Claude Feature Gap Audit
Find where your people's personal Claude beats the company one. Compare capabilities, spot shadow use, set the controls and switch features on by group.
What's inside this template
Who it's for
CIOs, AI Operations Leads and security or data protection teams running Claude Enterprise or Claude Team at organisations where staff also have personal AI accounts
When to use
When features are switched off pending review; when you see personal accounts or a rogue Team account; before claiming your domain; before auto mode becomes your default; monthly, after each release review
Key benefit
A company Claude that is better than the personal one, with the controls on, so people stop going round you and the work stays where you can see it
Sections included
- Audit details
- Feature gap table
- Shadow-use signals
- Controls before features
- Data rule
- Enablement backlog and ICE scores
- Auto mode decision
- Message to staff
- Steering group lines
- Implementation notes
Complete template content
To use this audit, copy it with the "Copy page" button above or open the Google Doc version. Read the companion comparison, personal Claude vs Claude Enterprise, for the thinking behind it.
Claude feature gap audit
A free template for CIOs, AI Ops leads and security teams who run Claude Enterprise or Claude Team. It compares what your people can get on personal Claude plans with what your organisation has switched on, finds where staff are going round you, and turns the gap into a short, scored plan. It works on its own; you don't need any platform to use it.
0. Audit details
- ☐ Organisation:
- ☐ Claude plan (Team or Enterprise) and seat count:
- ☐ Audit owner (usually the AI Ops lead):
- ☐ Sponsor (CIO or COO):
- ☐ Security and data protection partner:
- ☐ Date of this audit:
- ☐ Next review (monthly, or after each release review):
1. Feature gap table
One row per capability. Check the "personal plans" column against Anthropic's current plans and pricing page when you run the audit, because it changes often. Fill in your own setting, why it's off, and the condition that would let you switch it on.
| Capability | On personal plans? (check pricing page) | Our setting today | Why it's off | Shadow-use signal seen | Condition to switch on | Decision (on / on for groups / off) | Owner | Review date |
|---|---|---|---|---|---|---|---|---|
| Example (fictional): Memory | Yes, from Free | Off | Worry that memory will hold client details | Staff say their personal Claude "remembers" their projects | Data rule agreed and retention set | On for internal teams first | AI Ops lead | Next month |
| Connectors | ||||||||
| Skills | ||||||||
| Docs, Slides and Design | ||||||||
| Claude Code | ||||||||
| Cowork and scheduled tasks | ||||||||
| Web search and Research | ||||||||
| Dashboards and Motion (beta) | ||||||||
| Auto mode as the default | ||||||||
| Sharing outside the organisation |
2. Shadow-use signals
Tick what you've seen. Each one is evidence that the company's Claude is losing to a personal account.
- ☐ Personal Claude accounts on your company domain (Enterprise admins can list Free, Pro and Max accounts on a verified domain).
- ☐ A separate Claude Team account opened by a department.
- ☐ Expense claims for personal AI subscriptions.
- ☐ Screenshots or exports from personal Claude in team documents.
- ☐ Help desk tickets asking when a feature will be switched on.
- ☐ Champions reporting that people "use it at home instead".
- ☐ Low active use in teams that are known to use AI heavily.
3. Controls before features
Switch these on before you widen access, so every feature you enable is governed from day one. Check each against your plan: some are Enterprise only.
- ☐ Domain verified, and "Restrict organization creation" switched on.
- ☐ SSO enforced, not just configured.
- ☐ SCIM or JIT provisioning live (SCIM is Enterprise only).
- ☐ Groups that mirror your departments or cost centres, where your plan supports them.
- ☐ Admin controls for connectors set: which are allowed, read-only first.
- ☐ Custom data retention set (Enterprise only).
- ☐ Audit logs reviewed by a named person (Enterprise only).
- ☐ Compliance API connected to your archive or SIEM, if you need it (Enterprise only).
- ☐ Inference hooks connected to your data loss prevention or AI security tool, if you use one (Enterprise only; Owners and Primary Owners configure them).
- ☐ Organisation instructions and default model set.
