shadow AI. The findings suggest there are delays in Japanese organizations’ control and confirmation systems.

9. Most AI investment remains reactive

Fewer than 30% view AI investment and use as “proactive,” suggesting a cautious stance among companies operating in Japan.

Regarding investment in and/or use of AI to respond to customer needs, the combined share of respondents showing a positive stance was 28.2%: “proactively advancing” (8.2%), “already advancing but not sufficiently” (7.8%) and “currently considering or preparing” (12.2%). 

Among managers, the combined share for “proactively advancing” (9.3%), “already advancing but not sufficiently” (10%) and “currently considering or preparing” (20.7%) was 40%, significantly higher than the combined share among non-managerial employees (23.2%).  “Do not know” was notably high among non-managerial employees at 40.0%.  

This trend is also related to the “lack of awareness of guidelines” and “underdeveloped approval processes” shown earlier, suggesting a structure in which companies operating in Japan lack transparency, and continue to take a cautious stance on both AI investment and governance.

10. Data suggests a lack of confidence in early risk identification

Fewer than 20% are confident in detecting early warning signs of misconduct or emerging risks within their organization before they become serious.

Regarding confidence in being able to detect early warning signs of misconduct or emerging risks within the organization before they become serious, only a combined 16.2% said they were confident: “very confident” (1.4%) or “somewhat confident” (14.8%).  

Among managers, the combined share for “very confident” (2%) and “somewhat confident” (25.3%) was 27.3%, significantly higher than non-managerial employees (11.4%). Meanwhile, among non-managerial employees,　“do not know” accounted for the highest share at 43.4%, suggesting a lack of adequate training and awareness of how to spot misconduct and risks.