Control over AI
Blog
AI governance 9 min read

Measuring AI adoption: which numbers mean something, and how to measure without tracking people?

A board wants to know whether AI is being used in the organisation and where it adds something. A handful of figures at organisation level answers that, with no person attached to any of them. Which figures those are, and which you can leave out.

Abstract contour lines with a route
Quick answer

You measure AI adoption with figures about the organisation, not about people: what share of staff use AI, how often (daily, weekly, occasionally), which tools, what share of use runs through allowed tools, how that develops, and what AI is used for. Prompt volume on its own says little. Measuring without a user id is technically straightforward: the observation is then a tool and a day, not a person. Record the purpose in advance, watch for small groups where a count still points at someone, and involve the works council. Then it is a measurement of AI use and not employee monitoring.

01

The share of staff using AI and how often says more than the number of prompts

02

The share of use through allowed tools is the figure that connects policy and practice

03

A count without a user id answers the board's question completely

04

Small groups and indirect identification need attention even when there is no id in the data

05

A purpose set in advance and a works council kept close keep the measurement on the right side of the line

The managing partner of an accountancy firm bought Copilot licences for everyone last year. At the management meeting a partner asks whether it has delivered anything. IT knows how many licences were assigned. Nobody knows how many people work with it, whether they use something else on the side, or whether the work has become any faster.

That question is legitimate, and it can be answered without tracking a single employee. Measure the share of the organisation using AI, how often, with which tools, what part of that use runs through allowed tools, how that changes, and what AI is used for. Leave the number of prompts out as a headline figure. And measure all of it per tool and per day, never per person.

Why does an organisation want to know this?

Two reasons, which often run together.

The first is value. Money was spent on licences and training, and someone wants to know whether AI is changing the work or merely sitting on the budget. That is an ordinary investment question, and a good answer also helps decide where the next training should go.

The second is risk. If half the organisation uses AI, customer information goes through those tools too, and the privacy officer wants to know which tools those are and whether anything has been decided about them. That is the side worked out further in the AI governance topic.

The two questions share one property: neither needs a name. "How many people use AI" and "what share runs through allowed tools" are questions about the organisation. That is what makes the rest of this article possible.

Which figures mean something?

Not everything countable is worth counting. These are.

The share of staff using AI. Against the number of seats or licences. This is the figure the partner in the opening scene wants to see, and it is also the most honest one: forty percent use after a year of Copilot means the licences for the other sixty percent raise a question.

How often: daily, weekly or occasionally. Someone who uses AI every day has built it into their work. Someone who tries it once a month is still looking. The distribution across those three groups says more about where things stand than the total does.

Which tools, and how use is spread across them. One tool carrying everything is a different picture from ten tools each with a small share. The second picture usually means the organisation has not yet named a preferred route, or the named route does not do what people need.

The share of use through allowed tools. This is the figure that ties policy and practice together. If it rises, the decisions and the communication about them are working. If it falls while total use rises, use is growing outside the policy.

Development over time. Each of the figures above is a snapshot. The direction is the information. A seventy percent share through allowed tools is good news if it was fifty last quarter, and a signal if it was ninety.

What AI is used for. Writing communication, summarising, translating, coding, analysis: that distribution says where AI sits in the work, and so where training and agreements pay off most. If half the use is translation, an agreement about customer names in translation tools is more urgent than a prompting course.

FigureWhich question it answersWhat it does not say
Share of staff using AIIs use broad or concentrated in a few people?How intensive
Daily, weekly, occasionallyIs it in the work or still being tried?With which tool
Spread across toolsIs there a preferred route, and is it used?Whether those tools are allowed
Share through allowed toolsDoes practice follow policy?Why or why not
Development over timeIs what we are doing working?What the cause is
Use-case categoriesWhere does AI sit in the work?What exactly was asked
Number of promptsHow busy it isAlmost everything above

Why does the number of prompts say so little?

Because it hides the distribution. One analyst sending two hundred prompts a week and ten colleagues doing nothing produce the same total as two hundred colleagues with one prompt each. The first organisation has an enthusiast, the second has AI in the work. The volume cannot tell the difference.

Prompts over time are useful, as a trend. A doubling in a quarter is a signal to look at which tools carry it. But as the headline figure on a board slide it mostly says that things are busy.

What does this look like in practice?

Back to the accountancy firm. After a quarter of measuring, this is the picture: well over half the seats open an AI tool at least weekly. Copilot is the largest but not the only one: ChatGPT, a translation tool and a tool that summarises annual accounts are opened regularly too. No decision was ever taken about the summarising tool, because nobody knew it existed. The share through allowed tools sits around sixty percent.

Nothing in this is an incident. It is the ordinary picture of an organisation where people make their work easier and the policy has not yet caught up. What the management does with it: decide on the summarising tool, because it sees clients' figures; look at the translation tool; and take the sixty percent as a baseline. When the partner asks the same question in six months, there is an answer with a direction in it.

How do you measure this without a user id?

The difference between measuring and tracking is not in the dashboard but in what gets recorded. An observation without an id looks like this: on this device, this domain was opened today. With that you can count how many tools there are, how often they are opened and how that shifts. What you cannot do with it: speak to someone about it. That is not a gap, that is the design.

Frequency can be determined on the device itself. The device knows whether an AI tool was opened daily, weekly or occasionally this month, and reports only the category as an anonymous count. The organisation sees "three people use AI daily", never who.

That is how BeeSensible does it. The extension notices when someone opens an AI tool and reports only the domain, at most once a day per device, with no user id, no path and no page content. The Adoption screen shows on that basis the share of seats using AI, the daily, weekly and occasional split, the tools, and what AI is used for in seven use-case categories. For that last one, in cloud mode only the first prompt of a conversation is classified, after which the text is discarded and only the category counts. The Risk screen shows the share of use through allowed tools, with its trend. Nowhere in the dashboard is there a breakdown per employee.

Search tool, vendor or categoryโ€ฆ
865 tools
ChatGPT๐Ÿ‡บ๐Ÿ‡ธ
HighAllowed
Claude๐Ÿ‡บ๐Ÿ‡ธ
MediumAllowed
DeepSeek๐Ÿ‡จ๐Ÿ‡ณnew
CriticalNot allowed
Perplexity๐Ÿ‡บ๐Ÿ‡ธnew
MediumNo decision yet
Mistral๐Ÿ‡ซ๐Ÿ‡ท
LowNo decision yet
Midjourney๐Ÿ‡บ๐Ÿ‡ธ
MediumNo decision yet

Every tool, scored for risk

865 AI tools, each scored Low to Critical, with nothing pre-approved or pre-blocked until someone decides.

More about AI Tools

Three things remain worth doing even when there is no id in the data.

The purpose, in advance. The GDPR requires a purpose that is specified in advance. "Knowing whether our investment in AI is used and whether use runs through allowed tools" is such a purpose. Write it down before you measure, so that it is also clear later what the figures must not become: a means to speak to someone.

Small groups and indirect identification. A count without an id can still point at someone if the group is small enough. "One person uses a transcription tool daily" in a team of four is no longer an anonymous count. So prefer figures at organisation level, and put a lower bound on every breakdown. In BeeSensible, insight per department is off by default; whoever switches it on sees a department only from five people and seven days, and smaller departments fold into "Other".

The works council. In the Netherlands the Works Councils Act gives the works council a right of consent over facilities aimed at observing the behaviour or performance of employees. A count per tool without people sits differently under that than a breakdown per employee, but the conversation is still worth having: a works council that understands the design is the best ally against the question "can we not also see this per team". What an employer may and may not do is in can my employer monitor whether I use AI.

Where does measuring stop and tracking begin?

At the person. As soon as the observation carries a user id, can be broken down per person, or can still be read per person through an export or a support path, it is employee monitoring. Then heavier requirements on purpose, necessity and transparency apply, systematic oversight usually needs a data protection impact assessment, and the works council has a right of consent. The full distinction, and the four questions to ask a vendor, are in AI monitoring versus employee monitoring.

There is another reason to stay on the right side of that line, and it has nothing to do with the law. The KPMG and University of Melbourne study on trust, attitudes and use of AI (2025, among 48,000 workers in 47 countries) finds that 57 percent of workers hide their AI use from their employer. Announce that use becomes visible per person and that percentage rises: the use moves to the private phone. Your figures drop, the use does not. Measuring without people has no such effect, because there is nothing to evade.

What do you do with the figures?

They are a start, not evidence. A percentage through allowed tools only means something once it says which tools it covers and what the policy was. How you get from a dashboard to a substantiation an auditor accepts is in a dashboard is not evidence, and which questions from regulators the figures do and do not carry is in what are all those AI metrics for.

For the next board meeting, pick three figures: the share of staff using AI, the share of use through allowed tools, and the direction of both. Take the number of prompts off the slide, and add that there is no person in the data. That last point is the first thing the works council asks, and the answer deserves a place next to the figures.

FAQ

Common questions

Which AI adoption figure matters most?

For most organisations, the share of AI use that runs through allowed tools, with its development over time. That one figure ties policy to practice: if it rises, the decisions and the communication about them are working. The share of staff using AI and how often are the context around it.

Why does the number of prompts say so little?

Because one person sending two hundred prompts a week and ten colleagues who never use anything produce the same total as two hundred colleagues with one prompt each. The volume hides the distribution, and the distribution is what you want to know. Prompts over time are useful as a trend, not as a measure of adoption.

Can you measure AI use without knowing who it is?

Yes. An observation like "this domain was opened on this device today" needs no user id to count how many tools there are and how use develops. Frequency can be determined on the device itself and reported as an anonymous count per category. What you cannot do then is speak to someone about it. That is not a gap, that is the design.

When does measuring AI use become employee monitoring?

As soon as the measurement makes the behaviour of individuals visible: a user id in the data, a breakdown per person, or a group so small that a count in fact describes one person. Then the GDPR requirements on purpose, necessity and transparency apply, and in the Netherlands the works council has a right of consent.

What does BeeSensible measure, and what not?

BeeSensible counts which AI tools are opened (only the domain, at most once a day per device), how often people use AI in three categories, what AI is used for in seven use-case categories, and what share runs through allowed tools. Those streams carry no user id and no content. Nowhere in the dashboard is there a breakdown per employee.

Portrait of Rens Timmermans of BeeSensible

Would you rather someone showed you?

Rens, BeeSensible

I am happy to give you a twenty-minute tour. Leave your details and I will find a moment that suits you. Calling or emailing works just as well.

Rather talk to someone first? Book a call.

Want a live demo, or a quote for 100+ users? Leave your details and we'll be in touch within one business day.