A customer service team lead at an insurer gets an email from compliance. Attached is the new AI policy, six pages, with a request to "bring it to the team's attention" in the next team meeting. She has ten minutes for it, and she already knows how it goes: everyone nods, and next week someone under time pressure pastes a customer email into the free version of ChatGPT anyway, because that is the tool he knows.
The problem is neither the policy nor the team. It is the timing. A policy is read once; a tool is opened hundreds of times. So if you want to communicate AI policy without overloading people, do not bring the document to the employee. Bring the decision to the tool.
Why doesn't an email land when it counts?
Because the email is read on Tuesday and the question arises on Thursday. A separate article explains why what people learn from a training session or an email does not change how they act under pressure. The short version: people do know, but it does not occur to them at the time.
Something else is going on too. The KPMG and University of Melbourne study (2025, covering 48,000 workers in 47 countries) found that 57 per cent of workers hide their AI use from their employer. A policy that arrives as a warning does not shrink that figure. People use AI because it makes their work easier; the message has to share that starting point, or it will not be believed.
How many rules can someone remember?
One per situation. Not because people are slow, but because nobody runs through a list at the moment of choosing. They do what they did last time, unless something intervenes right then.
| Situation | The one rule | What goes with it |
|---|---|---|
| Someone opens a tool that is allowed | Nothing | No notice, no reminder |
| Someone opens a tool marked "Limited use" | The condition, in one sentence | For example: work account only, no customer data |
| Someone opens a tool with no decision yet | Public information only | And where to request the assessment |
| Someone opens a tool that is not allowed | Use this alternative instead | The alternative as the first button, the ban as the second sentence |
The four rules in that table come straight from the four statuses for AI tools. That is no coincidence: once the policy gives each tool a status, the communication for each tool is settled too. The status is the message.
Why name the alternative before the ban?
Someone who only hears "no" still has the work to finish. The way round it is obvious: a personal account, the phone, a tool nobody knows about yet. Why blocking amplifies that effect is a separate story; for communication, what matters is that a ban without an alternative does not change behaviour, only where it happens.
A notice that opens with "use Copilot Chat for this" and only then says that free ChatGPT is not allowed gives the same information in a different order. The first sentence is an answer, the second a boundary. People remember the answer.
There is one condition that often gets overlooked: the alternative has to do what the employee needed. Someone who opens a transcription tool and is offered a chatbot that cannot transcribe has not been given an alternative but a second ban. It shows in notices that keep being dismissed, and that says something about the policy, not the team.
What do you deliberately leave out?
This is the part that goes wrong most often, because the temptation to be complete is strong.
Not the legal basis. Article 5 of the GDPR and Article 4 of the AI Act are part of why the policy exists, but they mean nothing to someone opening a tool. Article 4 of the AI Act asks for measures that bring people to a sufficient level of AI literacy, taking into account the context in which the systems are used. That context is the desk, not the legal annex.
Not the catalogue. The organisation may have a status for hundreds of tools; the employee uses three or four. The list sits in the register for anyone who needs it, and each tool's status appears when it matters.
Not the risk scores, and no threats. "Violations will have consequences" is the sentence that feeds hidden AI use. The message is: this is what we decided, this is what you can use and this is where you report a tool we do not know about yet.
What does that look like for a team?
Back to customer service. The team lead does not spend her ten minutes summarising the policy. She asks which AI tools the team uses and hears, besides Copilot Chat, the free version of ChatGPT, a translation tool and a browser extension that rewrites replies. Nothing has been decided on the last two; she passes them to the administrator. That is all she has to contribute.
The rest happens at the tool. BeeSensible shows the organisation's decision in the browser when someone opens an AI tool: nothing for an allowed tool, the condition in one sentence for a tool marked "Limited use", a low-key notice for a tool with no decision yet if the organisation turns that on and, for a tool that is not allowed, the approved alternative as the first button. The extension does not block anything of its own accord: the organisation decides whether someone can still go on to the tool after the notice. What happens next is counted without a user ID. In this overview the administrator sees which tools still have no decision:
