To find out which AI tools employees are using, combine a straightforward staff survey with a review of the business systems you can appropriately access. Neither approach tells the whole story on its own. Together, they can help you identify standalone apps, AI features inside existing software, and work needs that may be driving employees to try unapproved tools.
The goal is not to catch people out or automatically ban every tool. It is to understand what is being used, what information could be involved, and whether the tool has a legitimate business purpose. That picture gives you a more useful starting point for deciding what to approve, limit, replace, or block.
Start with a clear, confidential staff survey
Ask employees directly, and explain why you are asking. Make clear that the purpose is to understand business use and improve guidance, not to punish someone for testing a tool. That can make it easier for people to report informal use, including trials started with a personal account.
Keep the survey focused on practical details. Ask:
- Which AI tools or AI-enabled features do you use for work, including tools built into software you already use?
- What work task does each tool help with?
- Do you sign in with a company account, a personal account, or no account?
- What types of business information do you enter, upload, or connect to the tool?
- How often do you use it, and which team or workflow depends on it?
- Who introduced or approved the tool, if anyone?
- What would make an approved option work better for your job?
Ask about features as well as product names. A writing assistant, transcription feature, meeting summary, design tool, or help function may use AI without employees thinking of it as a separate AI app. Managers can help by asking about everyday workflows and software features in team discussions.
Compare answers with available system records
A survey captures what people remember and are willing to report. System records can add another view, but they have limits. Use the sources your business already has access to, and follow your own privacy and monitoring policies.
Review endpoint and network activity
On company-managed computers, endpoint records may show applications, browser activity, or software installations, depending on the tools and settings in place. Firewall, proxy, or other network logs may show connections to known AI services. CISA’s guidance on logging on business systems explains why system logs can support visibility and investigation.
Network activity is a clue, not proof of work use. A connection does not reveal what an employee entered, whether the activity was personal, or whether sensitive information was involved. A business may also miss use on personal devices, home networks, mobile apps, or personal accounts. Microsoft’s overview of discovering and managing shadow IT offers a practical example of using available cloud-application information to identify services in use.
Check identity and cloud application records
If employees sign in to services through company identity tools or managed cloud applications, those records may help show which services are accessed and by whom. Coverage depends on how the accounts are configured and whether the employee used a work identity. Personal sign-ins and activity outside managed systems may not appear.
Use the information to confirm a lead, not to make assumptions about an individual’s activity. Restrict access to logs, be transparent about monitoring, and involve the appropriate internal contact when reviewing activity that could be sensitive.
Look for AI features in software you already use
An AI inventory limited to standalone chatbots is likely to be incomplete. Existing business software may add AI features over time, including tools for drafting, searching, summarizing, classifying, or analyzing information. These features can be part of a platform employees already use every day.
Review the software your teams depend on. Check vendor product information, account settings, administrator notices, and feature announcements. Ask software owners whether AI capabilities are enabled, optional, or connected to business data. Revisit the list when vendors change their products or when the business adds software.
For general risk-management context, the NIST AI RMF Playbook can help frame questions about identifying and managing AI-related risks. Use it as a reference for your review, not as a substitute for assessing your own systems and obligations.
Create an AI tool inventory you can act on
Record discoveries in one place, even if the first version is a simple working list. Include enough information to understand the tool’s role and decide what needs follow-up.
- Tool or feature: Record the product name and, where relevant, the AI feature within it.
- Purpose: Describe the task or business need it supports.
- Users or department: Identify the team, role, or known users, without collecting more personal detail than needed.
- Access method: Note whether it uses a company account, personal account, browser, mobile app, or integration.
- Information involved: Record the kinds of data used or connected, such as public material, internal business content, or sensitive information. Do not assume you know what was entered based only on an access log.
- Owner and status: Name a business contact responsible for review and mark the tool as approved, under review, limited, or not approved.
- Review notes: Capture what you still need to confirm about access, vendor practices, settings, or business suitability.
Keep the inventory current enough to be useful. Assign someone to review new software requests, ask teams about newly adopted features, and revisit entries when tools or workflows change. The aim is a dependable record, not a one-time list that quickly goes stale.
Assess discoveries before deciding what to allow
For each tool, start by validating the business need. An employee may have turned to an AI app because an existing process is slow or a supported tool does not meet the need. Understanding that reason can help you choose a safer option without disrupting useful work.
Then review the information the tool handles, how access is managed, the relevant account and product settings, and the vendor’s available information about data use and security. For AI use in regulated businesses, involve the people responsible for privacy, compliance, security, or legal review when appropriate. A tool’s presence in an inventory does not by itself establish that its use is suitable for sensitive or regulated information.
Choose a response that fits what you learn. You might approve a tool for a defined purpose, limit which data or features employees may use, select a more suitable alternative, or block access when there is a clear reason. Pair decisions with plain-language guidance so employees know what to use and where to ask questions.
For broader support with business technology and security, see Zevonix’s guidance on network security for Palm Coast businesses and managed IT considerations for small businesses.
Frequently asked questions
Can network or firewall logs reveal employees’ use of AI apps?
They may show connections to some services, depending on the network setup and available logs. They generally do not establish what information was entered or whether the activity was for work. Treat a log entry as a lead to verify, not a complete account of use.
Can single sign-on or cloud app logs show who uses AI tools?
They may show access to services using a managed work identity. They can miss personal accounts, unmanaged applications, and use outside systems the business can see. Confirm how much visibility your own configuration provides before relying on it.
How can IT identify AI apps used on company devices?
Depending on the business’s tools and policies, IT may review software and browser activity on managed devices, then compare findings with staff reports and available network or identity records. Explain monitoring practices and keep the review focused on business needs.
Make discovery a regular part of AI oversight
A useful AI inventory comes from asking employees, checking appropriate records, and looking beyond standalone apps to AI features already inside business software. Keep the process open and proportionate, then make decisions based on business purpose, data, and risk. If you want help reviewing your IT environment and security approach, contact Zevonix at (386) 260-0777.