Most organizations can tell you who signed the AI use policy acknowledgment that their legal team prepared. HR has it on file, and a visible copy of the policy is available on the intranet if you search for it. The training module was designed, and the LMS records the completion date. Every compliance box is checked, and for the most part, governance is covered. Everyone in HR breathes a sigh of relief.
None of that tells you what people realistically do when they sit down to work.
The AI use policy on paper vs. the AI policy in practice.
On paper, employees use the approved enterprise tool and keep personal information out of it. A human reviews anything that leaves the team.
In practice, the approved tool is slower than the deadline. The draft starts on a personal phone while brainstorming the next day’s meeting. The employee survey comments are pasted into a free chatbot “just to see the themes.” A manager asks AI to tighten the wording of a disciplinary write-up and never mentions it.
No one thinks they are breaking the policy. Most of them think they are being efficient.
That is the gap. And it is invisible from where leadership sits.
Yesterday on LinkedIn, I wrote about why AI policies go silent when a new use case appears, and the decision framework that fills that silence. You can read it here: Can We Use AI for That? Rethinking AI Use Policy. This piece is about what happens in the silence. I will repost the article here on Substack.
Your employees signed the AI policy, then opened their phones. Why AI use policies fail in practice, and how HR can find and close the compliance gap.
Non-compliance is rarely defiance
When leaders hear that employees are working around the AI policy, the instinct is to enforce it. Remind everyone. Re-sign the acknowledgment. Add a warning to the login screen. Figure out the harshest punishment you can hand out.
That treats the symptom as the cause.
People work around a policy for predictable reasons:
• The compliant path is slower. If approval takes weeks and the deadline is Friday, the deadline wins.
• Asking feels risky. Asking “Can I use AI for this?” can sound like admitting you already have.
• The policy doesn’t describe their work. It lists tools. It doesn’t say whether summarizing interview notes is allowed.
• No one ever checks. A rule nobody looks at becomes a suggestion.
None of these are character problems. They are design problems, and design problems do not respond to reminders.
AI Compliance is a behavior, not a document
An acknowledgment confirms receipt of the policy. It does not prove they understood it, could apply it, or chose to.
If you were asked tomorrow to show how your organization governs AI use, a signed form would be the weakest evidence you have. The stronger evidence is behavioral: what people are using, for what, with which information, and who approved the workflow usage.
Most HR teams cannot produce that today. Not because they are careless, but because they built the program to distribute a policy, not to observe one.
How to find out what is really happening
You cannot close a gap you cannot see. Start by making it safe to tell you the truth.
Run a no-penalty AI Use Inventory. Ask every team one question: What are you using AI for right now, and with which tools? Make it clear that the purpose is to learn, not to discipline. You will learn more in a week than an audit would find in a quarter.
Ask managers, not just employees. Managers know where the workarounds are. They often use them way more than frontline employees.
Collect the questions people ask. Every “Can we use AI for that?” is data. These questions show you exactly where the policy is silent.
Look where the sensitive information lives. Hiring, performance, employee relations, and benefits. Those are the areas where a workaround carries the most weight.
Make the AI use compliant path the easy path
Once you can see the gap, close it on the policy’s side, not the employee’s.
Answer quickly. Name who can approve a new use and set an expectation measured in days, not months.
Publish real examples. “Yes, you may use the approved tool to draft a job posting from the job description. No, you may not paste in résumés.” Examples do what definitions can’t.
Give people a sanctioned option. If the approved tool can’t do the task, people will find one that can. Fix the tool gap or make the trade-off explicit.
Revisit it. AI features arrive inside software you already approved. A policy reviewed once a year is out of date by spring.
The question: Are our employees complying with the AI Use Policy?
Every AI use policy rests on the assumption that people will comply with it.
The organizations that govern AI well don’t assume. They look. Then they make following the policy easier than working around it.
Here is the question I would ask your leadership team this week:
If we asked our people, without consequences, how they use AI at work, would their answers match our policy?
If you are unsure, that is your starting point.
Add a comment and let me know how your organization verifies AI Use.
Not sure whether your organization’s AI use is Green, Yellow, or Red?
I teach the full Green Light, Red Flag framework in a free 37-minute workshop, with the AI Use Decision Guide you can apply to a real case today.
Get the free workshop → https://bit.ly/487iiaZ
Bonus Checklist:
Policy vs. Practice: AI Use Compliance Survey Template & Checklist
This article posed one question: if you asked your people how they use AI, would their answers match your policy? This survey template and checklist help you find out.