Keep, cancel or never pay: an AI tool audit for Ugandan executives, priced in shillings

An AI tool audit is a one-afternoon exercise in which you list every AI subscription your business pays for, write the one job each does, attach the shillings it earns or saves, and give it one of four verdicts: keep, trial for 30 days, cancel, or never pay. A $20 plan costs about UGX 87,000 a month at UGX 4,350 per dollar, the market rate on 29 October 2026 (our arithmetic); at UGX 3,700, the June to August 2026 range, it was about UGX 74,000. Five staff on that plan for twelve months come to about UGX 5,220,000 at the market rate (our arithmetic), a figure worth being able to justify line by line.

This guide is for owners, managing directors and finance heads of Ugandan businesses that already sell. It gives the method step by step, a shilling cost table with the date and rate stated, the rules for personal and company accounts, the data that never goes into a tool, the one number to watch, and a template you can copy into a spreadsheet today.

Contents

• Why audit now, and who is this for?
• What do AI tools cost in shillings?
• How do you run the audit, step by step?
• What are the keep, trial, cancel and never-pay rules?
• What template can you copy?
• What do three audits look like?
• Personal accounts or company accounts?
• What data must never go into an AI tool?
• What is the one number you will watch?
• What is the keep and stop rule?
• Does the audit have a moral side?
• Frequently asked questions

Key Takeaways

• A $20 AI plan is about UGX 87,000 a month at UGX 4,350 per dollar, the market rate on 29 October 2026, and was about UGX 74,000 at UGX 3,700, the June to August range (our arithmetic). The vendor page fixes the price in dollars; the shilling price moves with the rate, by about 18% between those two rates (1)(2)(3).
• Staff at over 90% of the companies in MIT’s small study used personal AI tools for work, while only 40% of surveyed companies say they bought an official subscription. Expect to find tools on cards and phones you do not control (4).
• Every paid tool gets one of four verdicts. A tool with no named job and no number is a cancel. A tool that needs data you must not paste is a never-pay until the route is cleared.
• Customer names, phone numbers, ID numbers and Mobile Money details stay out of AI tools. The Data Protection and Privacy Act s.19 governs data processed outside Uganda, and s.35 sets a fine of up to 240 currency points, UGX 4,800,000 by our arithmetic. This is not legal advice; check with a Ugandan lawyer (5).
• Pick one number per tool and read the baseline before you start. In a randomised trial, experienced developers expected AI to make them 24% faster, were measured 19% slower, and still believed afterwards that it had made them 20% faster (6).
• Write the keep and stop rule before the 30 days begin: the number, the threshold and the date. A rule written after the result is a story.

Why audit now, and who is this for?

This is written for the person who signs for software in a business with roughly 3 to 50 people: the owner, the managing director, the finance head. Most Ugandan enterprises are very small. The trade ministry’s profile puts 90% of enterprises at micro size with an average of 2.1 employees (7). In a business that size, the person who decides what to pay for is usually the person who also pays the shop rent and answers the customer’s call. An audit has to fit inside that week.

Three things make this the right month for it.

First, the shilling price of a dollar plan moves with the exchange rate. A $20 plan stays $20 on the vendor’s page until the vendor changes it, and the shilling cost follows the rate. The dollar was up 25.26% against the shilling over twelve months on the 29 October Trading Economics quote of 4,360.14, so the same $20 that cost about UGX 69,600 a year ago costs about UGX 87,000 at UGX 4,350 today (our arithmetic) (3). A subscription priced in dollars is a small, unplanned position in a foreign currency. Most owners did not choose it on purpose.

Second, the tools multiplied inside businesses without a decision. MIT’s study found that workers at over 90% of the surveyed companies used personal AI tools for work, and only 40% of surveyed companies say they bought an official LLM subscription (4). That study is small, 52 organisations interviewed and 153 senior leaders surveyed, and its authors call the figures directional. It matches what an audit finds in practice: a partner pays for one plan on a personal card, a manager pays for another, and an intern uses a free tool that quietly stores customer names.

Third, the evidence on results is thin where small firms are concerned, and cost is the one variable you control. McKinsey’s 2026 survey found that 37% of respondents say AI has contributed positively to their organisation’s EBIT, essentially unchanged from 2025, and that the “high performers” are 6% of respondents. Its sample leans large: 36% of respondents came from firms above $1 billion in revenue (8). We do not know the Ugandan SME figure; we found no official one. What we do know is what you pay. A spend you can state in shillings, tie to a job and review on a date is the part of AI adoption you can manage this week.