- ☐ Spend limits set at organisation and user level.
- ☐ Feedback (thumbs up and down) setting decided.
4. Data rule
Replace case-by-case approvals with a standing rule. Agree it with your DPO and legal team; this template isn't legal advice.
| Data class | Allowed in our Claude organisation? | Conditions | Who approves exceptions | Notes |
|---|---|---|---|---|
| Example (fictional): Client documents under an existing engagement | Yes | Engagement letter permits processing by sub-processors; no special category data | Engagement partner | Reviewed quarterly |
| Public information | ||||
| Internal (non-sensitive) | ||||
| Confidential company data | ||||
| Client data | ||||
| Personal data | ||||
| Special category or regulated data |
5. Enablement backlog and ICE scores
List the capabilities you'll switch on, and for which group. Score each with ICE: impact, confidence and ease, each from 1 to 10, multiplied for a score out of 1,000. Start with the teams already using personal accounts.
| Capability | Group | Impact | Confidence | Ease | ICE score | Decision |
|---|---|---|---|---|---|---|
| Example (fictional): Microsoft 365 connector, read-only | Finance | 8 | 7 | 6 | 336 | Go |
| Example (fictional): Memory | Whole organisation | 6 | 6 | 8 | 288 | Next |
6. Auto mode decision
Anthropic says auto mode is becoming the default on Pro, Max and Team, and that Enterprise admins will get an email before it becomes the default for their organisations. Decide before the email arrives.
- ☐ Our default for Claude apps:
- ☐ Our default for Claude Code (admins can pin it, or turn auto mode off, in managed settings):
- ☐ Work that always needs a person to approve (for example, production changes, payments, external sends):
- ☐ Who is told, and how:
7. Message to staff
Adapt this when you switch capabilities on.
"From [date], [capabilities] are switched on in our company Claude for [groups]. Please use it for work instead of personal accounts. It keeps your work in one place, under our company agreement, and you won't lose it if you change role. Here's what you can and can't put into it: [link to data rule]. Questions: [contact]."
8. Steering group lines
Copy these into your steering group update.
- Capabilities switched on this month: [list], for [groups].
- Shadow-use signals: [what you saw], [what changed].
- Controls in place: [for example, SSO enforced, audit logs reviewed weekly, inference hooks live].
- Decision needed: [for example, approve the data rule for client documents].
9. Implementation notes
- Run this audit monthly, or after each Claude release review. New defaults reopen the gap.
- Switch on by group, not all at once. The teams already on personal accounts are your pilot.
- Only claim your domain once the company's Claude is the better option.
- If you track your AI estate in Kowalah, the free plan covers recording systems and AI assets and logging opportunities.
- Feature availability changes often. Check Anthropic's pricing page and release notes before you rely on any row.
Get started
How to use this audit
Map the gap
For each capability, note whether personal plans have it (check Anthropic's pricing page), your setting today, why it's off and the condition for switching it on.
Look for shadow use
Tick the signals you've seen: personal accounts on your domain, a department's own Team account, expense claims, screenshots in team documents.
Switch the controls on first
Enforce SSO, provisioning, retention and audit log review, and connect inference hooks if you use them, so every feature you enable is governed from day one.
Agree a data rule
Replace case-by-case approvals with a standing rule by data class, agreed with your DPO and legal team.
Score and switch on by group
ICE-score each capability and group, start with the teams already using personal accounts, tell staff what's changed and report it to the steering group.
Questions
Frequently asked questions
Common questions about personal Claude accounts and company rollouts
Why do people use personal Claude accounts when we have Claude Enterprise?
Is a personal Claude account safe for work data?
Can we block personal accounts?
Which controls should we switch on before features?
How do we decide what to switch on first?
Is this legal or data protection advice?
More templates
Related templates.
Ready when you are
Want help getting to governed on?
Kowalah is a UK Anthropic Implementation Specialist. We help CIOs and AI Ops leads switch Claude Enterprise features on with the controls on: SSO, retention, audit logs, a clear data rule and a feature plan teams will use. If you'd like help, book a conversation.