The answer to “what AI are we using?” In a document you can send.
Dashboards are for the people who run a programme. Everyone else wants a document. The GhostAudit AI usage report turns a period of measurement into a PDF or Word file that a leadership team, a customer or an auditor can read in ten minutes.
Pages from an example report. Organization, names and figures are illustrative.
Sensors on 486 devices recorded 23 AI tools in the period. Three sanctioned tools account for 81% of active time. Seven tools in use are not in the AI inventory.
- ChatGPT Enterprise
- Microsoft 365 Copilot
- GitHub Copilot
- Claude
- Cursor
- Otter.ai
- Sanctioned
- Under review
- Unsanctioned
- 1Review 7 tools that are not in the inventoryClaude and Cursor account for most of the use.
- 2Release or reassign 117 inactive seatsAn estimated $4,332 per month across 4 licences.
- 3Set an approved alternative for Cursor64 people use it; no nudge is configured.
Identity mode: pseudonymous. This report contains no names or email addresses.
- Formats
- PDF and Word
- Period
- 7 to 90 days
- Written by
- Fixed rules, no language model
- Plans
- Included in every plan
Six sections, in the order a reader asks the questions.
The report has a fixed outline, so two reports from different quarters can be laid side by side.
It opens with an executive summary: how many AI tools are in use, by how many people, where the time goes, how that compares with the period before, and how many of those tools are approved or missing from your inventory. AI tools in use lists each tool with its status and volume. Use by department appears when your identity mode and employee directory allow it. Licence utilisation sets the seats you pay for against measured use, with the savings estimate. Recommended next steps names up to six actions. Methodology and privacy closes the report with what the sensors collect, what they never collect and the identity mode in effect.
Sections that do not apply are left out, not padded. A workspace with no licences recorded gets no licence section. A workspace that has not collected data yet gets a short document that says so and lists what to do first.
- 01Executive summaryHeadline numbers for the period, where the time goes, and how policy and inventory stand.
- 02AI tools in useEvery tool seen, with its approval status, people, devices and active time.
- 03Use by departmentIncluded when identity mode and your employee directory allow it. Left out otherwise.
- 04Licence utilisationSeats against measured use per licence, with the savings estimate. Included when licences are recorded.
- 05Recommended next stepsUp to six actions, chosen by fixed rules over the numbers above.
- 06Methodology and privacyWhat sensors collect, what is never collected, and the identity mode in effect.
The same data always produces the same report.
The summary and the recommendations are produced by fixed rules over the numbers, not by a language model. If seven tools in use are missing from the inventory, the report says so and recommends reviewing them; if a licence has idle seats, it says how many and what they cost.
That has two consequences worth knowing. The report will never contain a plausible sentence that the data does not support. And nothing about your workforce's AI use is sent to a model provider to produce it.
The numbers are the ones on the AI usage screen for the same period. Each download is written to the audit log with the period and format.
- Rule-based narrative: reproducible, and checkable against the product
- No usage data sent to a language model
- Every export recorded in the audit log
Example workspace. Names and figures are illustrative.
The report covers the period selected on the page and compares it with the period before. Each download is written to the audit log.
Built to be forwarded.
A report gets forwarded, so it is built to contain as little about individuals as it can.
People are named in one place only, and only if your organization runs in named identity mode: the appendix of licence seats to review, which exists so that someone can act on it. Everything else in the report is counts. A version without that list of names can be requested through the API.
In pseudonymous or anonymous mode there are no names or email addresses anywhere in the report, because GhostAudit does not hold any. In anonymous mode the report counts devices and has no department breakdown.
As everywhere in GhostAudit, there are no prompts, page contents or web addresses in it. The methodology page says this in words a non-specialist can follow, which makes the report suitable for a works council or a customer.
Who asks for it.
Leadership. "Are we using AI, and is it under control" answered with numbers, once a quarter.
Customers. Security questionnaires increasingly ask how you govern employee use of AI. The report is evidence that you measure it. Our guide to answering those questions shows where it fits, and on Govern the answers themselves can be drafted from your records.
Finance. The licence section is the case for releasing idle seats before a renewal.
The end of a trial. Fourteen days of measurement produce a first report you keep whether or not you subscribe. Downloading it is one of the steps on the getting-started checklist a new workspace sees.
It is also the written deliverable of the AI Governance Starter, where our team runs the first 30 days and walks you through the findings.
Report details
- Formats
- PDF and Word (.docx). The same content is available as JSON through the API.
- Period
- Any length from 7 to 90 days, compared with the same number of days before it.
- Sections
- Executive summary; AI tools in use; use by department; licence utilisation; recommended next steps; methodology and privacy.
- Names
- Only in named identity mode, and only in the list of licence seats to review (up to 40 rows). The API parameter
names=falseleaves that list out. - Generation
- Deterministic rules over stored aggregates. No language model is involved.
- Audit
- Each export is recorded with the user, period and format.
- Plans
- Included in every plan and in the trial. See pricing.
Questions
- Can we put our own logo on it or change the wording?
The Word version is an ordinary document that you can edit and brand. The PDF is produced as is.
- Is it the same as the board AI risk report?
No. The usage report describes measured AI use and is part of every plan. The board AI risk report is one of the governance documents in Govern; it covers risk posture, assessments and the regulatory horizon.
- Can it be scheduled or emailed automatically?
Yes. An owner or admin can schedule it weekly or monthly to up to five recipients as a PDF, and the last twelve reports stay available under report history on the AI usage screen. Sending needs email to be configured for the deployment; until it is, scheduled reports are generated and kept for download. Names are included only when the workspace uses named mode and every recipient is an owner or admin.
- How much data does it need?
It can be produced as soon as sensors have reported. A period of at least two weeks, with most of the intended devices enrolled, gives numbers worth circulating.
Get your first report at the end of a trial.
Start a 14-day trial with every Govern feature, connect one discovery source and enroll a handful of devices. No card is needed to start, and nobody is asked to change how they work.