AI Monitoring Statistics: What Employers Track and What They Miss

AI monitoring is a hot topic in today’s workplaces. Employers are rushing to write policies, deploy dashboards, and get a handle on what their team members are doing with ChatGPT, Copilot, Gemini, and dozens of other tools. Workers, meanwhile, are wondering whether their keystrokes, screens, and output are being analyzed by a system they don’t know about.

And another layer: who, if anyone, is monitoring the AI itself? Agents are being deployed into production environments faster than most organizations can govern them, and the data suggests that most are not doing a great job monitoring those agents’ output.

The statistics below pull from recent surveys and vendor telemetry data covering employers, workers, and enterprise AI deployments. They cover how many companies have formal AI policies, what employers actually track, how much workers know (or don’t know) about being monitored, the state of AI agent oversight, and where regulation and spending are headed next.

Key AI Monitoring Statistics

• 22% of workers who use AI say their employer actively monitors that use
• 68% of employers now have a formal policy governing workplace AI use
• 47% of enterprise AI conversations run through personal identities rather than corporate-managed accounts
• Unapproved AI tools were involved in 43% of security incidents
• About half of deployed AI agents run without active monitoring, and 90% of organizations have unmonitored agents in production
• Only 21% of organizations report a mature governance model for agentic AI
• Only 7.2% of organizations have a named individual with formal accountability for AI agent behavior
• 70% of large US organizations now use AI monitoring dashboards
• 7% of working Americans say their employer has disclosed how or when AI monitors their work
• 94% of workers say employees should know if AI is being used to monitor their work

How Many Employers Monitor Employee AI Use?

Among US full-time desk workers with at least a bachelor’s degree who used AI for work in the past 12 months, roughly one in five (22%) say their employer actively monitors that use. The EisnerAmper survey was fielded by YouGov from May 28 to June 5, 2025, with 1,017 respondents and unweighted figures.

From the same survey, 36% say their company has a formal AI policy, 41% tell a manager or ask permission before using AI, and 28% say they would use AI at work even if it were banned. Sixty percent rely on free AI platforms, 43% use company-paid external tools, and 24% use internally developed platforms. That split is the reason monitoring is difficult.

Employer-side numbers run significantly higher than worker perception. In Littler’s 2026 Annual Employer Survey, 68% of US employers report a formal policy governing AI use, up from 38% a year earlier. This represents 303 US C-suite executives, in-house counsel, and HR leaders surveyed in March 2026.

ISACA’s 2026 AI Pulse Poll of more than 3,400 digital trust professionals puts formal comprehensive policy at 38%, with 30% reporting a limited policy and 25% reporting none. Ninety percent of ISACA respondents believe employees are using AI in their organization, which puts the policy adoption numbers in context.

In our own survey of 2,000+ U.S. workers for the May 2026 AI in the Workplace Report, 44% said their company does not have a clear AI use policy, or they’re unsure if one exists. At companies with less than 10 employees, that number rose to 59%.

(Sources: EisnerAmper, Littler, ISACA, and Founder Reports)

What Employers Track

As of August 2026, 70% of large organizations now use AI monitoring dashboards. This comes from KPMG’s Q3 2026 AI Pulse Survey, fielded July 24 to August 25, 2026, among 314 US C-suite and business leaders at companies with $1 billion or more in annual revenue. Seventy-four percent said they include cost reviews in their AI approval processes. Forty-three percent have implemented usage or token budgets for employees.

Inside the control layer those companies are building, 59% include data access controls, 53% include security and identity controls, 47% monitor AI outputs, 42% enforce policy and guardrails, and 40% manage model access.

The enforcement mechanics look different. The Littler report finds that 55% of employers have a formal review or approval process for AI tools, 54% restrict what information employees can enter, 45% have a designated AI oversight committee, 45% run due diligence on third-party AI vendors, 43% provide tool-specific training on approved AI applications, and 41% limit AI use for certain functions. About a quarter have risk-based training covering legal, compliance, or ethical considerations. Thirteen percent have implemented no AI governance measures at all.

Company size impacts the details. Among large employers in Littler’s data, 79% have a formal AI policy, 70% have a formal review process for AI tools, and 54% have an AI oversight committee.

(Sources: KPMG and Littler)

What Workers Know About Being Monitored by AI

One of the most eye-opening findings comes from a national survey conducted by David Binder Research for the AFL-CIO. Among 1,164 worker-voters surveyed April 14 to 22, 2026, with a margin of error of ±2.9%, just 7% say their employer has disclosed how or when AI monitors their work. Seventy percent say it hasn’t been disclosed. Twenty-three percent are unsure.

The numbers are drastically different than employee expectations. Ninety-four percent say employees should know if AI is used to monitor their work. That’s an 87-point distance between what workers expect and what workers say they’re getting.

Specific monitoring practices draw strong discomfort. Seventy-one percent would be uncomfortable with their employer using AI to analyze employee screens during work time. Seventy percent say the same about location tracking. In the research memo’s focus groups, workers described these practices as invasive and “creepy.”

