Where AI Productivity Monitoring Turns Into Surveillance

By Victor Hoang · Updated Oct 11, 2026

Somewhere in your company, someone is about to ask a reasonable question: now that everyone has AI, can we see who's actually using it and how productive they are? The answer is yes. You can see almost everything. You can count prompts, log active minutes per tool, score keyboard rhythm, and summarize each person's day into a tidy dashboard.

Being able to see it isn't the same as it being worth seeing. Our position: AI makes activity tracking cheap and granular, and that is exactly why leaders should measure outcomes and workflow change instead, and publish a line they won't cross on monitoring. Past that line you stop measuring work and start surveilling people, and the cost shows up in trust and in the quality of the numbers themselves.

This piece is about the monitoring question: what to watch, what never to watch, and how to say so in writing. It's different from how AI changes performance reviews, which asks what a good performer looks like once AI inflates output. Here we ask what you're allowed, and wise, to observe at all.

Key Facts

• Microsoft's 2022 Work Trend Index found that 85% of leaders said hybrid work made it hard to be confident employees were productive, while 87% of employees said they were productive, even though hours worked, meetings and other activity metrics had increased. Microsoft called the gap "productivity paranoia."
• The UK Information Commissioner's Office (ICO) says that while data protection law doesn't prevent monitoring, you must be clear about your purpose and select the least intrusive means to achieve it, and that you should not monitor workers "just in case."
• The ICO also says monitoring done without transparency could negatively impact trust relationships, and that you must run a data protection impact assessment before any processing likely to cause high risk to workers.
• The EU AI Act prohibits AI systems that infer the emotions of a person in the workplace, except for medical or safety reasons (Article 5(1)(f)).
• The same regulation lists AI systems used to monitor and evaluate the performance and behaviour of workers among its high-risk uses (Annex III, point 4).
• A 2024 study (revised 2025) by Sum, Shi and Fox, based on Reddit posts and worker interviews, found that workers respond to surveillance with everyday resistance, including technological workarounds. It's a qualitative study, not a measure of how common gaming is.

Why the Temptation Is Getting Stronger

Monitoring used to be expensive. Watching a hundred people closely took managers, time and awkward conversations, so companies mostly didn't. AI changes the economics in two ways.

First, collection is nearly free. Every AI tool you license produces logs: who used it, when, how often, how long. Nobody had to build anything. The data simply exists, and it arrives labeled "adoption."

Second, interpretation is nearly free too. A model can summarize a week of someone's activity into a paragraph and a score. That feels like insight. Often it's just activity, restated with more confidence.

The pressure behind it is real. Leaders are being asked what the AI spend is producing, boards want proof, and remote or hybrid teams removed the hallway cues managers used to lean on. Microsoft's data shows the shape of that anxiety: leaders doubted productivity while the activity numbers they could see were climbing. More visibility into activity didn't produce more confidence. It produced a measurement gap, because activity was never the thing leaders cared about.

Where Measurement Ends and Surveillance Begins

Here's a mental model we use: the Signal Ladder. Rank every metric by how close it sits to the result you actually want, and how much it asks of the person being measured.

1. Outcomes. Revenue closed, tickets resolved correctly, cycle time from request to delivery, defects found downstream, customer satisfaction. Close to the result. Hard to fake without doing the work.
2. Workflow change. Which processes now run differently because of AI, and what happened to their time, cost and error rate. Measured at the process level, not the person level.
3. Adoption and capability. Is the tool available, are people trained, are teams using it for the use cases it was bought for? Useful as team-level context, dangerous as an individual score.
4. Raw activity. Keystrokes, mouse movement, active minutes, screenshots, prompt counts per person, webcam checks. Far from the result, easy to inflate, and the most intrusive to collect.

The rule that follows is simple: climb the ladder, don't descend it. If you can answer your question with rung 1 or 2 data, rung 4 data is surveillance you didn't need. And if you find yourself reaching for rung 4, ask what question you're really trying to answer. Usually it's "are people doing the work?", which is a management conversation, not a data problem.

The ICO's guidance draws the same line from a legal angle. Its worked example describes an employer who finds a few remote workers started later than their timesheets said, then rolls out device monitoring that lets managers see automatic webcam images. The ICO says that's likely to infringe data protection law because it's disproportionate: the employer could check log-in times and let people explain discrepancies. The principle is least intrusive means, and it applies to your AI dashboards as much as to webcams.

Why Activity Tracking Backfires

There are three failure modes, and they compound.

It destroys the signal. Once people know a number is watched, they manage the number. That study found workers describe workarounds and commiserating with coworkers as their response to opaque monitoring. You don't need a survey statistic to see the logic: if "prompts per day" feeds a rating, someone will run a prompt loop. You then have a dashboard full of AI usage and no information about whether anything improved. This is the same problem that makes output volume a poor proxy for contribution, now with a surveillance layer on top.

It erodes trust, which AI adoption needs. People adopt AI when they feel safe experimenting, making mistakes and admitting what they don't know. An employee who suspects every prompt is logged and scored will stick to safe, visible, low-risk uses, and hide the experiments that might actually change the work. That's the opposite of what an AI program needs, and it connects directly to how leaders handle job anxiety around AI. Monitoring someone who already fears for their job reads as the first step to replacing them. Psychological safety isn't a soft extra here. It's the condition under which honest AI use happens.

It tells you about the tool, not the person. Activity scores from AI-assisted work blur two things: how hard someone worked and how much the tool did. Two employees with identical keystroke patterns can be producing very different value, and the metric can't tell you which is which.

Notice what we're not claiming. We aren't saying all monitoring is illegitimate, or that every employer who tracks anything is wrong. Security logging, safety monitoring and fraud detection have clear purposes and clear limits. The problem is open-ended, individual-level productivity scoring, where the purpose is vague and the data is cheap.

The Legal Floor Is Higher Than Many Leaders Assume

You don't need to be a lawyer to know the direction of travel, but you do need to know it exists.

In the UK, the ICO's monitoring guidance expects you to define your purpose and document why you're monitoring. It says you should not monitor workers "just in case," that you must tell workers about monitoring in an accessible way, and that, apart from very exceptional circumstances where covert monitoring is justified, monitoring has to be disclosed. It says you should seek and document the views of workers or their representatives before introducing it, unless there's good reason not to. And it asks for a DPIA before processing likely to cause high risk, with overall responsibility for monitoring resting at the highest senior management level.

In the EU, the AI Act goes further for AI-specific tools. Article 5(1)(f) prohibits using AI to infer emotions in the workplace, with a narrow medical or safety exception. So "sentiment" or "engagement" scoring from voice, face or video of employees is not a gray area in that market. Separately, Annex III lists AI systems used to allocate tasks based on individual behaviour or to monitor and evaluate the performance and behaviour of workers as high-risk, which brings additional obligations on providers and deployers. If you operate across borders, take advice from counsel on how these apply to your tools and your workforce.

The practical point for a leader: the legal frameworks and the management logic point the same way. Be clear on purpose, collect less, tell people, and don't use the most intrusive method when a lighter one will do.

What to Measure and What Never to Measure

Here's the decision table we'd put in front of a leadership team.

Two notes on the table. First, "Never" means never as a standing practice. A specific, documented investigation with a stated purpose is a different thing from a continuous feed. Second, the middle column is deliberately boring. Outcomes and process data are less exciting than a live activity dashboard, but you can defend them to an employee, a regulator and a board.

If you do tie any of this to ratings, remember the earlier point about fairness: adoption patterns can correlate with age, tenure or role, so treat any individual-level use with extra care and legal review.

An Illustrative Example

Illustrative scenario, not a real company. A 150-person professional services firm rolls out an AI writing assistant. The COO's first instinct is a weekly report of usage per consultant, ranked.

Instead, the leadership team picks three workflows: proposal drafting, client status reports, and meeting follow-ups. For each, they record a baseline: hours to produce, revision rounds, client edits. After 60 days they review the same numbers. Proposals drop from two days to one and a half with the same win rate. Status reports show no change, which tells them the tool or the training is wrong for that job, not that the consultants are lazy.

Nobody's keystrokes were logged. The team-level adoption figure (which groups used the tool for its intended jobs) went into the review as context. When one manager notices a consultant isn't using the tool at all, she talks to him, learns his clients forbid AI-assisted drafting, and the team adjusts the plan. A dashboard would have flagged him as a laggard. The conversation found the real constraint.

Publish the Line

The most useful thing you can do is write down what you will and won't do, and show it to everyone. We call this the monitoring charter. Keep it to one page. It should answer:

• Purpose. What we monitor and why, in plain language. No "just in case."
• Never. The practices we won't use: covert monitoring, emotion or sentiment inference, webcam or screen capture for productivity, per-person AI usage rankings.
• Level. What is measured at the team or process level, and what is ever individual.
• Access. Who can see what, and for how long data is kept.
• Process. How workers are consulted before changes, how they can raise concerns, and who is accountable at senior level.
• Review. When the charter is revisited, and who signs it.

Publishing it does three things. It forces you to decide, because you can't write a vague line down. It gives managers a reason to say no when a vendor demo or a board member asks for more data. And it tells employees the truth, which is what the ICO means when it says building trust starts with transparency.

What to Do Next

This fits inside a quarter.

1. Inventory what you already collect. List every tool that logs employee activity, who can see it, and what question it answers. You'll likely find monitoring you didn't choose, shipped as a default setting.
2. Place each metric on the Signal Ladder. Anything on rung 4 needs a documented purpose or goes. If rung 1 or 2 data can answer the question, stop collecting rung 4.
3. Pick three to five workflows and set baselines. Measure AI's effect where the work happens. This is the evidence your board actually wants, and it connects to a wider AI workforce roadmap.
4. Draft and publish the monitoring charter. Consult employees or their representatives first, and involve legal counsel and your data protection lead. Run a DPIA wherever monitoring could be high risk.
5. Equip middle managers. They are the ones who will use judgment instead of dashboards, and they decide whether AI programs land. Give them questions to ask, not scores to read.
6. Review quarterly. Check whether the numbers you collect are still answering a live question. If a metric hasn't changed a decision in two quarters, drop it.

The test is easy. Ask an employee what you track about them and why. If they can tell you the same thing your charter says, you're measuring. If they guess, you're surveilling.

Learn More

• The New Performance Review: How AI Changes How You Measure People
• How Leaders Should Respond to AI Job Anxiety
• Middle Management: AI Obstacle or Opportunity
• Is AI Making Teams Less Collaborative?
• Psychological Safety in Leadership
• Trust When Your Teammate Is AI
• OKR vs KPI