The short version
- Adoption jumped again in Q3 2026, but it is shallow. Among firms in the New York Fed’s region, 61% of service firms now use AI, while the median share of their staff actually using it is 17%
- Most workplace AI is still unofficial. Only 55% of employees say their main AI tool was introduced by their employer
- The EU AI Act high-risk deadline moved from 2 August 2026 to 2 December 2027. The transparency duties under Article 50 did not move and are now enforceable
- Agents got identities. Microsoft now issues agents their own directory identity, which turns AI agent governance from a policy question into an admin task
Q3 2026 was the quarter the numbers stopped flattering everyone. Adoption is genuinely high now, at least at the level of “we use AI somewhere”. Depth is a different story, and the gap between the two is where most of the risk sits.
Here is what changed between July and September, and what it means if you run IT, HR or the workplace.
Adoption doubled again. Usage did not follow
The New York Fed’s September survey of firms in its region is the cleanest read available, because it asks the same questions every August.
| Measure | Service firms | Manufacturers |
|---|
| Using AI in 2026 | 61% | 51% |
| Using AI in 2025 | 40% | 26% |
| Using AI in 2024 | 25% | 16% |
| Median share of staff using it | 17% | 7% |
| Describe their investment as minimal to modest | About three quarters | More than 90% |
| Say they have committed significant resources | 15% | None |
Read the last three rows together. A company can answer yes to “do you use AI” on the strength of a few licences and one enthusiastic team. That is what most yes answers currently mean.
The practical point for anyone planning next year’s budget: benchmarks built on the adoption headline will overstate what your peers are actually doing. Ask about the share of staff using the tool weekly instead.
Most AI at work still arrives without permission
The third wave of the Konstanz AI Study, published on 18 September, surveyed 1,105 employees in May 2026. Use rose from 35% to 38% year on year, which is a slower climb than the firm-level figures suggest.
The finding that matters more is this one. Only 55% of people said the AI tool they use most was officially introduced by their employer. Nearly half brought their own.
The split by job type is wide. 49% in office and knowledge roles use AI, against 25% in production and manual work. By education level it is 56% against 21%. In small organisations, 11% of employees had received any AI training and 10% said binding rules on AI use exist.
So the typical picture inside a company is not a rollout. It is a few hundred people using tools nobody approved, with no training and no written rule, while the leadership team reports high adoption. That is the shadow AI problem stated in survey form.
The jobs question got a clearer answer
The same New York Fed survey asked firms what AI had done to their headcount. The results are undramatic, which is itself the news.
| Effect reported | Service firms |
|---|
| Laid off workers because of AI | 4%, up from 1% last year |
| Hired fewer workers than they would have | About 15% |
| Hired more workers because of AI | About 13% |
| Retrained workers | Just over a third |
No manufacturer in the survey reported laying anyone off because of AI. Retraining is running at more than 20% among manufacturers and just over a third among service firms, which is several times the layoff rate.
Employees are less relaxed than their employers. In the Konstanz data, 40% expect a negative effect on the labour market over ten years, though only 17% worry about their own job. Worth knowing before you write the next all-staff email about an AI pilot.
The EU AI Act deadline moved. One part of it did not
This is the change most likely to have been missed, because the headline said “delayed”.
The Digital Omnibus on AI was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. AI used in employment decisions is high risk under Annex III, and that compliance deadline moved from 2 August 2026 to 2 December 2027.
| Obligation | Date | Status |
|---|
| Prohibited practices, Article 5 | 2 February 2025 | In force |
| AI literacy duty, Article 4 | 2 February 2025 | In force |
| Transparency duties, Article 50 | 2 August 2026 | In force and enforceable |
| High-risk systems, Annex III, includes employment | 2 December 2027 | Deferred from 2 August 2026 |
| High-risk AI inside regulated products, Annex I | 2 August 2028 | Deferred |
Article 50 is the one to act on now. If staff interact with a chatbot or an assistant, they have to be told they are dealing with AI. Emotion recognition and biometric categorisation carry their own disclosure duties. None of that was deferred.