Support for formal protections is nearly universal. Ninety-two percent support requiring transparency and accountability when employers use AI. Ninety-five percent support requiring a human to be the final decision-maker on issues affecting individual workers and their employment. Only 6% name employers as the institution most likely to protect them from AI harms, while 38% name labor unions.

(Source: AFL-CIO)

What AI Monitoring Misses

Vendor data gives a different kind of answer than surveys, because it measures behavior rather than asking questions. The 2026 Akamai State of the Internet report, drawing on LayerX browser data from Akamai’s customer base, finds that 47.11% of enterprise AI conversations take place through personal identities rather than corporate-managed accounts.

What’s equally interesting is that 14.4% of AI conversations initiated from corporate email addresses are tied to personal freemium subscriptions, meaning data entering them can be used for public model training despite looking corporate from the outside.

Use is heavily concentrated. Nearly 20% of employees use AI weekly and more than 30% monthly. The average user has 36 AI conversations. The top 5% have at least 144. A small group of power users accounts for the majority of exposure, which argues for risk-based monitoring over blanket surveillance.

Tool-by-tool governance also has limitations. The top four or five AI applications in a typical organization are each used by more than 20% of staff. After the tenth application, usage drops below 5%. By the thirtieth, it approaches zero. Monitoring programs that cover only the most popular tools like ChatGPT and Copilot address only the surface while missing fringe use of other tools.

Browser extensions sit even further outside the governed layer. Almost 18% of users at medium enterprises run at least one AI extension, versus 9.53% at large enterprises. Nearly 75% of AI extensions request high (56.4%) or critical (16.7%) permissions. More than 16% carry known Common Vulnerabilities and Exposures (CVEs), known security vulnerabilities. More than 41% request scripting access, compared to just 15.4% for extensions overall.

Despite the shortcomings, governance is working at the aggregate level. In the 2026 Netskope Cloud and Threat Report, the share of AI users on personal AI apps fell from 78% to 47% year over year, while use of organization-managed accounts rose from 25% to 62%. The figures reflect detected activity across customer organizations, so they may understate what remains invisible.

What about the cost of those shortcomings? The IBM Cost of a Data Breach Report 2026, conducted by Ponemon Institute across 602 organizations for breaches occurring March 2025 to February 2026, finds unapproved AI tools involved in 43% of security incidents, more than double the prior year. Ninety-two percent of organizations that had an AI-related incident lacked proper AI access controls at the time. According to IBM’s July 2026 announcement, about one in four malicious breaches were AI-enabled, averaging $6 million against a $4.99 million global average.

(Sources: Akamai, Netskope, IBM, and IBM)

AI Agent Monitoring Statistics

The agent half of the topic is moving faster quickly. In Gravitee’s April 2026 State of AI Agent Security survey of 750 senior technology leaders in the UK and US, mean monitoring coverage of deployed agents sits near 52%. Ninety percent of organizations have unmonitored agents running in production. Coverage barely improved from the December 2025 wave, which put it at 47%.

Despite those numbers, confidence is high. Ninety-two percent now report confidence in their agent visibility, up from 83% in December.

Pre-deployment controls are thin. Only 20% say all their agents are fully secured and governed before going live. Thirty-eight percent have a named accountable person. Thirty-five percent run an IT or CISO security review. Thirty-four percent have a documented process to pause or revoke access.

Accountability itself is barely formalized. Only 7% of organizations have a named individual with formal accountability for agent behavior. Thirty-two percent say accountability is unclear or situation-dependent, 30% say it’s shared but undefined, and 23% say it hasn’t been discussed. Despite that, 88% of organizations reported an AI agent security incident in the previous twelve months.

Identity design makes the accountability problem worse. Only 22% of teams treat agents as identity-bearing entities. Forty-six percent still use shared API keys. Twenty-six percent of deployed agents can create and task other agents.

Logging is where auditability breaks down. In the 2026 TrueFoundry Enterprise AI Gateway Report, based on more than 200 VP-level practitioners with confirmed live agent deployments surveyed March to April 2026, 76% lack unified logging across models and agent workflows. Fifty-six percent have no centralized governance layer. Only half have step-by-step tracing for their agents. Seventy-eight percent run six or more active tool or MCP endpoints.

The maturity picture across the broader market is similar. In Deloitte’s 2026 State of AI in the Enterprise, based on 3,235 IT and business leaders across 24 countries, only 21% report a mature governance model for agentic AI. Seventy-four percent expect at least moderate agent use by 2027.

However, formalization is accelerating from a low base. In KPMG’s Q3 2026 Pulse, half of large organizations are establishing clear protocols for when and how employees may use AI agents, up from 23% a year earlier. Role-specific guidelines for AI agent collaboration and delegation rose from 21% to 55% year over year.

(Source: Gravitee, Business Wire, Deloitte, and KPMG)

Watching AI Is Not the Same as Controlling It

The most useful framing in the data is that organizations have invested far more in observing AI than in intervening when it misbehaves. In the Kiteworks Data Security and Compliance Risk 2026 Forecast Report, based on 225 security, IT, compliance and risk leaders surveyed in Q4 2025 by Centiment with 97% at organizations of 1,000 or more employees, 42% lack continuous monitoring of AI systems and 41% lack human-in-the-loop controls.

The intervention side runs weaker still. Sixty-three percent cannot enforce purpose limitations on AI agents. Sixty percent have no kill switch to quickly terminate a misbehaving agent.

Shutdown readiness looks similar in ISACA’s AI Pulse Poll preview. Fifty-six percent of digital trust professionals don’t know how quickly they could halt an AI system after a security incident. Thirty-two percent believe they could do it within 60 minutes. Seven percent say it would take longer. Thirty-nine percent don’t know whether they even have a documented process for shutting down or overriding AI systems.

Human oversight is generally thin. Thirty-six percent say humans approve most AI-generated actions before execution. Twenty-six percent say humans review selected decisions after execution. Eleven percent say humans intervene only when alerted. Twenty percent don’t know how oversight works at their organization.

Only 43% of organizations route AI access through a centralized AI data gateway, per Kiteworks. Twenty-seven percent rely on distributed controls, 19% on partial or ad hoc controls, and 7% on no dedicated controls at all governing how AI systems reach sensitive data.

Incidents are climbing faster than response quality. The AI Incident Database recorded 362 incidents in 2025, up from 233 in 2024, per Chapter 3 of the Stanford HAI 2026 AI Index. Among organizations that reported incidents, the share reporting three to five rose from 30% to 50%. Self-rated “excellent” incident response fell from 28% to 18%. The counterweight is that organizations with no responsible AI policies at all fell from 24% in 2024 to 11% in 2025.

(Sources: Kiteworks, ISACA, and Stanford)

How Organizations Are Writing Monitoring Into Policy

Government AI policies are the richest public source of named case studies on this topic, because agencies have to publish what private employers usually keep internal.

The Texas Department of Information Resources AI Acceptable Use Policy states that “all interactions with AI systems may be logged, monitored, and reviewed by authorized DIR personnel” for security, compliance, and auditing purposes. The policy adds that “by using AI systems, DIR Users acknowledge and consent to such monitoring.” It applies to staff, contractors, student interns, and volunteers. This is a model consent-to-monitoring clause.

At the strict end of the spectrum, the Texas Juvenile Justice Department’s General Administrative Policy prohibits unapproved generative AI outright, requires staff to use only tools registered in the agency’s AI System Inventory, requires employees to disclose AI use in significant work products and cite the system used, and states that all AI use is subject to monitoring.

Oregon takes a distributed approach. The state’s Updated Interim Guidance on Generative AI Access and Usage (2026) makes agencies responsible for monitoring compliance, auditing access, and reporting incidents, with Cybersecurity Services and agency IT teams running periodic risk assessments.

The federal Department of the Interior policy (2026) applies to all employees, contractors, and affiliates, and frames access around approved “trust boundaries” rather than a static approved-tools list. Sensitive data handling is separated from public-data handling by work and web modes, and the department commits to periodic assessment of GenAI effectiveness and risk.

Monitoring can be used constructively. The US State Department Generative AI Playbook, published in July 2026, tracks adoption of the agency’s internal StateChat assistant across an 80,000-person workforce by monitoring active users, retention rates, and user profiles across bureaus, roles, geographies, and career levels, “while maintaining user privacy and trust.” The accompanying impact assessment covered 2,113 regular users (those using StateChat at least monthly) and 593 non-users.

(Sources: Texas DIR, Texas JJD, Oregon, US Dept. of the Interior, and US State Dept.)

The Future of AI Monitoring

Spending is increasing to meet the regulatory load. Gartner’s February 2026 forecast estimates AI governance spending at $492 million in 2026, surpassing $1 billion by 2030, with fragmented AI regulation expected to extend to 75% of the world’s economies by the end of the decade. Organizations deploying AI governance platforms are 3.4x more likely to achieve high effectiveness, based on a Gartner survey of 360 organizations in Q2 2025.

Maturity is rising, albeit from a low base. In McKinsey’s State of AI trust 2026, based on roughly 500 organizations surveyed from December 2025 to January 2026, average responsible AI maturity reached 2.3 on a four-point scale, up from 2.0 the year before. About one-third of surveyed organizations reached level three or higher in agentic AI governance. Nearly two-thirds cite security and risk concerns as the top barrier to fully scaling agentic AI.

Litigation pressure is building on employers. Littler reports that 79% of employers are concerned about AI-related litigation over the next 12 months. Leading concerns are data privacy (49%), discrimination or bias (45%), state or local AI laws (43%), recordkeeping or explainability requirements (35%), and wrongful termination or workplace displacement (15%).

(Sources: Gartner, McKinsey, and Littler)

Frequently Asked Questions