---
title: One Manager Misusing Claude's New Smart Reports Feature Can Expose the Whole Company to Fines
description: Claude Enterprise's smart reports feature lets team leads put names to staff AI sessions, and under EU law one manager's misuse can expose the whole company.
author: Darie Nani (Editor-in-Chief)
date: 2026-11-02T15:10:12.075Z
updated: 2026-11-02T15:10:12.101Z
canonical: https://www.sovereignmagazine.com/article/claude-enterprise-smart-reports-employer-risk
image: https://cdn.nanimediahouse.com/pexels-close-up-of-office-workers-engaged-in-a-tech-project-at-a-mo-6803551.jpg
categories: Artificial Intelligence
content_type: News
region: Europe
publication: Sovereign Magazine
about:
  - type: Organization
    name: Anthropic
---

Anthropic's new smart reports have Claude read a sample of a team's conversations and summarise them for an administrator or team lead, and one account setting lets that reader see which employee was behind each session.

[Anthropic says](https://support.claude.com/en/articles/16893491-get-started-with-smart-reports) the reports help companies understand adoption and plan spending, and that they "aren't designed and should not be used for evaluating individual performance or making employment decisions". The product does not enforce that, and the feature turns reading what staff wrote to Claude into a routine budget task for team leads.

That disclaimer may not be enough under the EU's AI rules. If a manager misuses the feature to judge staff, the company can be fined under European data law, whether or not it ever meant to monitor anyone.

Smart reports became available to all Claude Enterprise customers on 28 October. An administrator, or a team lead given delegated access, picks a team and up to the last 28 days. Claude reads a sample of that team's chat, Claude Code and Cowork sessions and reports what the team worked on, what it cost and where it got stuck. A section called Inefficiencies counts sessions that produced nothing usable and sessions that were personal or off-topic, with their cost. Reports arrive by email and 10 a month are free. An account owner, one of the company's top-level Claude administrators, has to switch the feature on.

Anthropic, which publicly refused to let its AI be used for mass domestic surveillance in its [dispute with the Pentagon](https://www.sovereignmagazine.com/article/judge-blocks-pentagon-anthropic-ban), built in limits. Names show as "User" by default. Sessions that touch restricted topics, including health, union activity, political or religious views, personal life and feelings about a named colleague, are never summarised, and personal chats appear only as a count and a cost.

## One Switch Lets Anyone Reading a Report See Who Was Behind Each Session

Names stay hidden until an account owner turns on a single switch in the account settings, in the same place as the switch that turns smart reports on. It is labelled "Allow attribution to individual users" and is off by default. Nothing in that label says who gets to see the names: once the switch is on, anyone who opens a report, including team leads with delegated access, can reveal the employee behind each session from inside the report. Each reveal is logged, not blocked.

The design relies on the account owner understanding this. An account owner can turn the switch on without realising what it allows, or turn it on once and forget about it, and it then applies to every report that follows, whoever runs it. A single switch with an unclear label is weak protection for a setting that decides whether managers can see which employee was behind each session.

## Smart Reports Make Reading Staff Chats a Routine Budget Task

A report takes a team, a date range and a click, and Anthropic sells it on spend and adoption: one Help Center use case is "Bring evidence to renewals". Personal chats appear in it as an inefficiency with a price attached. Running reports can be handed to team leads who are not administrators, and Claude does the reading, so nobody has to sit through transcripts.

Tools that read message content, such as Microsoft Purview and Google Vault, are used by compliance and legal teams and need special roles and licences. Microsoft's Viva Insights never uses the text of emails or meetings, and OpenAI says the task analysis in ChatGPT Enterprise "does not expose individual prompts or conversations". Claude Enterprise customers could already pull full chat content through Anthropic's Compliance API. A smart report puts a summary of each session in front of a team lead.

Microsoft removed user names from Productivity Score, its tool for measuring how staff used Microsoft 365, in 2020 after criticism. Jared Spataro of Microsoft wrote that the change "will ensure that Productivity Score can't be used to monitor individual employees".

In May, Italy's data protection authority warned an Italian start-up whose plug-in read staff Slack and Teams chats to gauge stress, even though employers saw only aggregate results, and told it to prevent even indirect employer access to how staff feel.

## Anthropic's Disclaimer May Not Be Enough Under EU AI Rules From December 2027

The EU AI Act treats AI used to monitor and evaluate workers' performance and behaviour as high-risk, which brings extra obligations for the company that makes it. Whether a product falls into that group depends on what its maker says it is for, and Anthropic says smart reports are not for judging individuals. The European Commission's draft guidance says such a statement is not enough when a product's features make that use foreseeable. Smart reports let a team lead put names to session summaries and add questions that are answered for every session. Those rules apply from 2 December 2027, after [the EU delayed them](https://www.sovereignmagazine.com/article/ai-summit-barcelona-2026).

## Employers Can Be Fined When One Manager Misuses Smart Reports

For employers, the risk applies now, under data protection law. The EU's top court ruled in December 2023 that a company can be fined for data protection breaches committed by anyone acting for it in the course of its business, and that its management does not need to have acted or even known. The company must still have been at least negligent, a test the court said is met when it "could not be unaware" that the conduct was unlawful.

Reusing staff chats for management reporting is a new purpose, so under European data law staff must be told first, and systematic monitoring of employees normally needs a formal risk assessment. Fines go up to 4% of global turnover or €20 million, whichever is higher, and up to 4% or £17.5 million in the UK.

Italy's data protection authority fined Intesa Sanpaolo €31.8 million in March, Italian media reported, after one employee made more than 6,600 unjustified look-ups of 3,573 customers' accounts over two years and the bank failed to stop or spot them. In 2020 Hamburg's data protection authority fined H&M €35.3 million because managers at a service centre had kept notes on staff illnesses, family problems and religious beliefs from return-to-work chats, readable by up to 50 managers.

In Germany, a company with a works council, an elected staff body, needs its agreement before bringing in any tool able to monitor staff, whatever the employer intends, and the council can go to court to stop one used without it. A Hamburg court found in 2024 that a works council had no say over staff use of ChatGPT only because the employer received no data about it, according to the law firm Gleiss Lutz. A smart report gives the employer that data. France, Italy and the Netherlands also require staff representatives to be consulted or to agree.

A manager who used the feature to judge a worker could also break Anthropic's [usage policy](https://www.anthropic.com/legal/aup). From 12 November it treats using Anthropic's AI to evaluate a worker's performance or behaviour, including to discipline or dismiss them, as high-risk: a qualified person must review the output and the worker "must be clearly told that AI was used". Internal summaries that are not the final recommendation are exempt.

## FAQ

**Q: Can my employer see what I am doing with Claude?**
On Claude Enterprise, an administrator or a team lead with delegated access can run a smart report on a team, which summarises sessions in chat, Claude Code and Cowork. Names show as "User" unless an account owner has switched on attribution, after which anyone viewing a report can reveal them. Personal chats appear only as a count and a cost. Employers can also pull full chat content through Claude's Compliance API.

**Q: Can employers see your AI chats?**
It depends on the product and the settings. OpenAI says the task analysis in ChatGPT Enterprise does not expose individual prompts or conversations, and Microsoft's Viva Insights never uses the text of emails or meetings, while tools such as Microsoft Purview and Google Vault let compliance and legal teams read message content. Claude smart reports put a summary of each session in front of a team lead.

**Q: Do employers have the right to monitor employees?**
Rules differ by country. Under European data law, staff must be told before their chats are reused for management reporting, and systematic monitoring of employees normally needs a formal risk assessment. In Germany, France, Italy and the Netherlands, staff representatives must also be consulted or must agree before monitoring tools are used.

Find out more at [claude.com](https://claude.com).