Control over AI
Blog
AI governance 9 min read

Measuring AI adoption: which numbers matter, without tracking people

A board wants to know whether AI is being used in the organisation. Which figures at organisation level show that, with no person attached to any of them.

Abstract contour lines with a route
Quick answer

You measure AI adoption with figures about the organisation, not about people: what share of staff use AI, how often (daily, weekly, occasionally), which tools, what share of use runs through allowed tools, how that changes over time and what AI is used for. Prompt volume on its own says little. Measuring without a user ID is technically straightforward: the observation is then a tool and a day, not a person. Record the purpose in advance, watch for small groups where a count still points at someone and involve the works council. That way it measures AI use and does not become employee monitoring.

01

The share of staff using AI, and how often, says more than the number of prompts

02

The share of use through allowed tools is the figure that connects policy and practice

03

A count without a user ID answers the board's question completely

04

Small groups and indirect identification need attention even when there is no ID in the data

05

A purpose set in advance and a closely involved works council keep the measurement on the right side of the line

The managing partner of an accountancy firm bought Copilot licences for everyone last year. At the management meeting a partner asks whether it has paid off. IT knows how many licences were assigned. Nobody knows how many people work with it, whether they also use something else or whether the work has got any faster.

That question is legitimate, and most of it can be answered without tracking a single employee. Measure the share of the organisation using AI, how often, with which tools, what part of that use runs through allowed tools, how that changes and what AI is used for. Do not use the number of prompts as a headline figure. And measure all of it per tool and per day, never per person.

Why does an organisation want to know this?

Two reasons, which often overlap.

The first is value. Money was spent on licences and training, and someone wants to know whether AI is changing the work or merely sitting on the budget. That is an ordinary investment question. A count of use does not measure what AI yields or saves; it does measure whether AI is used, by how many people and for what. That also helps you decide where the next round of training should go.

The second is risk. If half the organisation uses AI, customer information goes through those tools too, and the privacy officer wants to know which tools those are and whether anything has been decided about them. That side is covered in more depth in the AI governance topic.

The two questions share one property: neither needs a name. "How many people use AI" and "what share runs through allowed tools" are questions about the organisation. That is what makes the rest of this article possible.

Which figures mean something?

Not everything countable is worth counting. These are.

The share of staff using AI. Measured against the number of seats or licences. This is the figure the partner in the opening scene wants to see, and it is also the most honest one: forty per cent use after a year of Copilot raises a question about the licences for the other sixty per cent.

How often: daily, weekly or occasionally. Someone who uses AI every day has built it into their work. Someone who tries it once a month is still exploring. The distribution across those three groups says more about where things stand than the total does.

Which tools, and how use is spread across them. One tool carrying everything is a different picture from ten tools each with a small share. The second picture usually means the organisation has not yet named a preferred tool, or the named tool does not do what people need.

The share of use through allowed tools. This is the figure that ties policy and practice together. If it rises, the decisions and the communication about them are working. If it falls while total use rises, use is growing outside the policy.

Trend over time. Each of the figures above is a snapshot. It is the trend that tells you something. A seventy per cent share through allowed tools is good news if it was fifty last quarter, and a warning sign if it was ninety.

What AI is used for. Drafting emails and documents, summarising, translating, coding, analysis: that distribution says where AI sits in the work, and so where training and AI rules pay off most. If half the use is translation, a rule about customer names in translation tools is more urgent than a prompting course.

FigureWhich question it answersWhat it does not say
Share of staff using AIIs use broad or concentrated in a few people?How intensive
Daily, weekly, occasionallyIs it part of the work or still being tried out?With which tool
Spread across toolsIs there a preferred tool, and is it used?Whether those tools are allowed
Share through allowed toolsDoes practice follow policy?Why or why not
Trend over timeIs what we are doing working?What the cause is
Use-case categoriesWhere does AI sit in the work?What exactly was asked
Number of promptsHow busy it isAlmost everything above

Why does the number of prompts say so little?

Because it hides the distribution. One analyst sending two hundred prompts a week and ten colleagues doing nothing produce the same total as two hundred colleagues with one prompt each. The first organisation has an enthusiast; the second has AI built into its work. The volume cannot tell the difference.

Prompts over time are useful, as a trend. A doubling in a quarter is a reason to look at which tools account for it. But as the headline figure on a board slide it mostly says that things are busy.

What does this look like in practice?

Back to the accountancy firm. After a quarter of measuring, this is the picture: well over half the seats open an AI tool at least weekly. Copilot is the largest but not the only one: ChatGPT, a translation tool and a tool that summarises annual accounts are opened regularly too. No decision was ever taken about the summarising tool, because nobody knew it existed. The share through allowed tools is around sixty per cent.

Nothing in this is an incident. It is the ordinary picture of an organisation where people make their work easier and the policy has not yet caught up. What management does next: decide on the summarising tool, because it sees clients' figures; look at the translation tool; and take the sixty per cent as a baseline. When the partner asks the same question in six months, there will be an answer that shows which way things are going.

How do you measure this without a user ID?

The difference between measuring and tracking is not in the dashboard but in what gets recorded. An observation without an ID looks like this: on this device, this domain was opened today. With that you can count how many tools there are, how often they are opened and how that shifts. What you cannot do with it is single anyone out. That is not a gap; it is by design.

