A board meeting at a housing association. IT's slide carries one number, large: 12,400 prompts this quarter, double the last one. A board member asks whether that is good news. The room goes quiet, because nobody knows whether those 12,400 came from two hundred colleagues or from five.
That is the trouble with most KPIs for AI adoption: they count something, but they answer no question. A usable KPI measures the organisation, not the person, and shows a direction. Eight figures do that work, and prompt count is not one of them.
What makes a figure a KPI for AI adoption?
Three requirements. The figure answers a question the board actually has: are we using it, does it run through the agreed route, do our agreements work. It has a direction, because a snapshot says little and a trend says a lot. And it is about the organisation, so that no person sits inside it and the measurement does not turn into surveillance.
That third requirement is a design choice up front, not a restriction applied afterwards. The GDPR asks for a purpose defined in advance, and "knowing whether our AI use runs through allowed tools" is such a purpose. "Knowing who opens ChatGPT" is a different purpose, with different requirements and a works council with a right of consent. Which figures exist at all, and how measurement without people works, is set out in measuring AI adoption. This article lines them up as KPIs.
Which eight KPIs say something?
| KPI | What it says | What it does not say | Without a user id? |
|---|---|---|---|
| Share of workstations using AI | Is use broad or confined to a few people | How intensive, with which tool | Yes, counted per device |
| Daily, weekly, occasional | Is AI in the work or still being tried | Which task | Yes, the category is determined on the device |
| Tools in use, and how many without a decision | How large the policy's backlog is | Whether those tools carry risk | Yes, only the domain |
| Share through allowed tools, with trend | Does practice follow policy | Why or why not | Yes |
| Visits to disallowed tools | Whether a decision lands in practice | What was entered there | Yes, at most one count per device per day |
| Outcome after a notice | Whether the alternative is good enough | Who continued | Yes, counted per outcome |
| Use-case categories | Where AI sits in the work | What exactly was asked | Yes, only the category is counted |
| Share of sensitive-data markings handled | Whether people adjust in the moment | What the text was | Yes, without content |
The first two answer the investment question: did anything happen with the licences and the training. The middle four answer the policy question: do we know which tools, has a decision been taken, does practice follow it. The last two are about behaviour in the moment, and that is where training and agreements first become visible.
Why does prompt volume say so little?
Back to the 12,400. One analyst sending two hundred prompts a week and ten colleagues doing nothing produce the same quarterly total as two hundred colleagues with one prompt a week. The first association has an enthusiast; the second has AI in its work. The volume cannot see the difference, and the difference is what the board member wanted to know.
There is a second problem. Prompt volume rewards the wrong thing. Put it at the top of the slide and you get an organisation that prompts more, not one that works with AI more sensibly. The share through allowed tools rewards the right thing: people taking the agreed route. Keep prompt volume as a trend in the appendix, and take it off the slide.
What does this look like in a board report?
The association from the opening replaced the slide a quarter later. Just over half of workstations open an AI tool at least weekly. Eleven tools are in use; three of them had no decision yet, including a tool that rewrites letters to tenants. The share through allowed tools stands at 64 percent, up from 58 the previous quarter. After a notice, two thirds choose the alternative.
None of those figures is an incident. Together they tell what is happening: use is growing, the policy is catching up, and there are three decisions to take, one of them urgent because that tool sees tenants' personal data. That is a ten-minute board conversation with a direction in it.
The last KPI in the table comes from a different layer: not which tools are opened, but what happens with sensitive data at the moment of typing. This is what that layer looks like, in counts, with nobody attached to them:
