# VAL-001: Measure AI usage and adoption by tool, team, function and workflow


- Area: AI Usage, Spend & Value

- Verification: Proof of value
- OWASP adoption tier: AT0–AT4

- URL: /r/VAL-001

**Acceptance criteria:** Report volumes, active users, trends and the sanctioned/unsanctioned split at privacy-appropriate aggregation.

**Why it matters:** Usage is the denominator for every cost, risk and value figure.

**How to verify:** Usage by tool, team and function from pilot data, at privacy-appropriate aggregation.

**OWASP adoption context:** Adoption reporting spans the listed employee AI contexts so sanctioned usage does not hide shadow or agent-assisted activity; privacy limits still govern the telemetry.

**Mappings:**
- NIST CSF 2.0: DE.CM-03; SOC 2: CC7.2; ISO 27001: Cl. 9.1, A.5.36 — Workforce usage and the sanctioned/unsanctioned split provide technology-monitoring context and inputs to security-performance and acceptable-use review. Adoption volumes and active-user counts alone are business analytics; security conclusions need relevant analysis and follow-up.
- ISO 42001: Cl. 9.1 — The sanctioned and unsanctioned usage split provides policy-performance evidence when included in AI-management-system evaluation. Define the relevant objectives and evaluation method; pure activity volumes do not establish responsible-use objectives or effectiveness.