A board meeting at a housing association. IT's slide shows a single number, in large type: 12,400 prompts this quarter, double the previous one. A board member asks whether that is good news. The room goes quiet, because nobody knows whether those 12,400 came from two hundred colleagues or from five.
That is the trouble with most KPIs for AI adoption: they count something, but answer no question. A usable KPI measures the organisation, not the person, and shows which way things are moving. Eight figures do that work, and prompt count is not one of them.
What makes a figure a KPI for AI adoption?
Three requirements. The figure answers a question the board actually has: are we using it, is it going through the approved tools, are our AI rules working? It shows which way things are moving, because a snapshot says little and a trend says a lot. And it is about the organisation, so that no individual can be found in it and the measurement does not turn into surveillance.
That third requirement is a design choice up front, not a restriction applied afterwards. The GDPR asks for a purpose defined in advance, and "knowing whether our AI use runs through allowed tools" is such a purpose. "Knowing who opens ChatGPT" is a different purpose, with different requirements and a works council with a right of consent. Which figures exist at all, and how you measure without tracking people, is set out in measuring AI adoption. This article lines them up as KPIs.
Which eight KPIs say something?
| KPI | What it says | What it does not say | Without a user ID? |
|---|---|---|---|
| Share of workstations using AI | Is use broad or confined to a few people | How intensive, or with which tool | Yes, counted per device |
| Daily, weekly, occasional | Is AI part of the work or still being tried out | Which task | Yes, the category is determined on the device |
| Tools in use, and how many without a decision | How large the policy's backlog is | Whether those tools carry risk | Yes, only the domain |
| Share through allowed tools, with trend | Does practice follow policy | Why or why not | Yes |
| Visits to disallowed tools | Whether a decision holds in practice | What was entered there | Yes, at most one count per device per day |
| Outcome after a notice | Whether the alternative is good enough | Who continued | Yes, counted per outcome |
| Use-case categories | Where AI sits in the work | What exactly was asked | Yes, only the category is counted |
| Share of sensitive-data highlights dealt with | Whether people adjust as they work | What the text was | Yes, without content |
The first two answer the investment question: has anything come of the licences and the training? The middle four answer the policy question: do we know which tools are in use, have decisions been taken and does practice follow them? The last two are about behaviour while people work, and that is where the effect of training and AI rules first becomes visible.
Why does prompt volume say so little?
Back to the 12,400. One analyst sending two hundred prompts a week and ten colleagues doing nothing produce the same quarterly total as two hundred colleagues with one prompt a week. The first association has an enthusiast; the second has AI in its work. The volume cannot show the difference, and that difference is exactly what the board member wanted to know.
There is a second problem. Prompt volume rewards the wrong thing. Put it at the top of the slide and you get an organisation that prompts more, not one that works with AI more sensibly. The share through allowed tools rewards the right thing: people using the approved tools. Keep prompt volume as a trend in the appendix, and take it off the slide.
What does this look like in a board report?
The association from the opening replaced the slide a quarter later. Just over half of workstations open an AI tool at least weekly. Eleven tools are in use; three of them have no decision yet, including a tool that rewrites letters to tenants. The share through allowed tools stands at 64 per cent, up from 58 the previous quarter. After a notice, two thirds choose the alternative.
None of those figures is an incident. Together they show what is happening: use is growing, the policy is catching up and there are three decisions to take, one of them urgent because that tool sees tenants' personal data. That is a ten-minute board discussion that shows which way things are heading.
The last KPI in the table comes from a different layer: not which tools are opened, but what happens to sensitive data as people type. Here is what that layer looks like, in counts with nobody attached:
