When AI Use Becomes a KPI, Usage Logs Become Employee Monitoring Data

A growing number of employers have stopped encouraging AI use and started requiring it. Some run mandatory training. Some set targets for how many tokens employees consume or how many hours they log on AI platforms. Some track usage by name and fold it into performance reviews. A Washington Post report published November 2 collects the evidence that this approach can backfire on productivity and morale. There is a second problem the report does not dwell on, and it belongs to privacy and legal teams: the moment AI use becomes a metric, the logs that measure it become employee monitoring data, with all the legal obligations that come with it.

What the reporting found

The Post, citing company practices and researchers, describes a range of mandates. Major technology companies including Meta and Google are tracking employees’ use of AI, and Accenture requires managers to show use of new technology tools to be promoted. Arvind Karunakaran, an assistant professor of management science and engineering at Stanford University, warned that usage targets measure the wrong thing: “You can consume a lot of tokens without creating a lot of value.”

According to the report, research Karunakaran co-authored found that mandating AI tools may raise productivity in the short term, but that over the medium to long term employees tend to feel devalued and disengaged and find ways to check the box. The article also cites a Stanford Institute for Human-Centered Artificial Intelligence report finding that a third of organizations surveyed expected AI-related staff reductions in the coming year, and a Gallup and Jobs for the Future report finding that more than half of employees have less say than they would like in adopting new technology at work.

Molly Blankenship, associate vice president of strategy and impact at Jobs for the Future, put the issue in terms any compliance team will recognize: “It’s reasonable for employers to expect people to learn and use new technologies. The bigger question is how they’re implementing those expectations, whether workers are involved in the conversation and what support and training they’re providing.”

When a usage dashboard becomes a monitoring system

An AI adoption dashboard that shows totals by department is a management tool. One that shows each employee’s prompts, tokens and session time, and feeds that into reviews, is a system for monitoring individual workers. The legal analysis changes with that shift, and in several jurisdictions it changes sharply.

• Purpose and proportionality. Under the GDPR and laws modeled on it, employers need a lawful basis and a defined purpose for monitoring, and the monitoring must be proportionate. Consent is rarely a valid basis in employment because of the power imbalance. Collecting prompt content to measure adoption is hard to justify when usage counts would do.
• Impact assessments. Systematic monitoring of employees is one of the classic triggers for a data protection impact assessment in Europe. Many companies rolled out AI usage tracking as an IT configuration change and never ran one.
• Notice and access rights. In California, the CCPA has covered employee personal information since January 1, 2023. Employees can ask what has been collected about them, including usage logs, as we explained in our guide to CPRA and employee data. Prompt histories are likely to be in scope.
• Automated decisions. If AI usage scores feed into promotion or termination decisions through an automated system, rules on automated decision-making can apply, including California’s regulations on automated decision-making technology, which take effect for significant decisions in 2027, and the EU AI Act’s treatment of AI used to evaluate workers as high-risk. Our analysis of AI in employment decisions covers the state-law picture.

Complaints about worker tracking are already reaching regulators. We reported on noyb’s GDPR complaints over worker tracking at AI training-data firms, which show how quickly surveillance concerns follow productivity measurement.

The data protection problem in the prompts themselves

Usage mandates also change what goes into AI tools. When employees are told to use AI more, they paste more customer emails, more spreadsheets and more HR files into whatever tool is at hand. If the approved tool is clumsy, they use an unapproved one. Every one of those prompts is a potential disclosure of personal data to a vendor, and possibly a cross-border transfer. A mandate without clear rules on what data may be used, in which tools, increases exposure at exactly the moment it increases usage.

AI literacy: what the law now asks

The EU AI Act’s literacy duty is often cited to justify mandatory training. It was softened in July 2026 by the Digital Omnibus on AI. Article 4 now requires providers and deployers to “take measures to support the development of AI literacy” of staff and others operating AI systems on their behalf, taking into account their knowledge, experience and the context of use, and states that this “does not require providers or deployers to guarantee any specific level of AI literacy of any individual,” as the European Commission’s summary of the AI omnibus also notes. In other words, the law expects support and training, not token quotas. In the United States, the Department of Labor has published a voluntary approach, which we summarized in what the DOL’s AI literacy framework says.

Two other EU AI Act provisions are directly relevant to workplaces. Emotion recognition systems in the workplace are prohibited, with narrow medical and safety exceptions. And employers that deploy high-risk AI systems at work must inform workers’ representatives and affected workers before putting the system into service, an obligation that maps closely to Blankenship’s point about involving workers in the conversation.

A six-step plan for a defensible AI adoption program

1. Measure outcomes, not consumption. Track whether AI is improving specific processes, at team level, rather than tokens or minutes per person. This is both better management and less monitoring.
2. Separate adoption analytics from performance management. If individual usage data is collected for security or licensing, document that purpose and do not repurpose it for reviews without a fresh assessment.
3. Run a DPIA before turning on per-user tracking. Record what is collected, why, who sees it and how long it is kept. Exclude prompt content unless there is a specific, documented need.
4. Publish an employee notice. Tell staff what AI usage data is collected and how it is used, and update your employee privacy notice accordingly.
5. Set data rules for prompts. List approved tools and the categories of data that must never be entered. Pair the rules with privacy training for employees that uses real examples from their jobs.
6. Involve workers before rollout. Consult staff or their representatives on targets and tools. In the EU this is required for high-risk systems; elsewhere it is simply how to avoid the disengagement the research describes.

HR has a central role here, a point we made in why HR must lead on employee privacy. Captain Compliance’s assessment workflows can be used to run and record the DPIA or AI impact assessment for an internal AI rollout, and its rights request workflows can handle employee access requests that now include AI usage data. Those tools document decisions; they do not decide whether a particular monitoring program is lawful.

Frequently asked questions

Is it legal to require employees to use AI?

Generally, employers can set reasonable job requirements, including using approved tools. The legal questions arise from how compliance is measured and what data is collected about employees in the process, and from any automated decisions that rely on that data.

Can we track individual employees’ AI usage?

Often yes, with limits. In Europe, you need a lawful basis, a clear purpose, proportionality and usually a DPIA. In California, employees have rights over the data. Collecting aggregate metrics, or counts without prompt content, is easier to justify than full logs.

Does the EU AI Act require mandatory AI training?

Not in the form of a test or certification. After the July 2026 amendments, Article 4 requires providers and deployers to take measures to support AI literacy, and it explicitly does not require guaranteeing a specific level for any individual.

Are AI prompts personal data?

They often are, both because they can identify the employee who wrote them and because they frequently contain information about customers or colleagues. Treat prompt logs with the same care as email.

What should we tell employees?

What AI tools are approved, what data must not be entered, what usage data the company collects about them, who sees it and whether it affects evaluations. Clear answers to those questions do more for adoption than a quota.

The metric that measures the employer

Usage quotas are attractive because they are easy to count. The research in the Post’s report suggests they mostly count compliance theater. Privacy law adds a sharper consequence: every number a company collects to prove its employees are using AI is a record it may have to justify to a regulator, disclose to an employee or defend in court. Before the next dashboard goes live, someone should ask what it would look like printed out and handed to the person it describes.