One caution about local usage numbers. The Anthropic Economic Index measures Claude chat use only. For April to May 2026 it put Uganda at 0.11 on its index, rank 116 of 121 countries, and found that 33.12% of Ugandan conversations were coursework against 16.45% globally (9). That tells you how one tool is used, nothing about how many Ugandan firms use AI. We use it for one purpose here: much of the observed use is people learning, so do not assume your staff already know how to judge what these tools produce.

What do AI tools cost in shillings?

Exhibit 1 and the table below convert the vendors’ own US price lists into shillings at two rates. The first is UGX 4,350 per dollar, the market rate on 29 October 2026: Trading Economics showed 4,360.14 and a Bank of Uganda-attributed mirror showed 4,354.52, so we round to 4,350 (3). The second is UGX 3,700, the rate that held between June and August 2026 in third-party quotes. We could not retrieve the Bank of Uganda’s own rate page when we checked, so neither column is the official rate. Convert at the rate on your own statement, because your card or bank applies its own rate and fee.

Prices checked on 29 October 2026 on the US pages of the vendors (1)(2)(10)(11)(12). Prices exclude tax and card fees. The Copilot $18 is a promotional price for the first year only; the list price is $21. Rounded to the nearest UGX 100. Our arithmetic.

A few details in that table matter more than the headline numbers.

• Annual prepay hides the cost. Claude Pro is $17 a month on annual billing, which means $200 billed up front, or about UGX 870,000 on one charge at UGX 4,350. A year’s prepayment that nobody remembers is the kind of line an audit exists to catch.
• Some plans carry advertising or training terms. ChatGPT Go’s page says the plan may include ads. The ChatGPT page lists content used to train models as opt-out on Free, Go, Plus and Pro. Claude lists model training as opt-out on Free, Pro and Max, and off by default on Team (1)(2). We come back to this under accounts.
• Some plans need a personal account. Google’s page says its AI plans need a personal Google Account that you manage on your own (10). A business that buys these for staff is buying into personal accounts.
• Some plans are not for teams. Canva’s page says Pro is for one person and Canva Teams is closed to new sign-ups, with Business as the team plan (12). A shared Pro login sits outside the plan as the page describes it, and it is a data risk.
• A US page is not a Ugandan quote. The Microsoft page lists some products as not available in its market. Check the price and availability at checkout in Uganda before you build a budget on a US price (11).

The vendors’ premium tiers start at $100 a month. At the market rate that is about UGX 435,000 for one seat. The same $100 would buy about 5 standard seats at $20. That is a decision to make on purpose, and the audit is where you make it.

How do you run the audit, step by step?

Run it in one sitting with the finance person and the person who manages staff accounts. Plan an afternoon for a firm of five. It grows with the number of cards, phones and mailboxes involved. Seven steps.

Step 1. Collect every charge, from every account

Open three months of statements: the business bank account, every company card and every Mobile Money statement the business uses. Then do the part people skip. Search the owner’s and the finance mailbox for “receipt”, “invoice”, “subscription”, “renewal” and “your plan”. Ask each manager what they pay for personally and claim back. Check app-store billing on staff phones the business reimburses. A dollar charge on a personal card that the business refunds each month is still a business subscription.

Mobile Money belongs on the list. Uganda had 36.3 million active mobile money accounts at December 2025, an account count and not a count of people (13). A business paying a local vendor from a wallet is normal, and it will not appear on the card statement. Annual renewals are the second blind spot: look back twelve months for anything that charged once.

Step 2. List each tool in one row

One row per tool and per account. If three people each hold a seat, that is three rows or one row marked “3 seats”. Record: tool and plan; whose account it sits in; how it is billed and the renewal date; USD price; UGX per month at today’s rate; who uses it; the date it was last used; and what data it touches. The template further down has these columns.

“Last used” is the column that changes decisions. Ask the user, or check the tool’s own usage page. Do not guess. A tool nobody has opened in 30 days has already told you its verdict.

Step 3. Name the job in one sentence

The sentence has a verb, an object and a person: “drafts first versions of fee-reminder messages for the bursar”, “summarises supplier emails for the owner”, “makes the Friday post for the marketing assistant”. If the user cannot write the sentence in under a minute, the tool has no job yet. “Helps with productivity” is not a job.

The job must also name something the business already does. McKinsey found that nearly three-quarters of high performers fundamentally redesigned workflows because of AI, up from 55% a year earlier (8). You cannot redesign a workflow you have not named. MIT put it more bluntly: “The core barrier to scaling is not infrastructure, regulation, or talent. It is learning”, meaning tools that do not retain feedback or fit the workflow stall (4). A job sentence is the cheapest test of fit.

Step 4. Attach the money the tool earns or saves

For each tool write the number it moves, in shillings or hours, with the source of the baseline. Three forms cover most cases.

• Hours saved. Hours per month the user would otherwise spend, multiplied by the cost of one hour of that person’s time. The break-even is the tool’s monthly UGX divided by that hourly cost. A $20 plan at UGX 4,350 is UGX 87,000. If a staff hour costs the business UGX 15,000, the plan must save about 5.8 hours a month to break even (our arithmetic; the hourly figure is an example, use your own).
• Outside spend avoided. The tool replaces money you paid someone else: design, copywriting, transcription, translation. MIT reported agency spend falling by 30% in its best cases, and found back-office automation often paid back faster than the sales and marketing uses where about half of the sampled budgets went (4). Those are the best cases in a small study. Use them as a question to ask, not as a forecast.
• Revenue touched. The tool sits in the path of a sale: quote speed, follow-up, reply time. Count the quotes or enquiries that went through it and what share closed. Be honest about correlation. A busy month raises everything.

Write “no data” when the number does not exist. Do not write a zero or an estimate that looks like data. A blank is information too: it means the tool needs a number before the next renewal.

Step 5. Mark the data it touches

Beside each tool write red, amber or green for the data its users actually put in. Red is data that must never go in. Amber is data that goes in only in coded form. Green is public or your own non-sensitive material. The data section below defines each class. If a user cannot say what they paste, mark the tool red until they can.

Step 6. Give one verdict and act the same day

Apply the four rules in the next section. Then act on the day: cancel what you marked cancel, move what must move to a company account, put a review date on every trial, and write down the renewal date for anything on annual billing so that the cancellation is made before it, not after. Claude’s page says you can cancel at any time, that the plan stays active to the end of the billing period, and that you should cancel at least 24 hours before the renewal date to avoid the next charge (2). Read each vendor’s own terms; they differ.

Step 7. Write the new monthly total and the saving

One line at the top of the page: before, after, difference, in shillings at a stated rate. Then set the next audit for 90 days out. The point of the line is to be able to say it to the board, the partners or your spouse without opening the spreadsheet.

That is the whole method. The rest of this guide supplies the rules, the template and the guardrails.

What are the keep, trial, cancel and never-pay rules?

These rules are our own craft. They are a decision aid, not research findings, and the thresholds are yours to change. What matters is that they are written before you look at the tool you love.

Keep: the four conditions

A tool earns a keep when all four hold: a job, a user, a number and a data class. If any one is missing, it is a trial or a cancel. Most tools fail on the number. The user feels the tool is useful and cannot say how many minutes, shillings or enquiries it moved. That is a trial, not a keep, and the trial exists to produce the number.

Trial: the 30-day rule

Write three lines before day one: the number you will read, the threshold that means keep, and the date. Cancel before the first renewal. A trial that rolls into a paid month without a written decision is a purchase. The common failure is a free trial that converts quietly to a paid plan on a card nobody is watching.

Cancel: any one of four triggers

• The user cannot write the job sentence in a minute.
• Nobody has opened it in 30 days.
• It does the same job as a tool you keep. Two assistants for drafting emails is one assistant too many.
• The number did not move by the review date.

“We might need it” is not a reason. If you might need it, you can buy it again, and the only cost of being wrong is a month at the then-current price.

Never pay: five cases

1. The input does not exist. A forecasting tool needs clean stock or sales records. If yours are on paper or in six spreadsheets, build the table first. The missing piece is the table.
2. The data it needs must not go in. If the tool works only when whole client files, customer lists or ID documents are pasted into an overseas service, and you have not cleared the route with a lawyer, you do not pay. See the data section.
3. A free tier already does the job. Free plans on the major assistants cover drafting and summarising for many small jobs. Pay when a limit costs you something you can count.
4. It is sold as an agent but has no stop rule. Gartner estimates that only about 130 of the thousands of agentic AI vendors are real; the rest “agent wash” assistants, RPA and chatbots, and it forecasts that over 40% of agentic AI projects will be canceled by the end of 2027 (14). Anthropic’s own guide advises “finding the simplest solution possible, and only increasing complexity when needed” and says agents commonly include stopping conditions such as a maximum number of iterations (15). If the vendor cannot tell you where a human checks and when it stops, do not pay.
5. You are building what you could buy. In MIT’s sample, purchased or partnered tools reached deployment about 67% of the time against about 33% for internal builds, and the authors warn that this is correlation, not causation (4). Before paying a developer to build a custom assistant, ask what an off-the-shelf plan at the prices above does not do.

On every verdict, write the sentence that would change your mind. “I would keep the chatbot if enquiries answered within ten minutes rise by 20% in 30 days” is a keep rule. “I will see how it goes” is not.

What template can you copy?

Paste the two tables below into a spreadsheet. Table A is the ledger of what you pay. Table B is the decision. Keep them on one tab so that a cancellation is visible next to the reason.

Table A. What you pay

Table B. What it does and what you decide

The four lines at the bottom of the sheet

• Monthly total before: UGX ________ at ________ per USD on ________ (date).
• Monthly total after: UGX ________.
• Saving per month: UGX ________. Saving per year: UGX ________.
• Next audit date: ________ (90 days out). Owner of the audit: ________.

Two formulas to keep with it. Break-even hours per month for a tool = UGX a month ÷ UGX cost of one hour of the user’s time. Annual cost = UGX a month × 12, or the annual charge converted on the billing date. Compare the annual cost, not the monthly, with the number the tool moves.

What do three audits look like?

The three examples below are illustrative. The businesses are invented to show the arithmetic and are not clients or real cases. Prices for named plans are the official ones we checked on 29 October 2026 (1)(2)(10)(11)(12). A price marked “assumed” is invented. All conversions use UGX 4,350 per dollar, rounded to the nearest UGX 100 and then summed so that each column adds up. At UGX 3,700 per dollar, the dollar-priced lines would be about 15% lower.

A law firm of five in Kampala (illustrative)

The managing partner pulled six months of statements and found five lines. Three people used one ChatGPT seat each, and one of those seats had not been opened in 40 days. A partner paid personally for a second assistant and claimed it back. A Copilot add-on had been bought for five people on an annual plan at the $18 first-year promotional price ($21 after), and none of the five could write the job sentence. A contract-review add-on was on a trial that was about to convert.

The line that decided the example is the last one. A contract-review add-on that needs whole client contracts pasted into an overseas tool sits squarely in the data problem described below. Until a Ugandan lawyer says the route is clear and the clients have been told, the verdict is never pay. The saving is real. The point of the audit was the data decision.

A private primary school (illustrative)

The bursar found two teachers on personal cards, a head teacher on a personal Google account, and a design plan bought for notices. Canva’s page says that K-12 educational organisations can get most premium features free, with eligibility requirements (12). Whether this school qualifies is something to check with Canva, not assume. The fee-reminder service is the line the school should not touch: every fee follow-up goes through it.

The saving is small, UGX 87,000 a month. The school’s real decision is about children’s names and parents’ phone numbers. The head teacher’s trial is conditional on one rule: report comments are drafted from codes, and a teacher pastes the child’s name back in after the draft is done.

A wholesale distributor with 12 staff (illustrative)

The owner held one ChatGPT seat that he used daily, and a sales manager held a second assistant on a personal account, a duplicate. Two larger purchases were on the table. The chatbot would answer price and stock questions on WhatsApp. The forecasting app would plan reorders. The chatbot goes on trial with one number: the share of WhatsApp enquiries answered within ten minutes, read for 30 days. The forecasting app goes on the never-pay list because the stock counts it needs are on paper.

The distributor’s next task is a stock table: item, quantity, date counted, one row per count. When twelve months of rows exist, the forecasting question can be asked again. This is also the pattern the AI Deep Dives Day 2 session builds: a table before an agent.

Personal accounts or company accounts?

The audit will find tools in both. The rule we recommend is short: anything that touches customer, client, pupil or staff information lives on a company-owned account with the training setting off, and personal accounts are for your own non-sensitive work.

Four reasons sit behind the rule.

1. Ownership. If a manager leaves and the work was in her personal account, the conversations leave with her. A company account has an owner who is not a departing employee.
2. Training terms. On the vendor pages we checked, content may be used to train models by default on consumer plans, with an opt-out, while Claude’s Team plan says no model training on your content by default (1)(2). Terms change. Read the current page for the plan you actually have, and set the opt-out where it exists.
3. Visibility. You cannot audit what you cannot see. Team and business plans carry central billing and admin controls; Claude’s Team plan, for 2 to 150 people, lists central billing and administration and single sign-on, and ChatGPT’s page says its Business plans start at 2 users (2)(1). That is the feature that lets you answer “who has a seat” in one screen.
4. Cash. A personal dollar card reimbursed in shillings each month makes you the foreign-exchange counterparty. The reimbursement lags the charge, and the amount moves with the rate. One company card with a limit is easier to control.

What does the evidence say about how common the mess is? MIT’s small study found workers at over 90% of surveyed companies using personal AI tools for work, while 40% of surveyed companies say they bought an official subscription (4). We are citing it as a direction. We do not know the Ugandan figure.

In an audit, we would expect to find personal tools in a majority of businesses that have never looked, and we would treat that as a hypothesis to confirm with your own statements and a short, friendly question to each staff member.

Ask the question without blame: “Which AI tools do you use for work, and which of them do you pay for yourself?” Staff who fear a penalty will say “none”. Staff who expect a reimbursement and a better account will tell you the truth. The same BCG survey that found 51% of frontline employees using generative AI regularly, against more than three-quarters of leaders and managers, also found that regular use is sharply higher for those with at least five hours of training (16). Offering a sanctioned tool and a short training is a better answer than a ban.

What data must never go into an AI tool?

This section is not legal advice. Check with a Ugandan lawyer before you decide what your business may or may not do. What follows is a reading of the text of the Act as we found it, and a practical rule built on it.

What the Act says, in the parts that matter here

• Section 1(b) applies the Data Protection and Privacy Act to a person outside Uganda who collects, processes, holds or uses personal data relating to Ugandan citizens (5).
• Section 7(1) says there is no collecting or processing of personal data without the data subject’s prior consent, subject to listed exceptions (5).
• Section 19 says that where a controller or processor in Uganda stores or processes personal data outside Uganda, it must ensure that the country has “adequate measures … at least equivalent” to the Act, or that the data subject has consented (5).
• Section 35 makes unlawfully obtaining or disclosing personal data an offence with a fine of up to 240 currency points, or ten years in prison, or both. A currency point is UGX 20,000, so the fine cap is UGX 4,800,000 (our arithmetic) (5).

A reasonable reading is that pasting a customer’s name and phone number into a tool whose servers sit abroad is a transfer of personal data outside Uganda, and that s.19 asks you to have either a destination with equivalent protection or the person’s consent. We say “reasonable reading” on purpose. Whether a given paste is a “disclosure” for s.35, whether your business must register with the Personal Data Protection Office, and whether a particular vendor’s terms meet s.19 are questions for a lawyer. We did not resolve them.

The regulator has shown it will act on these provisions against a very large company. On 18 July 2025 the PDPO found Google in breach of s.29, failure to register, and s.19, cross-border transfer without safeguards, ordering registration and evidence within 30 days. It declined a data-localisation order “at this stage” (17). A small business sits far below Google’s scale. We did not find a small-business exemption in the sections we read, and a lawyer should confirm that. As of 21 October 2026 the government had launched a five-year National Data Strategy as groundwork for a National AI Strategy that had not yet been published (18). Until that exists, the Data Protection and Privacy Act is the law on the table.

The three data classes

Exhibit 3 shows the classes. Write the class beside every tool in your audit.

The acceptable-use rule, in six lines

Put this on one page, have every user sign it and keep the signed copies. Adapt the words.

1. AI tools are used on company accounts for any work involving customers, clients, pupils or staff.
2. Red data never goes into an AI tool.
3. Amber data goes in only as codes. The key file stays in the company’s own system.
4. Every output is read by a named person before it is sent to anyone outside the business. The tool drafts; a person sends.
5. Training opt-outs are switched on wherever the plan offers one.
6. The owner reviews this rule every six months and after any incident, and an incident is reported the day it is noticed.

Rule 4 matters beyond data. In a field experiment on 758 consultants, users inside the AI’s capability finished 12.2% more tasks, 25.1% faster and at better quality; on a complex task outside it, they were 19% less likely to produce a correct solution (19). The same tool, a different task, an opposite result. Someone has to read the output.

The audit adds one question to the rule: does each tool on your list handle red data, and if it does, why is it still on the list?

What is the one number you will watch?

A business that audits tools but measures nothing will be back in the same place in a year. Choose one number per job, write the baseline before you start, and read it on a fixed day each week. One number per tool is a deliberate limit. A dashboard of eight numbers is not read.

Why the feeling is not the number

The best reason for measuring is the METR trial. In 2025, METR ran a randomised trial with 16 experienced open-source developers across 246 tasks. With AI allowed, they took 19% longer. They had expected a 24% speed-up beforehand, and afterwards they still believed AI had made them 20% faster (6). These were experienced people on codebases they knew, using early-2025 tools. It is not an SME benchmark and we do not say your results will match. What it shows is that the user’s own sense of speed can point the wrong way. Exhibit 4 puts the three figures side by side.

Pick the number from the job

The weekly reading

Fix a day, say Friday at 4pm, and spend ten minutes. Update the number and write one line on why it moved. Capture the baseline first. If you did not time the old way, write “no baseline”, and the tool stays a trial until you have one.

Two cautions. A number measured once is a snapshot; read it for at least four weeks before you decide. And where staff use the tool, tell them the number you are watching and why. People who think they are being timed for a disciplinary hearing will game the number or hide the tool.

The strongest case against all of this

The best argument against trimming and measuring is a size argument. McKinsey’s 2026 survey says it plainly: “AI deployment by larger organizations continues to outpace deployment by smaller organizations” (8). The conclusion some owners draw is that a small firm should spend more and spend sooner, not run an audit that takes tools away. If bigger competitors adopt faster, a small firm that cancels subscriptions is stepping backwards.

That argument is right about the gap, and we concede it: a firm that cancels everything and measures nothing will fall behind. Where we part is on what closes the gap. The same survey found that nearly three-quarters of high performers fundamentally redesigned workflows because of AI (8), which is work on the process itself. An audit keeps spending on AI, and it points that spend at the jobs where the number moves.

What is the keep and stop rule?

The rule has four parts, written down before the trial begins.

1. The number you will read (from the last section).
2. The threshold that means keep. State it in the same unit as the number.
3. The date on which you read it.
4. The action if the threshold is missed: stop, or change one thing and set a second date.

Exhibit 5 shows the sequence for every tool, prompt or agent.

Examples of well-formed rules, with invented thresholds that you should replace with your own:

• “Keep the fee-reminder drafting prompt if it saves at least 3 hours a month and produces no parent complaint by 30 November. If not, stop it.”
• “Keep the WhatsApp chatbot if the share of enquiries answered within ten minutes rises from the baseline by at least 20 percentage points by the date. If it rises less, change the answer list once and set a second date. If it still misses, cancel.”
• “Move to Team seats only if two people use the tool at least three days a week. Otherwise stay on one account.”

Agents get a stricter version. Anthropic’s guidance says agents can pause for human feedback at checkpoints or when they hit blockers, and that it is common to include stopping conditions such as a maximum number of iterations (15). For a business, translate that into three lines: where a person checks, what the agent may never do, and the number of runs or the shilling cost at which it stops. Gartner’s warning that over 40% of agentic projects will be cancelled by the end of 2027, driven by “escalating costs, unclear business value or inadequate risk controls” (14), is a forecast, not a count. It is a good reason to write the stop rule first.

Common failures: no review date; a threshold written after the result; keeping a tool because the subscription is already paid. The last is the sunk-cost error in a business suit, and it is the most expensive of the three, because it renews itself.

Does the audit have a moral side?

The audit began as an accounting exercise, and accounting is a good thing. A business that knows what it pays and why can pay its people on time, and that is a moral outcome before it is a financial one. The frame also has a limit, and we found it inside our own method. The method says each tool must serve a named customer or move a number, and the data rule says a customer’s phone number does not go into a tool. Neither rule can explain why a number in your phone, held for someone who will never check, deserves care when no auditor is looking. Scripture gives the reason: “Whoever can be trusted with very little can also be trusted with much” (Luke 16:10, NIV). You hold the customer’s data as a steward, and the same posture explains why a subscription you do not need is a small act of unfaithfulness with someone else’s money. The audit gives you the controls, and stewardship gives you the reason to keep them when it is inconvenient.

Frequently asked questions

What is an AI tool audit?
It is a review of every AI subscription and free tool your business uses. You list each one, write the single job it does, attach the shillings or hours it earns or saves, mark the data it touches, and give it a verdict: keep, trial for 30 days, cancel or never pay. A small firm can do it in an afternoon.

How much do ChatGPT, Claude and Gemini cost in Uganda in shillings?
On the vendors’ US price pages on 29 October 2026, ChatGPT Plus and Claude Pro on monthly billing are $20, Google AI Pro is $19.99, and ChatGPT Go is $8. At UGX 4,350 per dollar, the market rate on 29 October 2026, a $20 plan is about UGX 87,000 a month; at UGX 3,700, the June to August range, it was about UGX 74,000 (our arithmetic). Prices exclude tax and card fees, and a US page is not a Ugandan quote.

Should staff use personal or company AI accounts?
Any work involving customer, client, pupil or staff information belongs on a company-owned account with the training opt-out switched on. Personal accounts are for non-sensitive work. In MIT’s small study, workers at over 90% of surveyed companies used personal AI tools while only 40% of surveyed companies say they bought an official subscription, so expect to find both.

Can I paste customer names and phone numbers into ChatGPT or Claude?
Do not paste them. Use codes such as C01 and C02 and keep the key in your own system. Section 19 of the Data Protection and Privacy Act covers personal data processed outside Uganda, and section 35 sets a fine of up to UGX 4,800,000 (240 currency points, our arithmetic) for unlawfully obtaining or disclosing personal data. This is not legal advice; check with a Ugandan lawyer.

How do I know whether an AI tool is worth paying for?
Write the one-sentence job, pick one number it should move, record the baseline before you start, and set a threshold and a date. In a randomised trial, developers believed AI had made them 20% faster after being measured 19% slower, so a user’s feeling is not evidence. Break-even hours equal the tool’s monthly UGX divided by the cost of one staff hour.

What is the difference between keep, trial, cancel and never pay?
Keep means a job, a user, a number with a baseline and a clear data class. Trial means a job but no baseline yet, for 30 days with a written threshold. Cancel means no job, no use in 30 days, a duplicate or a missed number. Never pay means the input does not exist, the data must not be pasted, there is no stop rule, or a free tier does the job.

Do I need a lawyer before I use AI tools in my business?
For data decisions, yes. Whether a paste counts as a transfer or a disclosure under the Act, and whether your business must register with the Personal Data Protection Office, are legal questions we did not resolve. For spending decisions, no. The audit method needs a statement, a spreadsheet and an honest conversation with staff.

How often should we repeat the audit?
Every 90 days at first, and at every annual renewal date. Prices and plans change, the shilling moves, and staff add tools. Set the next audit date on the same page as the saving, and give it an owner.

Read next

• From AI pilot to daily work: a 30-day method
• AI agents for a Kampala business: a one-page brief

