How do we check whether staff follow our AI policy?
Compare what the policy allows with what the company actually uses, from three sources. First, the admin consoles of the approved AI services: who has an account, how active it is, which features and connectors are switched on. Second, identity and expense data: sign-ins with company e-mail addresses to services nobody approved, and AI subscriptions on company cards. Third, the network: which devices connect to which AI services, including local model runtimes, and how much data goes to each. A good monthly report shows the approved services and their use, the unapproved ones still in use, and any unusually large transfers, so that the conversation is about facts, not rumours. Keep it about tools and devices rather than individuals unless there is a specific concern, and involve HR or the works council where your country requires it. From the Pro plan, NetSenX gives the network view: hosts, AI services and volumes over time. It does not read what was typed and does not block anything.
This answer is part of the guide: Shadow AI: what it is and how to find it