In March 2023, Samsung engineers pasted proprietary semiconductor source code into ChatGPT to debug it. Within 20 days, the company had identified three separate incidents of sensitive data leaving the building through an AI chatbot, including a recording of an internal meeting. Samsung banned generative AI tools company-wide a month later.
Stories like that are no longer unusual. Cyberhaven research found that 11% of the data employees paste into ChatGPT is confidential, and roughly one in twenty employees has done it at least once. A 2023 Fishbowl survey of nearly 12,000 professionals found that 68% of those using AI tools at work had not told their manager. Most leaders underestimate how much ChatGPT use is happening inside their company, and how much business-sensitive information is going with it.
If you lead IT, security, or HR and you want visibility into employee ChatGPT use, you have six realistic options. This guide walks through each one, covers what it sees and what it misses, and shows how to combine them into a measurement program that gives you real numbers on adoption, business impact, and ROI without resorting to surveillance. For broader context on the enterprise landscape, see our overview of ChatGPT adoption in the enterprise.
Quick answer
You can track employee ChatGPT use through six methods: network and firewall logs, endpoint monitoring software, the ChatGPT Enterprise admin dashboard, API key auditing, employee surveys, and aggregated AI adoption analytics. The strongest approach combines several of these in layers, starting with the ChatGPT Enterprise admin console and extending visibility across all your AI tools with an adoption dashboard that aggregates data at the team level instead of tracking individuals.
Three pressures are pushing this issue up the priority list for IT and HR leaders in 2026.
These three goals are often treated as one project, but they require different data. Data loss prevention needs content-level visibility. Shadow AI detection needs network-level visibility. Adoption and ROI measurement need aggregated team-level visibility, and they specifically do not need individual prompt content. The methods below map to different combinations of these goals.
The most straightforward starting point is to have your network team log connections to ChatGPT domains (chat.openai.com, api.openai.com) and any other AI endpoints. Most modern firewalls, secure web gateways, and cloud access security brokers (Zscaler, Netskope, Cloudflare Gateway, Palo Alto Prisma) can do this without any new tooling.
Network logs tell you which corporate users or devices are connecting to ChatGPT, how often, and roughly how much data they are exchanging. Combined with DNS filtering, you can also detect connections to alternative chatbots like Claude, Gemini, Perplexity, Copilot, and known wrapper services.
Strengths
Limitations
Use it for: baseline visibility and shadow-AI detection on managed devices. Treat it as the floor of your tracking program rather than the whole thing.
Endpoint agents (Microsoft Defender for Endpoint, CrowdStrike, ActivTrak, Teramind, Veriato, and others) sit on the employee device and can record application usage, web browsing time, and in some cases keystrokes, clipboard activity, and screen content. Most can be configured to flag ChatGPT usage or block uploads above a certain size.
This is the most powerful technical option and also the one most likely to backfire. Endpoint monitoring at this level is what most employees mean when they talk about surveillance, and the research on its consequences is consistent: an American Psychological Association survey found that 56% of monitored employees report feeling stressed about it, and almost two-thirds say activity-tracking software is a valid reason to quit. As we covered in our analysis of how employee tracking hurts morale and productivity, invasive monitoring usually produces performative work rather than the actual productivity gains it promises.
Strengths
Limitations
Use it for: data loss prevention in industries where the regulatory bar requires content-level inspection. Do not reach for it just to count who is using ChatGPT.
If your organization has deployed ChatGPT Enterprise, ChatGPT Team, or ChatGPT Edu, tracking is largely built in. OpenAI's Enterprise Compliance API and the Admin Workspace surface user-level analytics: total messages, active users by day, week, and month, average prompts per user, GPT and tool usage breakdowns, and SSO-mapped user identities. Workspace admins can export audit logs for the entire organization. For deeper coverage of what these logs contain and how to put them to work, see our guide on how to measure the business impact of ChatGPT Enterprise.
One important detail: OpenAI documents that conversation content is only accessible to workspace admins under specific circumstances such as litigation, investigations, and audits, not for routine performance management. This is both a feature (employees can use ChatGPT for sensitive work without their manager reading their prompts) and a constraint (you cannot use Enterprise audit logs to monitor what people are asking).
Strengths
Limitations
Use it for: the foundation of any sanctioned-AI measurement program. If you have bought Enterprise, start here.
If your organization runs on Anthropic's models instead, we cover the equivalent admin tooling in our guide to tracking Claude Enterprise usage.
For developers and data teams, the largest volume of AI usage often is not in the ChatGPT web app. It is in API calls from internal applications, IDE plugins, GitHub Actions, and one-off scripts. Tracking this requires governance on the API key itself: route all calls through a corporate gateway or proxy (Cloudflare AI Gateway, Portkey, AWS Bedrock guardrails, or a self-hosted reverse proxy), enforce that every API key is registered to a service or human owner, and log request volume, model used, and approximate token counts.
Strengths
Limitations
Use it for: any organization where engineering or data science is a significant share of AI consumption, which is most of them.
Surveys are the lowest-friction option and the one most organizations underestimate. A well-designed quarterly pulse can capture three things that technical tracking misses: usage on personal devices and accounts, what tasks employees use AI for, and the qualitative obstacles such as training gaps, policy confusion, or fear of getting in trouble.
The accuracy depends entirely on whether employees believe they will not be punished for answering honestly. The Fishbowl finding that 68% of AI users had not told their manager is the baseline you are working against. Make surveys anonymous, run them through a third party where possible, and pair them with a clear acceptable-use policy that frames AI use as encouraged within guardrails rather than as something to confess.
Strengths
Limitations
Use it for: complementing your technical tracking with the why. Never as your only data source.
The sixth option sits one layer above the others. An AI adoption analytics platform connects to ChatGPT Enterprise, Microsoft 365 Copilot, Google Gemini, GitHub Copilot, Slack AI, and your other AI tools through their admin APIs, anonymizes the data at ingestion, and reports adoption metrics at the team and department level without exposing individual prompts or conversations. Worklytics is one such platform, and the broader category is sometimes called an AI adoption dashboard.
The job of this category is different from the other five methods. The first five answer "who is using ChatGPT and how often." Aggregated analytics answers three harder questions:
Three principles define a tracking program that produces honest adoption numbers and avoids drifting into surveillance.
For a full breakdown of what to measure and how to roll the data into actionable benchmarks, see our guide on how to measure employee AI usage without invading privacy, and our department-level walkthrough for tracking ChatGPT Enterprise usage by department.
Strengths
Limitations
Use it for: measuring adoption, business impact, and ROI across your full AI stack at scale, without the trust costs of endpoint monitoring.
The right tracking program is almost never a single tool. It is a set of layers where each method covers what the others miss and where the most invasive option is reserved for cases that genuinely require it. The layering that works for most mid-sized and enterprise organizations looks like this.
For OpenAI's agentic coding tool specifically, see tracking Codex usage.
The order matters. Most organizations skip Layers 1 through 4 and reach straight for endpoint monitoring because it sounds the most thorough. They end up with a surveillance system that catches the cases everyone already knew about, misses everything that matters, and creates a measurable retention problem in the process.
Three illustrative views from a Worklytics deployment. Each one keeps individual employees anonymous and reports at the team or department level.
If employees are using personal ChatGPT accounts, it is usually because the sanctioned tools are missing, slow to approve, or perceived as inferior. Surveillance does not fix that. It pushes the behavior further underground. Make the sanctioned option faster and better than the consumer option first.
You can measure adoption, identify shadow AI, and prove ROI without ever seeing a single prompt. Most leaders who think they need to see prompt content do not, once they articulate what decision they are actually trying to make.
AI tool usage is changing every quarter. Models change, capabilities expand, and what looks like high adoption today is the baseline next year. Whatever tracking you set up should be designed to run continuously and benchmark against itself over time.
