A works council receives a proposal for a tool that maps AI usage. The first question arrives within two minutes: will you see what I type? The second follows immediately: will you see how often I use it?
Two different questions. The answer to the first is almost always no. The answer to the second is yes more often than people realise.
#Two kinds of measurement
AI monitoring is about services. Which AI tools are opened across the organisation, how often, and at what risk? The subject of measurement is the tool.
Employee monitoring is about people. Who uses what, how often, at what times? The subject of measurement is the person.
They resemble each other because both can be derived from the same observations. The difference is whether you attach a user id.
#It is one field in a database
That sounds too simple and it is literally true.
An event without an id looks like this: an AI service was opened, at this domain, at this timestamp. What you can do with it: count frequency, see which services exist, and see whether the picture is shifting.
An event with an id looks like this: user 4471 opened this service at this timestamp. What you can additionally do: break it down per person, examine individual patterns, and have a conversation with someone about their behaviour.
That single field then determines four things.
Whether it is processing of personal data. Without attribution to a person you fall outside the GDPR. Note the nuance: pseudonymisation is not anonymisation, and an id that can be linked elsewhere remains personal data. See anonymising, pseudonymising, masking.
Whether the works council has consultation rights. Facilities aimed at observing or checking employee behaviour or performance generally require consultation. A count with no people in it sits differently from a per-employee breakdown.
Which retention period makes sense. Counts can be kept longer because they describe the organisation. Behavioural records about people should be kept briefly.
Whether people will route around it. The practical point, and the one below.
#The governance question needs no names
Work through the questions you actually have to answer:
- Which AI services are in use in our organisation?
- Are they services we have taken a decision about?
- Is usage moving toward approved tools or away from them?
- Where is the largest risk, and is it changing?
None of those four requires a name. All are answerable with organisation-level counts.
One category does require people: "who did this" during a specific incident. That is an investigation question, not a governance question, and it deserves its own procedure with its own legal basis and safeguards. Conflating the two is exactly what stalls the conversation with a works council.
#Why measuring people ruins your numbers
The least-made argument and the most persuasive one.
KPMG and University of Melbourne research on trust in and use of AI found that 57 per cent of workers hide their AI use from their employer. That is the starting position, before anything is measured.
Announce that usage will become visible per person and something predictable happens. The usage moves to the personal phone, the personal account and the laptop at home. Your numbers fall, your risk does not, and you now own a dashboard showing the opposite of what is happening.
Measuring without people does not produce that effect, because there is nothing to evade. That is not an ethical argument but a measurement argument: you get better data when nobody has a reason to hide.
#What to ask a vendor
Not "what does the dashboard show", because that is an interface choice. Ask what is recorded:
- Is a user id attached to the event, and if so, what needs it?
- Is the content of what people type stored anywhere?
- Does an export, report or support path exist where it becomes per-person after all?
- Can an administrator flip the setting, and does anyone find out?
Those four separate the two kinds of monitoring better than any product page. The answer to the third is often surprising.
We had to make this choice ourselves and it does not land in the same place everywhere: the AI tool usage streams carry no user id at all, so an organisation sees that a service is being used and never by whom. Detection events in text do sit under a user id, and the dashboard has no per-employee breakdown anywhere. Knowing that distinction before you walk into a works council meeting is worth more than a reassuring sentence, and it is exactly the kind of detail vendors prefer to summarise as "we respect privacy".