Sources and Evidence

1. OpenAI, ChatGPT plans and pricing page, checked 29 October 2026. https://chatgpt.com/pricing/ US page. Go $8, Plus $20, Pro from $100 a month; Business plans start at 2 users; content may be used for training with opt-out on Free, Go, Plus and Pro.
2. Anthropic, Claude plans and pricing page, checked 29 October 2026. https://claude.com/pricing US page. Pro $17 a month billed annually or $20 monthly; Max from $100; Team standard seat $20 annual or $25 monthly, premium seat $100 annual or $125 monthly; model training is opt-out on Free, Pro and Max and off by default on Team.
3. Trading Economics, Ugandan Shilling quote page, 29 October 2026. https://tradingeconomics.com/uganda/currency Third party. USDUGX 4,360.14 on 29 October 2026, up 25.26% over twelve months. A Bank of Uganda-attributed mirror (allratestoday.com/central-bank-rates-api/bou.md) showed 4,354.52 the same day. We could not retrieve the Bank of Uganda rate page itself, so we round to 4,350 and call it our arithmetic.
4. MIT / Project NANDA, “The GenAI Divide: State of AI in Business 2025,” July 2025 (PDF mirror). https://mlq.ai/media/quarterly_decks/v0.1_State_of_AI_in_Business_2025_Report.pdf Small study: 52 organisations interviewed, 153 senior leaders surveyed, 300+ public initiatives. Directional, not a count.
5. Data Protection and Privacy Act, Cap. 97 (Act 9 of 2019), ULII text, read 29 October 2026. https://www.ulii.org/akn/ug/act/2019/9 Sections 1(b), 7(1), 19 and 35. Not legal advice.
6. METR, “Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity,” 10 July 2025. https://metr.org/blog/2025-07-10-early-2025-ai-experienced-os-dev-study/ Randomised trial: 16 experienced developers, 246 tasks. Early-2025 tools; not an SME benchmark.
7. Ministry of Trade, Industry and Cooperatives, MSME profile, January 2025. https://mtic.go.ug/wp-content/uploads/2025/01/MSME-profile.pdf Ministry figure; underlying survey year not stated.
8. McKinsey, “The State of AI,” 25 August 2026. https://www.mckinsey.com/capabilities/quantumblack/our-insights/the-state-of-ai 1,719 participants in 97 nations, fielded 4 May to 8 June 2026; 36% from firms above $1 billion revenue, so small firms are thin in the sample.
9. Anthropic Economic Index, usage by country, April to May 2026 (published 24 June 2026). https://www.anthropic.com/economic-index Measures Claude chat use only, not national AI adoption.
10. Google, Gemini subscriptions page, checked 29 October 2026. https://gemini.google/subscriptions/ US page. AI Plus $4.99, AI Pro $19.99, AI Ultra from $99.99 a month; plans need a personal Google Account that you manage on your own.
11. Microsoft, Microsoft 365 Copilot pricing page, checked 29 October 2026. https://www.microsoft.com/en-us/microsoft-365-copilot/pricing US page, paid yearly. Copilot Business add-on shown at $18 per user a month, a first-year promotional price (list $21); some products listed as not available in the page’s market. Check availability and price in Uganda.
12. Canva, plans and pricing page, checked 29 October 2026. https://www.canva.com/pricing/ US page, prices exclude tax. Pro US$144 a year, Business US$250 a year per person; K-12 educational organisations and not-for-profits can enjoy most premium features for free (eligibility applies).
13. Uganda Communications Commission, “A snapshot of gains, impact and progress,” December 2025 data. https://www.ucc.co.ug/uganda-communications-commission-a-snapshot-of-gains-impact-and-progress/ Subscriptions and accounts, not unique people.
14. Gartner, “Over 40% of agentic AI projects will be canceled by end of 2027,” 25 June 2025. https://www.gartner.com/en/newsroom/press-releases/2025-06-25-gartner-predicts-over-40-percent-of-agentic-ai-projects-will-be-canceled-by-end-of-2027 A forecast, not a count.
15. Anthropic, “Building effective agents,” December 2024. https://www.anthropic.com/research/building-effective-agents Vendor-authored engineering guide.
16. BCG, “AI at Work: Momentum builds, but gaps remain,” 23 June 2025. https://www.bcg.com/publications/2025/ai-at-work-momentum-builds-but-gaps-remain 10,600+ employees in 11 countries.
17. CIPESA, “Ugandan regulator finds Google in breach of country’s data protection law,” 21 July 2025. https://cipesa.org/2025/07/ugandan-regulator-finds-google-in-breach-of-countrys-data-protection-law-orders-local-registration/ Describes the PDPO finding of 18 July 2025.
18. Daily Monitor, “Government launches five-year data strategy ahead of AI adoption,” 21 October 2026. https://www.monitor.co.ug/uganda/news/national/government-launches-five-year-data-strategy-ahead-of-ai-adoption-5639746 No national AI strategy had been published at that date.
19. Dell’Acqua et al., “Navigating the Jagged Technological Frontier,” Harvard Business School working paper, 2023. https://www.hbs.edu/faculty/Pages/item.aspx?num=64700 758 consultants; one field experiment.