How to monitor employee AI use without spying on staff
You can monitor employee AI use without spying by recording what happened, not what was written. Log the kind of data, the AI site, the person, the outcome and the time. Do not read prompts or answers. Tell staff first, keep it proportionate, and use what you find for training rather than blame. That setup gives you visibility and keeps trust.
Why managers want to monitor AI use
Staff use AI at work. Often more than you think. Questa AI reports Salesforce's 2026 Workforce AI Survey found 67% of employees use AI tools at work, while only 18% of organisations have formal AI security policies.
Bans do not stop it either. Wakefield Research data cited by PagerDuty found two-thirds of office professionals have used AI tools at work despite policy restrictions.
So the real question is not whether staff use AI. It is whether client data goes in with it. That is what monitoring should answer. Nothing more.
Why staff worry about it
Monitoring feels personal. Research commissioned by the ICO, summarised by Simmons & Simmons, found 70% of people would find workplace monitoring intrusive.
That is a fair worry. Someone drafting a hard email with ChatGPT does not want a manager reading it. Nor should the manager want to.
Two ways to monitor: reading content or recording outcomes
There are two broad approaches. They feel very different to staff.
| Reading content | Recording outcomes | |
|---|---|---|
| What is kept | Full prompts, files and answers | Kind of data, site, person, outcome, time |
| What a manager sees | Everything typed | "Card number taken out, ChatGPT, Priya, 4 Oct 09:31" |
| How staff feel | Watched | Checked, like a spellchecker |
| Your own risk | You now store copies of sensitive data | Little sensitive data stored |
Reading content creates a new problem. Every prompt you keep is another copy of client data, now sitting in your logs.
Recording outcomes answers the useful questions. Did client data nearly go out? Where? How often? Which team needs help?
Rule of thumb: if you would not want a stranger reading the log, you are collecting too much. Record the kind of data and the outcome, not the words.
What the ICO expects from employers
The ICO defines monitoring workers as any monitoring of people who work on your behalf, on premises or elsewhere, in or outside work hours. Checking AI use on work PCs falls inside that.
The ICO's guidance is flagged as under review because of the Data (Use and Access) Act 2025. Check the current version before you rely on it. The main ideas below are general good practice either way.
Use the least intrusive way
Proportionality means you pick the lightest method that does the job. If outcome records tell you what you need, reading full prompts is hard to justify.
Tell staff in advance
According to Hunton, the ICO says covert monitoring is unlikely to be justifiable in normal circumstances. It is generally only for criminal activity, gross misconduct or similar. AI checks should be open.
Consider a DPIA
A DPIA, a data protection impact assessment, is a written check of the risks to staff and how you reduce them. Browne Jacobson notes one is required where monitoring is likely to cause high risk, citing keystroke monitoring and monitoring that could cause financial loss, such as performance management, as examples.
Reading every prompt sits close to keystroke monitoring. Feeding results into performance reviews moves you towards high risk too. Both are good reasons to keep it light.
Watch automated decisions
PolicyPros notes the Data (Use and Access) Act 2025 replaced Article 22 of the UK GDPR with Articles 22A to 22D from 5 February 2026. These cover automated decisions. Keep a person in any decision about a member of staff.
How to set up monitoring staff will accept
- Write the policy first. Say which AI tools are welcome and which data must stay out. Our UK AI policy template covers this.
- Decide what you will record. Kind of data, site, person, outcome, time. Write down what you will not record: prompt text and answers.
- Tell everyone before it starts. Explain why, what is kept, who sees it and for how long.
- Get each person's agreement. A dated record of who agreed the policy helps if a client or insurer asks.
- Do a DPIA if in doubt. Even a short one shows you thought about staff.
- Review monthly. Look at patterns, not people.
Use findings for training, not blame
Take Ashcombe, a fictional accountancy firm. The monthly record shows Tom's team pasted client bank details into ChatGPT several times. Each time the details were taken out before sending.
The poor response is a warning to Tom. The better one asks why. Perhaps the team summarises bank statements and nobody showed them a safer way. A short session fixes it for everyone.
A near miss is a training note, not a disciplinary file.
Say this in the policy. Staff who know findings go to training are less likely to hide AI use. Hidden use is the thing you cannot see at all. Our guide to finding shadow AI covers that side.
Worked example: "Bank details taken out, ChatGPT, Tom, 6 October 2026." No prompt. No answer. Enough to plan training, not enough to read Tom's work.
Where Helio Guard fits
Helio Guard was built around the outcome-only approach. Checks run on the PC with fixed rules, not an AI model. Sensitive items are swapped for labels, so the question still goes through. Only a short record reaches your account: kind of data, site, person, outcome and time. We never see what your team types.
It also records each person's dated agreement to your AI policy and flags staff who may need training. Windows PCs with Chrome and Edge only. It costs £1 a person a month, from 5 people, with a 14-day free trial and no card needed. The pricing page has the detail.
Common questions about monitoring AI use
Do I need staff consent to monitor AI use at work?
Monitoring AI use usually rests on legitimate interests rather than consent, because staff may not feel free to refuse an employer. You still need to tell staff clearly what is recorded and why before monitoring starts. Recording a dated agreement to your AI policy is good practice and shows they were told.
Can I use AI monitoring records in disciplinary action?
AI monitoring records can be used in disciplinary action, but doing so raises the risk level and may call for a DPIA. Many firms say in their policy that findings go to training first. Keeping a person in every decision about a member of staff also matters under the newer automated decision rules.
Is monitoring AI use different on personal phones?
Monitoring AI use on personal phones is far more intrusive than on work PCs, because personal devices hold private life. Most small firms limit checks to company computers and set a policy rule that client data stays off personal devices. That keeps monitoring proportionate and easier for staff to accept.
Related: How to let staff use AI safely: a four-week rollout for small firms