Frequency can be determined on the device itself. The device knows whether an AI tool was opened daily, weekly or occasionally this month, and reports only the category as an anonymous count. The organisation sees "three people use AI daily", never who.

That is how BeeSensible does it. The extension notices when someone opens an AI tool and reports only the domain, at most once a day per device, with no user ID, no path and no page content. On that basis, the Usage screen shows the share of seats using AI, the split between daily, weekly and occasional use, the tools and what AI is used for, in seven use-case categories. For that last figure, in cloud mode only the first prompt of a conversation is classified; the text is then discarded and only the category is counted. The Compliance screen shows the share of use through allowed tools, with its trend. Nowhere in the dashboard is there a breakdown per employee.

AI register
AllowedUnder reviewNot allowedAll tools
Search by tool, vendor, domain or former name…
1,012 tools
DeepSeek
Critical · 90/100
Not allowed
Otter.aiNew
High · 68/100
No decision yet
Grok
High · 67/100
Not allowed
ChatGPT
High · 62/100
Allowed
Perplexity
Medium · 55/100
No decision yet
HeyGen
Medium · 53/100
No decision yet

Every tool, scored for risk

Over 1,000 AI tools, each scored from Low to Critical. Nothing is approved or blocked until someone decides.

More about AI Governance

Three things remain worth doing even when there is no ID in the data.

The purpose, in advance. The GDPR requires a purpose that is specified in advance. "Knowing whether our investment in AI is used and whether use runs through allowed tools" is such a purpose. Write it down before you measure, so that it is clear later on what the figures must not become: a way to call individuals to account.

Small groups and indirect identification. A count without an ID can still point at someone if the group is small enough. "One person uses a transcription tool daily" in a team of four is no longer an anonymous count. So prefer figures at organisation level, and set a minimum group size for every breakdown. In BeeSensible, department-level insight is off by default; if you switch it on, a department only appears once it has at least five people and seven days of data, and smaller departments are grouped under "Other". Figures only appear at all once the organisation has five active users.

The works council. In the Netherlands the Works Councils Act gives the works council a right of consent over systems designed to monitor the behaviour or performance of employees. A count per tool with no people in it is treated differently under that rule from a breakdown per employee, but the conversation is still worth having: a works council that understands the design is your best ally when someone asks "can't we see this per team as well?" What an employer may and may not do is covered in our article on whether an employer can monitor AI use.

Where does measuring stop and tracking begin?

At the person. As soon as the observation carries a user ID, can be broken down per person or can still be read per person through an export or a support channel, it is employee monitoring. Stricter requirements on purpose, necessity and transparency then apply, systematic monitoring usually requires a data protection impact assessment and the works council has a right of consent. The full distinction, and the four questions to ask a vendor, are set out in AI monitoring versus employee monitoring.

There is another reason to stay on the right side of that line, and it has nothing to do with the law. The KPMG and University of Melbourne study on trust, attitudes and use of AI (2025, covering 48,000 workers in 47 countries) finds that 57 per cent of workers hide their AI use from their employer. Announce that use will be visible per person and that percentage rises: the use moves to personal phones. Your figures drop; the use does not. Measuring without people has no such effect, because there is nothing to evade.

What do you do with the figures?

They are a start, not evidence. A percentage through allowed tools only means something once it says which tools it covers and what the policy was. A dashboard is not evidence explains how to get from a dashboard to evidence an auditor will accept; which questions from regulators the figures can and cannot answer is covered in our article on what all those AI metrics are for.

For the next board meeting, pick three figures: the share of staff using AI, the share of use through allowed tools and the trend in both. Take the number of prompts off the slide, and add that the data contains no individuals. That last point is the first thing the works council will ask about, and the answer deserves a place next to the figures.

FAQ

Common questions

Which AI adoption figure matters most?

For most organisations, the share of AI use that runs through allowed tools, and how it changes over time. That one figure ties policy to practice: if it rises, the decisions and the communication about them are working. The share of staff using AI, and how often they use it, provide the context.

Why does the number of prompts say so little?

Because one person sending two hundred prompts a week and ten colleagues who never use anything produce the same total as two hundred colleagues with one prompt each. The volume hides the distribution, and the distribution is what you want to know. Prompts over time are useful as a trend, not as a measure of adoption.

Can you measure AI use without knowing who is using it?

Yes. An observation like "this domain was opened on this device today" needs no user ID to count how many tools there are and how use develops. Frequency can be determined on the device itself and reported as an anonymous count per category. What you cannot do is single anyone out. That is not a gap; it is by design.

When does measuring AI use become employee monitoring?

As soon as the measurement makes the behaviour of individuals visible: a user ID in the data, a breakdown per person or a group so small that a count in effect describes one person. Then the GDPR requirements on purpose, necessity and transparency apply, and in the Netherlands the works council has a right of consent.

What does BeeSensible measure, and what does it not measure?

BeeSensible counts which AI tools are opened (only the domain, at most once a day per device), how often people use AI in three categories, what AI is used for in seven use-case categories and what share runs through allowed tools. Those streams carry no user ID and no content. Nowhere in the dashboard is there a breakdown per employee.

Portrait of Rens Timmermans from BeeSensible

Prefer someone to walk you through it?

Rens, BeeSensible

I'm happy to give you a twenty-minute tour. Leave your details and I'll find a time that suits you. You're also welcome to call or email.

Prefer to talk to someone first?

Want a live demo, or a quote for 100+ users? Leave your details and we'll be in touch within one working day.