After the sugar rush of AI investments, organizations are now starting to grapple with the ROI question and wondering what they’ve got to show for it.

Organizations typically measure AI adoption in terms of seats purchased, tokens consumed, and monthly active users. But this tells us nothing about whether the investment is working, which teams are actually using AI, or what they are doing with it.

And this issue is compounded by employees interchangeably using AI tools with employer-provided enterprise accounts often used for things that have nothing to do with their jobs.

Workers Don’t Differentiate Between Paid and Free Tools

An analysis of nearly 2 million minutes of at-work AI use found that workers largely bring identical tasks to whichever AI tool they have open at the time, regardless of whether it is employer-provided or personal, free or paid. When they’re using their own personal AI tools at work (this includes free versions of ChatGPT, Claude and Gemini), 64% of the time they’re using them for business related activity.

This could of course be well-intentioned - employees might have spotted a compelling reason to use a tool that their company hasn’t provided them with for instance. But the net result is that information ceases to be company-controlled and that unless controls are in place, this activity is also completely invisible to an employer.

Employers won’t know for instance what intellectual property might have left the business, what customer information could have leaked from a secure environment or if they have broken data protection laws. When an employee leaves the business, this information also leaves with them which is a particular concern if moving to a competitor.

Some tools are riskier than others, free versions of US-based tools will state they ‘train on data’, which whilst opaque is still arguably safer than those based in China which offer no reassurance whatsoever and could ultimately be overseen by its Government.

 ‘Shadow AI’ use also makes it impossible to measure good outputs from these sessions. If employees are doing great work for their companies on personal tools, it’s impossible to see.

Only 75% of in Work AI use has a Business Purpose

But when enterprise tools are used in the workplace, the research found that 45.6% of employees' personal AI activity flows through them. It also found that just 74.6% of all in-work AI use is business with the remainder either clearly personal use or ‘ambiguous'. Unless companies can separate this usage, they are very likely ‘heroing’ AI employees on ‘leaderboards’ which don’t deserve it whilst burning through their tokens - and still being no closer to quantifying what real ROI looks like.

Legal Most Likely to use Official Tools, but Marketing Goes Freestyle

Not all business departments are equal - both in terms of their AI use overall and their uptake of enterprise tools vs personal. Legal is significantly ahead on both counts using 19.5% of all enterprise AI hours across the entire business, ahead of ‘go to market’ on 17.7%, design and development on 13.3% and strategy on 11.9%. Legal also uses 32.3% of total hours across the business on enterprise plans with just 3.6% on total usage via personal accounts.

‘Go to market’ on the other hand uses just 10% of its total hours on enterprise tools with 28.6% of all company usage taking place on personal accounts. This is perhaps reassuring - legal departments handle some of the most sensitive information in the business and are aware of the implications should it leak. Marketers on the other hand are reaching for whatever tool they think will get them ahead and either less concerned or oblivious to the consequences.

Little Variation in Tasks no Matter What Tool Used

Interestingly, when assessing how the main six AI tools (ChatGPT, Claude, DeepSeek, Gemini, Microsoft Copilot and Perplexity) are actually used we found little difference of what work they’re tasked with. Efficiency and automation tasks dominate AI usage across all tools and account for 47% of overall work. This is followed by risk and compliance and decision support at 20% each, then revenue and growth at 7% and innovation and creation at 6%.

There are some slight tool-specific nuances. Claude is favored for decision support with 31% of its usage dedicated to that task versus just 17% for ChatGPT.

Microsoft Copilot is the tool of choice for efficiency with 57% of its use geared towards that, but the overall hierarchy holds across every platform.

For security teams it means work is concentrated in efficiency, risk, and decision support - the categories that carry meaningful data exposure regardless of which AI an employee opens.

Monitoring and Measuring all AI use - Whether Sanctioned or Not

Simply providing an employee with an AI tool doesn’t mean it’s the one they will use or in the right way, but the risk can be managed by taking the following steps:

• Monitor personal accounts as well as enterprise accounts - with 64% of business use taking place on personal accounts, Teams that govern only corporate-issued AI accounts are governing a minority of where work actually happens.

• Session depth reveals far more than event counts - many dashboards only measure events - a 12-minute Claude session on a contract review counts the same as a 10 second quick query on ChatGPT guest despite the two being completely different in terms of contribution to meaningful work and material data exposure risk

• Detect meaningful work - Vendor dashboards report seats, tokens consumed, and monthly active users. These numbers measure adoption, not value. Instead look at what tasks tools are being used for and their outcomes e.g. with 47% of use geared towards efficiency and automation this is a strong indicator of workflow acceleration that is potentially delivering measurable results.