What's Happening?
Measuring AI adoption within organizations often relies on vendor-provided metrics like active seats or weekly users, which primarily reflect engagement with purchased tools. However, this approach creates a significant blind spot, as it fails to account
for a substantial portion of AI usage. According to Arthur, a comprehensive understanding of AI adoption requires three layers of measurement: footprint, usage, and impact. The 'footprint' layer, which tracks what AI tools are actually installed and running across an organization's devices and cloud platforms, is largely missing. This means that command-line agents, personal AI agents installed by employees, and team-built agents on cloud platforms often go uncounted. Surveys, such as Gallup's May 2026 report, indicate that self-reported AI usage by U.S. employees (52% use AI at work) already outpaces official rollouts, highlighting the gap in organizational visibility. A KPMG Q2 2026 pulse also found that 42% of leaders have only partial visibility into AI spending, further underscoring the lack of a complete 'footprint' understanding.
Why It's Important?
The inability to accurately measure the full 'footprint' of AI adoption presents several critical challenges for U.S. businesses. For security teams, this blind spot represents a significant risk, as unsanctioned or unmonitored AI tools can introduce vulnerabilities and data privacy issues. For Chief AI Officers (CAIOs), it leads to measurement errors, making AI programs appear smaller and more orderly than they truly are, thus hindering effective strategy and resource allocation. Without a clear understanding of what AI tools are in use, organizations cannot effectively manage costs, ensure compliance, or accurately assess the return on investment (ROI) of their AI initiatives. The discrepancy between official adoption numbers and actual employee usage suggests that companies may be underestimating the true extent of AI integration, potentially missing opportunities for optimization or failing to address widespread shadow IT practices related to AI.
What's Next?
To gain a more accurate understanding of AI adoption, organizations need to prioritize building the 'footprint' layer of measurement. This involves implementing environment scans to identify all AI agents and tools installed across devices and cloud accounts, distinguishing between sanctioned and unsanctioned usage. While usage data from vendor consoles remains valuable, it should be treated as tool-specific and not aggregated across disparate systems that define metrics differently. The ultimate goal is to connect AI adoption to tangible business and quality metrics, such as cycle time, throughput, defect rates, revenue, and cost, rather than relying on easily inflated self-reported time savings. This comprehensive approach will enable CAIOs to develop a more honest and actionable scorecard, allowing for better governance, risk management, and strategic decision-making regarding AI investments. Tools like Arthur's open-source scanner, Deckard, are emerging to help organizations establish this crucial 'footprint' layer.
Beyond the Headlines
The challenge of measuring AI's true 'footprint' within organizations points to a broader issue of digital governance and the evolving nature of work in the AI era. The proliferation of personal and team-built AI tools, often outside official procurement channels, reflects a growing trend of 'shadow IT' driven by employee initiative and the accessibility of AI. This phenomenon raises questions about corporate control versus employee autonomy, and the need for policies that balance innovation with security and compliance. The lack of visibility into AI usage could also mask potential biases or ethical concerns embedded in unmonitored AI applications, which could have legal and reputational consequences. Ultimately, the struggle to measure AI adoption highlights the need for a more adaptive and holistic approach to technology management that acknowledges the organic ways in which new tools are integrated into daily operations, moving beyond traditional IT oversight models.
