Governed AI
How to Run a Franchise AI Usage Audit in One Week
Christian Pillat · January 8, 2026 · 5 min read
A franchise AI usage audit takes about a week and answers three questions: which AI tools your network already uses, whose accounts they sit in, and which of your documents have been pasted into them. Run it anonymously, start with your own headquarters, and promise nobody gets in trouble.
There is no product in this post. A franchise AI usage audit needs one person, a spreadsheet, a survey tool and permission to ask uncomfortable questions.
What a franchise AI usage audit is looking for
Three findings, in ascending order of discomfort.
- Which tools, and for what. Not the brand names — the tasks. What work is handed to a machine tells you what you are failing to support.
- Whose account. Personal, the franchisee's business account, or something you provided. That is the line between an exposure you can manage and one you cannot reach.
- Which of your documents are inside them. Manual pages, training material, financial statements, employee records. This is the finding that changes your legal posture, and nobody volunteers it.
What you are not looking for is a list of names. Say so in writing before anything goes out, and mean it. If the exercise reads as enforcement you get a clean result, the clean result is false, and you act on it.
One reason a week is the right unit: nobody at your headquarters does this for a living. On FRANdata's segmentation of system footprints, national brands — those in thirty-five states or more — are 16% of US franchise systems; the rest are regional or local. At that size the operations lead is also the compliance function, so an audit either fits in a week or never happens.
Days one and two: the anonymous survey
Seven questions. Wording does more work here than the survey tool you pick.
- In the last ninety days, have you used any AI tool for anything to do with running your location?
- Which ones? A checkbox list of the tools you already suspect, plus an "other" box.
- Whose account is it — your own, your business's, or one the brand provided?
- What did you use it for most recently? One open text box, no limit — the most valuable field in the survey.
- Have you ever pasted or uploaded brand material into it? Which kind: manual or policy pages, training material, financials, customer records, employee records, the franchise agreement.
- What is one question you asked an AI tool that you would previously have asked us?
- What stopped you asking us instead?
Four design decisions decide whether any of it is usable. No name field. No location field unless you have enough regions that a region cannot identify one owner. Send it from operations, never legal. Close it after seventy-two hours.
Publish the aggregate back to the network; that is what makes your second survey honest. Questions six and seven will change your roadmap, question five your policy.
Day three: follow the money, and why it under-counts
Start with your own headquarters. It sets the tone, and it is usually where the heaviest usage is.
Then work outward: the marketing fund, location P&Ls under software or dues and subscriptions, brand-domain inboxes for vendor receipts, and your identity provider for accounts opened with brand email addresses. Search memo fields for the vendor names you know plus the generic strings — "AI", "assistant", "copilot", "GPT" — and for small recurring charges on personal cards reimbursed as software.
Put the caveat in your write-up too: this step under-counts badly, because capable free tiers generate no transaction at all. The survey is the measurement; the money is corroboration.
The money produces a structural finding, not a total. Most systems already fund network technology through a fee — 61.9% of franchisors charge one in FDD Item 6, per IFA analysis — and AI sits outside it almost everywhere. The amounts are small; what they sit outside is every instrument you own for managing spend.
Day four: ask the managers, not the owners
Owners answer for policy. Managers and shift leads answer for practice. Do this in person, one at a time, never in a form. Three questions:
- What do you use to write the schedule, reply to a bad review, or build training for a new hire?
- Has anyone here made a saved prompt, a custom assistant or a bookmarked chat with our material in it?
- The last time you needed an answer and could not find it, where did you go?
The middle question is the one nobody thinks to ask, and it finds the most durable exposure in the network. A shared custom assistant loaded with manual excerpts outlives whoever built it and appears in no expense report and no survey response.
Listen for a tool nobody at headquarters has heard of, described by someone slightly proud of it. A manager who built a workaround has written your specification.
Day five: where your documents actually live
The least dramatic step, and the one that produces the number people remember.
- Search your file share for the manual's filename and count the copies. Then count how many are shared with anyone holding the link.
- Pull download logs from the franchisee portal or LMS for the last year. Most systems record this; nobody looks.
- Search sent mail for the manual as an attachment. Email is how the document was legitimately distributed, which is why it is never audited.
- Check departed employees' accounts, any personal drive that held brand material, and any drive owned by a franchisee rather than the brand. A manual in a former field consultant's personal account is still your document, and you cannot reach it.
Someone will want to type your brand's distinctive phrases into a public chatbot to see what comes back. That is not evidence either way — a model repeating a phrase proves little, and silence proves nothing. Exposure depends on which account a document was typed into: does AI train on your franchise data.
What you know on Friday
Three numbers and one list: the share of respondents who used AI for brand work in the last ninety days, the share who put brand material into it, the count of document copies outside your control, and the answers to question six.
Sort the exposure into two piles. What could embarrass you — a confident wrong answer given to a customer or an employee, the territory of AI hallucination franchise operations. And what could cost you: your operating method spread across accounts you cannot administer.
Then do not write the memo. A memo changes only whether people tell you. What you hold is a description of demand, and the case for building around it is governed AI for franchises.
You will remember question six longer than the usage rate: the things your operators wanted to know and asked a machine, because the machine answered. Treat that list as the edit list for your operations manual, written by the people who use it.
Once you can see the demand, serving it is the next job: building the sanctioned route instead of banning use.
Get new posts weekly