The AI Policy Exists. Does Anyone Know About It?

We've spent an extraordinary amount of time discussing what AI agents can do. Far less time, it seems, is spent asking whether the people using them understand the rules.

I recently attended a community discussion about artificial intelligence. There were some genuine aha moments as participants explored connecting AI to databases and streamlining everyday processes. When I asked about governance controls, the answers were uncertain.

That doesn't mean anyone was acting irresponsibly. It does illustrate a gap that deserves attention: enthusiasm for capability can move faster than an organization's ability to explain how that capability should be used.

If employees don't know a policy exists, whose problem is it?

IT may have written the acceptable-use standards. Security may have defined data-handling requirements. Legal may have reviewed the language. HR may have included a reference in onboarding. Management may assume employees have read it.

Every department can have completed its assigned task, and the organization can still have employees who don't know what is expected of them.

So is that an IT problem or an HR problem? The question is useful precisely because neither answer is sufficient.

IT and security understand technical exposure and controls. HR understands employee communication, training, and policy processes. Business leaders understand how work is actually performed. Executive leadership sets expectations and resolves competing priorities. Governance fails when these responsibilities are treated as independent handoffs instead of a shared operating obligation.

Publication is not awareness

A policy on an intranet is evidence that a document was published. It is not evidence that people know it exists, understand it, or can apply it to a real situation.

Consider an employee preparing a customer proposal. They discover that an AI assistant can summarize a spreadsheet in seconds. Are they permitted to upload the file? Does the answer change if it contains pricing, personal information, or confidential customer data? Does it matter whether the tool is a company-managed service or a personal account?

A policy that says 'protect confidential information' may be directionally correct without helping the employee make that decision. The practical guidance has to meet the employee where the work happens.

The goal is not to make everyone a specialist in AI risk. It is to make the expected behavior clear enough that employees can act confidently, recognize exceptions, and know where to ask.

Training is not the same as comprehension

A completed training module is useful evidence of participation. It doesn't necessarily establish that someone can distinguish an approved use case from an unacceptable one.

A stronger approach uses realistic scenarios from different roles: a recruiter screening applications, a finance analyst working with forecasts, a customer-service representative summarizing correspondence, or a developer connecting an agent to an internal system.

Those situations expose the actual questions: What information may be used? What actions require review? Who approves access? What should happen when an output is wrong or a tool behaves unexpectedly?

Managers also need to reinforce the expectations. If teams are measured only on speed and output, while governance is mentioned once during onboarding, the operating incentives may contradict the written policy.

Accountability has to be visible

I would ask leaders four questions. Can employees find the guidance when they need it? Can they explain what it means for their work? Do managers reinforce it? And can the organization identify and correct misunderstandings before they become incidents?

The answers require more than an annual acknowledgment. They require feedback from employees, practical examples, clear escalation paths, and periodic checks that policy still matches the tools and processes people actually use.

This is especially important as AI capabilities change. A policy designed around drafting text may not adequately address an agent that can query a database, update a record, or initiate a workflow.

Governance is an organizational outcome

The existence of a policy matters. So do technical safeguards. But neither substitutes for a workforce that understands the expectations and leaders who reinforce them.

I don't see this as an argument for moving AI governance from IT to HR, or from HR to IT. It is an argument against confusing departmental ownership of a document with organizational accountability for behavior.

The more useful question for executives is not simply, 'Do we have an AI policy?' It is, 'How do we know the people using AI understand what they are allowed to do—and what they are responsible for?'

That's where governance moves from documentation into practice.