How to Monitor ChatGPT Usage in Your Company (2026 Guide)

To monitor ChatGPT usage in a company you need to cover three separate channels: ChatGPT Enterprise or Edu workspaces (through OpenAI’s Compliance API), personal ChatGPT accounts used for work (through a browser extension or an AI-aware proxy), and OpenAI API usage from internal apps (through the Usage API or an API gateway). Each channel needs a different method. Most organizations that think they “monitor ChatGPT” are only covering one of them.

This guide walks through each channel, what you can capture, how to deploy it, and how to do it in a way your employees and works councils will accept.

Step 0: decide what you want to know

Before choosing tools, write down the questions you need answered. They usually fall into four groups:

• Adoption: How many people use ChatGPT? Which teams? Is usage growing after rollout?
• Risk: Is sensitive data being pasted in, such as customer records, code, credentials or health information? Are people using personal accounts instead of the company workspace?
• Cost: Are we paying for seats nobody uses? How much are we spending on the API, and for what?
• Value: What are people using it for? Which use cases work well, and where do people struggle?

Adoption and cost questions often need only metadata. Risk and value questions usually need some content analysis, and that is where privacy design matters.

Channel 1: ChatGPT Enterprise and Edu workspaces

If your organization licenses ChatGPT Enterprise or Edu, OpenAI provides a Compliance API that workspace owners can turn on. It exposes conversations, messages, file uploads, users and custom GPTs in your workspace.

What you can do with it:

• Count active users and conversations by user and, when joined to your directory, by department.
• Find seats assigned to people who haven’t used ChatGPT in 30, 60 or 90 days.
• Run DLP detectors over conversations and uploads after the fact.
• Inventory custom GPTs and see which are shared broadly.

Limits: It is an after-the-fact feed. You can alert, investigate and train, but you can’t stop a prompt from being sent. It also doesn’t see personal accounts.

In PromptGlass this is the OpenAI connector: paste the workspace ID and a compliance key, and usage appears alongside other AI tools.

Channel 2: personal ChatGPT accounts used for work

This is the channel most organizations miss. Employees who prefer their own Plus or free account, or who don’t have an enterprise seat, use ChatGPT in the browser with personal credentials. Nothing appears in the workspace logs.

There are two ways to see it.

Option A: a managed browser extension

A browser extension pushed through Intune, Jamf, Google Admin or Group Policy can:

• Tell when a user is on ChatGPT with a personal account rather than the company workspace.
• Capture the prompt at submit, plus pasted content and file uploads.
• Show a coaching message before sending, for example “This looks like customer data. Please use ChatGPT (Acme workspace)”, with a link to switch.
• Redact or block sensitive content inline if your policy requires it.

It’s quick to deploy, needs no network changes and covers remote users. Its main gap is browsers the extension isn’t installed in, so pair it with browser management policies that limit unmanaged profiles.

Option B: an AI-aware forward proxy

An AI-aware proxy decrypts traffic only for AI domains and parses the ChatGPT web protocol to extract prompts. It covers every browser and the ChatGPT desktop app on managed networks or devices that route through it. It needs a trusted certificate on endpoints, and either a PAC file or a rule in your existing secure web gateway that forwards AI traffic to it.

Many organizations use both: the extension for rich in-browser coaching, and the proxy as a backstop.

Channel 3: the OpenAI API

Internal apps, scripts, agents and developer tools call the OpenAI API directly. You have two options.

The Usage and Costs APIs (with an admin key) give tokens and cost by project, model and API key. They are easy to set up and good for spend tracking, but they don’t show which person or feature made a call, and they can’t do DLP.

An API gateway is a drop-in endpoint compatible with the OpenAI SDK. Apps change their base URL:

export OPENAI_BASE_URL=https://ai-gateway.example.com/v1

Every request then gets attribution (team, app, optionally end user), inline detection and redaction, budgets, rate limits and per-request cost. Issuing virtual keys per team means real OpenAI keys never sit in application configs.

What to capture and what to keep

Monitoring doesn’t mean storing every prompt forever. Choose a storage mode for each kind of event:

A sensible default is metadata for everything, redacted content for policy hits, and short retention for content (30–90 days).

Doing it in a way people accept

ChatGPT monitoring fails when employees discover it by accident. Build trust from the start:

1. Announce it. Explain what’s captured and why: protecting customer data, steering people to safe tools, understanding where AI helps.
2. Pseudonymize by default. Analysts should see “Finance, user u_7f3a” rather than names. Revealing an identity should need a reason and a second approver.
3. Report teams, not individuals. Hide groups smaller than five.
4. Coach before you block. A helpful message at the moment of risk teaches more than a silent block.
5. Involve works councils early in regions where co-determination applies. Restrict storage to metadata for those groups if needed.

A rollout checklist

• Connect the ChatGPT Enterprise workspace through the Compliance API.
• Connect the OpenAI organization through the Usage API with an admin key.
• Deploy the browser extension to a pilot group in log-only mode.
• Publish a transparency notice and link it from the acceptable-use policy.
• Review two weeks of data: personal vs workspace share, top data classes, idle seats.
• Turn on coaching for personal accounts and for sensitive data classes.
• Route internal apps through an API gateway with per-team virtual keys.
• Reclaim idle seats and reassign them to people on the waiting list.

Covering all three channels gives you one consistent view of ChatGPT across your organization: who uses it, for what, at what cost, and with what data. That’s the starting point for every other AI governance decision.