ChatGPTThe AI policy is clear: use Microsoft Copilot, not the free version of ChatGPT. A month later it turns out the marketing team mostly uses ChatGPT anyway. Not to dodge the rules, but to translate campaign copy into German and French. Someone found it worked well, and the rest of the team followed. That is useful information: people found a way of working that helps, and the policy had no answer for it yet.
Adjusting the policy starts there. The question is not "who is breaking the rules?" but "what are people trying to do, and how can we make that possible in a way that fits?"
Why does practice drift from the policy?
An AI policy is usually written before you know what people will really use AI for. New tools arrive, existing tools gain features and teams find uses nobody anticipated. And a policy on the intranet is not always to hand when someone needs a quick translation.
So a gap is not a failure of the policy. It is the point at which the policy can learn something.
Which signs tell you to adjust?
Five signs come up most often:
- A tool without a decision is growing. More and more people use a tool nobody has made a call on.
- Many people carry on after a notice. When a tool is not allowed, they skip the alternative and go on to the original anyway.
- An allowed tool barely gets used. The approved alternative exists on paper, not in the work.
- The same kind of data keeps coming up. Customer numbers or HR details keep appearing in text headed for AI tools.
- A new kind of use. A team uses AI for something the policy does not cover, such as translation or writing code.
Our article on which AI metrics actually tell you something covers how to read the figures behind those signs.
What can you actually do?
You have more options than allowing or banning.
Take a decision. A tool that sees real use and has no decision deserves one. That can be "Limited use" with a condition: general questions are fine, no personal or customer data.
Improve the alternative. If people ignore a tool, ask why. Perhaps the alternative translates less well, or nobody knows it exists. Sometimes the business tier of the tool people already use is the best answer.
Make the condition specific. "Be careful with sensitive data" is hard to apply. "No names, customer numbers or national ID numbers; use [NAME1] if you need an example" is something people can do mid-task.
Aim the guidance at what keeps coming up. If the same data keeps appearing, give a short explanation of exactly that data type, with an example from your own work. Training lays the foundation; a targeted reminder like this helps people apply it.
When do you choose a stricter measure?
Sometimes a stricter approach is right, for example for a tool whose vendor uses input to train its models. An organisation can then decide that employees cannot go on to that tool after the notice, or that sensitive data is masked by default before it is sent.
Only do that once the alternative works. A strict measure without a usable alternative tends to push the work to a personal account or a phone, where you no longer see it. With a good alternative alongside, the same measure is mostly a clear signpost.
How do you know the adjustment worked?
Pick one figure in advance that matches your measure. If you chose a better alternative, check whether the share of AI use through allowed tools goes up. If you clarified a condition, check whether that data type is sent unchanged less often. Look after a month, not a week: new habits take a little time.
If nothing changes, that is information too. Perhaps the cause was different from what you thought, and a conversation with the team is the best next step.
In BeeSensible you take these decisions per tool, with the alternative attached, and employees see the decision when they open the tool. Every tool starts as "No decision yet"; you choose.
