Acceptance criteria
Report volumes, active users, trends and the sanctioned/unsanctioned split at privacy-appropriate aggregation.
Why it matters
Usage is the denominator for every cost, risk and value figure.
How to verify
Usage by tool, team and function from pilot data, at privacy-appropriate aggregation.
OWASP adoption context
Adoption reporting spans the listed employee AI contexts so sanctioned usage does not hide shadow or agent-assisted activity; privacy limits still govern the telemetry.
Framework mappings
Workforce usage and the sanctioned/unsanctioned split provide technology-monitoring context and inputs to security-performance and acceptable-use review. Adoption volumes and active-user counts alone are business analytics; security conclusions need relevant analysis and follow-up.
The sanctioned and unsanctioned usage split provides policy-performance evidence when included in AI-management-system evaluation. Define the relevant objectives and evaluation method; pure activity volumes do not establish responsible-use objectives or effectiveness.