Gartner research found that the acceptance rate of email monitoring rose by 20 percentage points among employees when employers explained the reasons for it. The same pattern applies to AI tracking. Telling people what you measure, why you measure it, and what you do not measure is the single highest-ROI thing you can do for adoption and trust.
Note for the dev team: wrap this section in FAQPage schema markup. Each H3 below is a Question and the paragraph that follows is the Answer.
On a personal ChatGPT account, employers generally cannot see your individual chat history. On ChatGPT Enterprise, ChatGPT Team, or ChatGPT Edu, workspace administrators can access conversation audit logs through the Enterprise Compliance API, but OpenAI policy is that this access is reserved for litigation, regulatory investigations, or security audits, not routine performance management. If you are on a corporate device, network-level logs may also show that you visited ChatGPT, but not what you typed.
In most jurisdictions, yes. Workplace monitoring is legal when it is proportionate, transparent, and serves a legitimate business interest. The specific requirements vary. The US is broadly permissive at the federal level with state-by-state variation (California, Connecticut, Delaware, and New York have specific notification laws), while the EU requires explicit transparency, data minimization, and a documented lawful basis under GDPR. The safer approach everywhere is to disclose monitoring in writing through your employee handbook or acceptable-use policy and to minimize what you actually collect.
No. OpenAI policy is that data submitted through ChatGPT Enterprise, ChatGPT Team, ChatGPT Edu, and the API is not used to train their models. This is the major business case for deploying Enterprise versus letting employees use consumer accounts. The consumer free and Plus tiers do, by default, use prompts as training data unless users explicitly opt out.
The honest answer is imperfectly. The most reliable signals are network and DNS logs showing connections from corporate devices to AI domains, combined with anonymous employee surveys that capture personal-account use. If shadow AI is a major concern, the fastest mitigation is usually to make the sanctioned alternative obviously better, with faster approval, better models, and integration into the tools employees already use.
The difference is scope and granularity. Surveillance focuses on individual behavior at high resolution: what each person typed, when, and for how long. Tracking AI adoption focuses on aggregate patterns at the team or department level: how many people are using sanctioned tools, how frequently, in which departments, and what business outcomes correlate with usage. The first question is whether one person is performing. The second is whether your AI investment is working. The technical implementations are different, the privacy implications are different, and the impact on employee trust is different.
The most defensible approach is to combine three data sources. Use the ChatGPT Enterprise admin dashboard for tenant-level usage volume. Use an AI adoption analytics layer to correlate usage with productivity signals such as meeting time, focus time, and project cycle time. Use a quarterly survey to capture the qualitative time savings employees report. Triangulating across these three gives you a number defensible enough to put in front of finance.
For organizations that already run ChatGPT Enterprise and a modern firewall or CASB, the foundational layer costs nothing extra. Both are already capturing the data. Adding API governance through a gateway typically runs in the low thousands per month at enterprise scale. Aggregated AI adoption analytics is generally priced per employee per month. Endpoint monitoring software is the most expensive option and the one that comes with the largest soft costs in employee trust.
Tracking employee ChatGPT use is no longer optional. The question is whether you do it as a surveillance project that erodes trust and misses most of the actual usage, or as a measurement program that gives you the visibility you need on adoption, business impact, and ROI without surveilling anyone.
The Samsung incident showed what happens when there is no visibility. The American Psychological Association data shows what happens when there is too much. The organizations that get this right sit in the middle. They combine the data their AI platforms already collect with privacy-first analytics that aggregate at the team level, supplemented by clear policy and an honest conversation with employees about what is being measured and why.
Generative AI is going to keep expanding inside your company whether you measure it or not. Measuring it well is how you turn that expansion from a risk into a competitive advantage. If you want to see what cross-tool AI adoption analytics looks like in practice, you can explore the Worklytics AI adoption dashboard or read our walkthrough on tracking AI usage by team and role.
