How to find out which AI tools your staff are using
You can find out which AI tools staff are using in five ways: ask them, check browser history, read firewall logs, use Microsoft's own tools, or add browser monitoring. The first three cost nothing and fit into one week. They give a snapshot. Ongoing visibility needs one of the last two, and the right choice depends on your Microsoft licence and how much admin time you have.
Why it is worth checking
Unapproved AI use is common. It is rarely sneaky. Staff use what helps them get through the day. Caiberops - Shadow AI Statistics 2026 reports that Verizon's 2026 Data Breach Investigations Report found employee use of unapproved AI tools tripled in a single year, from 15% to 45% of employees.
The point is not to ban AI. AI is welcome. The point is knowing where client data goes, so you can answer a client, an insurer or an auditor honestly.
Option 1: Ask your staff
Simple and free. Send a short, friendly message. Ask which AI tools each person uses, for what, and whether on a work or personal account.
- Pros: takes ten minutes. Shows why people use AI, not just where.
- Cons: people forget. Some will under-report if they fear trouble.
Make it safe to answer. Say nobody is in trouble. You will get better answers.
Option 2: Check browser history on a sample of PCs
Pick three to five machines. Open Chrome or Edge history. Search for chatgpt, copilot, gemini, claude, perplexity and deepseek.
- Pros: free. Shows real visits, with dates.
- Cons: slow by hand. History can be cleared. It misses phones and home laptops. It shows visits, not what was pasted.
Tell staff before you look. Checking quietly damages trust, and your data protection lead may want a say.
Option 3: Read your firewall or DNS logs
Your router or firewall may log the web addresses each device reaches. DNS logs work the same way. DNS is the internet's address book. Search them for the main AI domains.
- Pros: covers every device on the office network. No visit to each PC.
- Cons: needs someone who knows the box. Misses home and mobile working. Shows the site, not the person or the data.
If you have an IT provider, this is a quick job for them.
Rule of thumb: asking, history and logs tell you which sites. None tells you what data went in. Treat them as a first look, not a control.
Option 4: Microsoft's own tools
Microsoft Defender for Cloud Apps can find AI apps in use. According to Microsoft Learn - Step 1: Discover AI apps, you filter the Cloud app catalog by the Generative AI category, review risk scores and usage, and tag apps as Sanctioned or Unsanctioned.
There is a licence cost. Cloud Capsule - How to Detect Shadow AI in Microsoft 365 (MSP Guide) says it needs Microsoft 365 Business Premium or higher, and devices must be enrolled in Defender for Endpoint or Defender for Business. o365hq lists Business Premium at $22.00 per user per month on an annual commitment as of October 2026.
- Pros: strong if you already pay for Business Premium. Ongoing. One place to see it.
- Cons: a big step up from Basic or Standard. Setup and tuning take skill. Most small firms need their IT provider for it.
For more on Microsoft's side, see our comparison of Helio Guard and Microsoft Purview.
Option 5: Dedicated browser monitoring
These tools add an extension to the browser on each PC. They see which AI sites are used, by whom. Some also check what is pasted or uploaded.
- Pros: works on any Microsoft licence. Covers home working on the work PC. Can act before data leaves.
- Cons: another tool to buy and roll out. Coverage depends on browsers and operating systems supported.
Side by side
| Option | Cost | Effort | Ongoing? | Shows data? |
|---|---|---|---|---|
| Ask staff | Free | Low | No | No |
| Browser history | Free | Medium | No | No |
| Firewall or DNS logs | Free if you have them | Medium | Partly | No |
| Microsoft Defender for Cloud Apps | Business Premium or higher | High | Yes | Not on its own |
| Browser monitoring | Per person | Low to medium | Yes | Depends on tool |
Run a quick audit this week
- Monday: send the staff message.
- Tuesday: check history on a few PCs, with notice.
- Wednesday: ask your IT provider for a week of DNS or firewall logs.
- Thursday: list every tool found. Mark each approved or not.
- Friday: write a one-page AI policy naming the approved tools.
That list will help if a client asks about your AI controls.
Where Helio Guard fits
Helio Guard is browser monitoring for Windows PCs, on Chrome and Edge. It flags unapproved AI tools and records each person's dated agreement to your AI policy. It also takes sensitive data out of pastes and uploads, so the question still goes. Checked on the PC. We never see what your team types. Windows only for now. It is £1 a person a month, from 5 people, with a 14-day free trial and no card needed. Details are on the pricing page.
Common questions
Is it legal to check which AI tools my staff use?
Checking which AI tools staff use on work devices is generally possible in the UK, but UK GDPR expects you to be open about it. Tell staff what you check and why, keep it proportionate, and record the reason. Your data protection lead should agree the approach before any monitoring begins.
Do firewall logs catch AI use on phones?
Firewall logs only catch AI use on phones while the phone is on your office network. Personal mobile data and home Wi-Fi bypass the office firewall completely. That gap is why a staff survey and a clear AI policy still matter alongside any technical check.
Should I just block ChatGPT instead?
Blocking ChatGPT usually pushes staff to phones or other AI tools you cannot see. A better approach for most small firms is approving one or two AI tools on suitable accounts, then keeping client data out of them. Blocking suits specific sites you have decided against, such as some tools with unclear data terms.
Related: Microsoft Purview for AI without E5: what are the options?, Browser extension vs firewall for blocking AI tools: which suits a small firm?, How to stop staff pasting client data into ChatGPT without banning AI