A customer service team lead at an insurer gets an email from compliance. Attached is the new AI policy, six pages, with a request to "bring it to the team's attention" in the next team meeting. She has ten minutes for it, and she already knows how it goes: everyone nods, and next week someone under time pressure pastes a customer email into the free version of ChatGPT anyway, because that is the tool he knows.
The problem is not the policy and not the team. It is the moment. A policy is read once; a tool is opened hundreds of times. So if you want to communicate AI policy without overloading people, do not bring the document to the employee. Bring the decision to the tool.
Why does an email not land at the moment that counts?
Because the email is read on Tuesday and the question arises on Thursday. Why knowledge from a training or an email does not change behaviour under pressure is worked out in awareness training makes people aware, it doesn't change their behaviour. The short version: people do know, and do not think of it at the time.
Something else is at play. The KPMG and University of Melbourne study (2025, among 48,000 workers in 47 countries) found that 57 percent of workers hide their AI use from their employer. A policy that arrives as a warning does not shrink that figure. People use AI because it makes their work easier; the message has to share that starting point, or it will not be believed.
How many rules can someone remember?
One per situation. Not because people are slow, but because at the moment of choosing they do not walk through a list. They do what they did last time, unless something steps in at that moment.
| Situation | The one rule | What goes with it |
|---|---|---|
| Someone opens a tool that is allowed | Nothing | No notice, no reminder |
| Someone opens a tool with limited use | The condition, in one sentence | For example: work account only, no customer data |
| Someone opens a tool with no decision yet | Public information only | And where to request the assessment |
| Someone opens a tool that is not allowed | Use this alternative instead | The alternative as the first button, the ban as the second sentence |
The four rules in that table come straight from the four statuses for AI tools. That is no coincidence: once the policy has a status per tool, the communication per tool is done too. The status is the message.
Why name the alternative before the ban?
Someone who only hears "no" still has the work to finish. The detour is obvious: a personal account, the phone, a tool nobody knows about yet. Why blocking amplifies that effect is a story of its own; for communication, what matters is that a ban without a route does not change behaviour, only where it happens.
A notice that opens with "use Copilot Chat for this" and only then says free ChatGPT is not allowed gives the same information in a different order. The first sentence is an answer, the second a boundary. People remember the answer.
That comes with a condition that is often skipped: the alternative has to do what the employee was looking for. Someone who opens a transcription tool and is offered a chatbot that cannot transcribe has not been given an alternative but a second ban. You notice that in notices that keep getting dismissed, and that is a signal for the policy, not for the team.
What do you deliberately leave out?
This is the part that goes wrong most often, because the temptation to be complete is strong.
Not the legal basis. Article 5 of the GDPR and Article 4 of the AI Act are part of why the policy exists, and they mean nothing to someone opening a tool. The AI Act asks in Article 4 for measures that ensure a sufficient level of AI literacy, taking into account the context in which the systems are used. That context is the desk, not the legal annex.
Not the catalogue. The organisation may know hundreds of tools with a status; the employee uses three or four. The list lives in the register for whoever needs it, and appears per tool at the moment it matters.
Not the risk scores and not the threat. "Violations will have consequences" is the sentence that feeds hidden AI use. The message is: this is what we decided, here is where it is fine, and here is where you report a tool we do not know yet.
What does that look like for a team?
Back to customer service. The team lead does not spend her ten minutes summarising the policy. She asks which AI tools the team uses, and hears, next to Copilot Chat, the free ChatGPT, a translation tool and a browser extension that rewrites replies. Nothing has been decided about the last two; she passes them to the admin. That is her entire role in the communication.
The rest happens at the tool. BeeSensible shows the organisation's decision in the browser at the moment someone opens an AI tool: nothing for an allowed tool, the condition in one sentence for a limited-use tool, a calm notice for a tool with no decision yet, and for a tool that is not allowed the approved alternative as the first button. The extension blocks nothing; continuing is always possible, and what happens next is counted without a user id. The admin sees in this overview which tools still have no decision:
