· AI
The People Most Likely to Break Your AI Policy Are the Ones Who Approved It
Most AI use policies are written on the assumption that rank-and-file staff are the risk. The data says the opposite.
Most AI use policies are written on the assumption that rank-and-file staff are the ones cutting corners, and that a list of rules will fix it. Three surveys published this year say the opposite on both counts.
BlackFog's January survey of 2,000 employees at UK and US companies with more than 500 staff found that 69 percent of C-level respondents and 66 percent of director or senior vice president respondents agreed that speed beats privacy or security when picking an AI tool. Among administrative staff, only 37 percent agreed, and junior executives came in at 38 percent. The people with the authority to write the policy are the ones most willing to go around it.
The steelman: maybe the answer is just to block it
Before I argue against a hard ban, the honest case for one. If leadership itself cannot be trusted to follow a written policy, no amount of better wording fixes that. The practical answer, on this view, is to stop asking and start blocking: firewall unapproved AI domains, lock down browser extensions, run data-loss-prevention tooling that flags a paste into an unsanctioned chatbot regardless of whose login did it. Make the rule technical, not social, and nobody's good intentions matter anymore.
That case gets stronger the more you read these three surveys, and weaker at the same time.
Why the ban alone does not survive contact with the data
TrustedTech's September survey of 2,001 UK and US employees found that awareness of the risk runs high everywhere. Eighty-four percent of IT and telecoms workers said they understood the security and privacy risk of using unapproved AI tools. Seventy-three percent of that same group used one anyway. Healthcare and education workers showed the identical pattern at a lower level: 76 percent risk awareness in both sectors, with unapproved use well below that but still 38 to 41 percent. TrustedTech's own conclusion was blunt: "knowing the risks does not necessarily stop employees from turning to unauthorised tools."
That is the finding that breaks the pure-ban case. If awareness does not change behavior, there is no reason to expect a memo to change it either, and a policy document is just awareness with a letterhead. A technical block can stop a specific tool at a specific domain. It cannot stop someone from using their phone, a personal laptop, or whatever new chatbot launches next month, and the BlackFog numbers say the people most inclined to find that workaround are sitting in the C-suite, not answering phones.
Okta's AI Agents at Work survey, run by Apprize360 across 292 executives and 492 knowledge workers in seven countries, shows why leadership is also the wrong place to expect the fix to come from unprompted. Ninety percent of executives said they were confident in their organization's visibility into AI tool use. Fifty-two percent of knowledge workers admitted to using an unapproved tool anyway, 24 percent regularly, and in 16 percent of cases workers had handed an AI tool their login credentials. Fifty-eight percent of executives had already dealt with an AI-related security incident in the past year. The group most confident that it has visibility is the same group the other two surveys show is least inclined to follow the rules itself. That combination, not employee carelessness, is the actual failure mode: nobody feels urgency to fix a problem they believe does not exist, while being the most likely to cause it.
What this means for the policy itself
None of this means enforcement is useless. It means enforcement without a usable, fast, approved alternative is enforcing a rule that the people who could change it do not believe applies to them. A policy has a real chance of being followed only if three things are true at once: there is a specific approved tool that is at least as fast as the unapproved one, visibility comes from logs and not from asking people to self-report, and the policy's authors are visibly bound by the same rule, with no separate standard for anyone above a certain title.
That first condition is the one most companies skip, because it is the one that costs money and attention rather than a signature. A company that stands up its own fast, cheap, approved option, a model it runs or rents on its own terms instead of waiting on a slow enterprise rollout, removes the excuse that the sanctioned path was too slow to use. That gap between "we have a policy" and "we built the thing people would actually choose" is most of what an AI readiness engagement works through in practice, and it is also where MojoAI spends its time with clients. If your policy has not been tested against what your own leadership actually does under deadline pressure, that conversation is worth having before the next incident, not after it.
Sources
References used in this article. Links also appear alongside the relevant claims.
Let's make it happen.
You don't need a polished brief. A couple of lines about where you want your company to go is plenty, and we'll come back with what we'd tackle first.
We scope the work around your goals and timeline before quoting anything, so you know exactly what you're getting.