The AI literacy duty is also live and often forgotten. Set against the Konstanz finding that 11% of employees in small organisations have had any AI training, a lot of employers are behind on a rule that has applied since February 2025.
Agents got identities, which changes who owns the problem
The quarter’s real platform shift was quieter than the model launches. Agents are now treated as accounts.
Microsoft’s Entra Agent ID gives agents built in Copilot Studio and Azure AI Foundry their own identity in the directory, visible to admins by default. Agent 365 adds a catalogue, and multi-tenant agent management in the Microsoft 365 admin centre lets one team inventory, install or block agents across tenants. Separately, agents built on the Model Context Protocol became available inside Word, Excel, PowerPoint and Outlook on 15 July.
Two consequences for workplace systems. First, an agent that books desks or rooms can now be held to the same access review as a service account, so “we cannot see what the AI did” stops being a defensible answer. Second, MCP inside Office means your booking platform is one connector away from being writable by an assistant, whether or not anyone planned for that.
The questions to settle before that happens are the same ones as last quarter: whose permissions the agent borrows, whether it starts read-only, and what the audit trail records. We wrote those up in AI agent governance for desk and room booking systems. HybridHero AI is built on that model. It reads live availability and workspace rules, acts only within each user’s permissions, and confirms every action in plain language. You can see it on the HybridHero AI page.
What to do in Q4
| Action | Why now | Owner |
|---|
| Measure weekly active AI users, not licences | The median firm has 17% of staff using it. Licence counts hide that | IT |
| Publish one page of AI rules and log the tools in use | Nearly half of AI at work was never approved | IT and HR |
| Add an AI disclosure line wherever staff or visitors meet a bot | Article 50 is enforceable as of 2 August 2026 | Legal and HR |
| Run basic AI literacy training | The duty has applied since February 2025 and most small employers have not done it | HR |
| Review which agents can write to your workplace systems | Agents now have directory identities and can be inventoried | IT |
| Use the extra time on high-risk employment AI | December 2027 is a reprieve, not a cancellation | HR and Legal |
Frequently asked questions
How many companies are using AI at work in 2026?
In the New York Fed’s September 2026 survey, 61% of service firms and 51% of manufacturers reported using AI, up from 40% and 26% a year earlier. Those figures cover any use, not broad use. The median share of staff actually using it was 17% at service firms and 7% at manufacturers.
Is AI causing job losses?
Not yet at scale in this data. 4% of service firms said they had laid off workers because of AI, up from 1% the year before, and no manufacturers did. About 15% hired fewer people than planned, about 13% hired more, and just over a third retrained staff.
Did the EU AI Act get delayed?
Partly. The Digital Omnibus moved high-risk obligations under Annex III, which includes AI used in employment decisions, from 2 August 2026 to 2 December 2027. Product-embedded high-risk systems moved to 2 August 2028. Prohibited practices, the AI literacy duty and the Article 50 transparency duties were not deferred.
What is Article 50 of the EU AI Act?
It is the transparency rule. People must be told when they are interacting with an AI system, and there are specific disclosure duties for emotion recognition, biometric categorisation and synthetic content. It took effect on 2 August 2026.
What is shadow AI?
AI tools staff use for work that the employer never approved, procured or secured. The Konstanz study puts the scale of it plainly: only 55% of employees say their main AI tool came from their employer.
Why does agent identity matter for workplace software?
Because an agent with write access can change bookings, cancel rooms and read where people will be. Giving the agent its own directory identity means its permissions can be scoped and its actions attributed, which is what any access review will ask for.
Where this fits
For the underlying concepts, the glossary covers AI agent, audit trail and role-based access control. For the longer view on how AI lands in day to day operations, see AI in the workplace: the 2026 guide.