The Safe AI Use Playbook: policy, training, and the gap between them

Your AI use policy is almost certainly a better document than your company is a user of AI. ISACA’s 2026 AI Pulse Poll, a survey of more than 3,400 digital trust professionals, found that nine in ten believe employees are using AI in their organization while only a third say everyone is trained on it.

Policy coverage is rising. Capability is not. What you end up with is a signed document describing behavior no one has been taught to perform.

This playbook covers what belongs in the policy, what the EU AI Act and NIST ask you to teach, what safe-use training looks like session by session, and how to tell whether any of it governs anything.

What an AI use policy can and cannot control

An AI use policy is a decision record. It states which tools your company has approved, which classes of data may enter them, who checks the output, and who answers the hard cases. That record is worth having. It settles arguments, it satisfies auditors and insurers, and it gives a manager something to point at.

What it does not do is operate. A policy cannot classify a spreadsheet, notice that a model invented a citation, or decide whether a customer list counts as confidential when the names have been stripped but the account values have not. Those are judgments, made by a person, in about four seconds, with a deadline pressing. The person either has the judgment or does not, and the document on the intranet has no bearing on the matter.

This is the distinction the whole category misses. Search for an AI use policy and you will find ten near-identical templates, each with the same section list, each offered as a free download. The artifact is treated as the deliverable. Read the top legal and HR guidance and you find a single paragraph on training, usually phrased as a clause the policy should contain and not a program somebody has to run.

Two layers sit under every policy and determine whether it means anything. The first is technical control: what your tooling blocks, logs, or routes to a business-tier account. The second is human capability: what your staff can recognize, verify, and refuse. Security vendors sell the first layer well.

No vendor sells the second, because the second one looks like teaching, and teaching is not a product you can install. The broader case for treating that as a capability problem rather than a paperwork problem runs through our argument that buying licenses is not the same as building a team that can use them.

The size of the gap, in numbers you can check

Return to the ISACA numbers, because the two sides of that survey sit far apart. Alongside the 90% who believe employees are using AI, 38% have a formal comprehensive AI policy, 30% have a limited one, and 25% have no active policy at all. Only 33% say their organization trains all employees on AI, up from 22% the year before.

Policy adoption grew ten points in a year; training everyone grew eleven. Both are rising from a base so low that most companies are governing a practice they have not explained.

Usage is moving faster than either. Verizon’s 2026 Data Breach Investigations Report, published in May 2026, found that frequent AI tool use by employees jumped from 15% to 45% in a single year, and now ranks unsanctioned AI use as the third most common non-malicious data-leakage activity. A policy written against 15% usage is being asked to govern three times the traffic, performed largely in tools and accounts nobody chose.

The pattern repeats on the HR side. Traliant’s 2026 AI Governance Gap Report, a survey of more than 500 HR professionals, found that 65% of HR teams now use AI for compliance and policy work, while only 39% have a formal process to review AI output for bias, accuracy, or legal risk, and only 45% provide AI literacy training to all staff. The function writing the AI policy is using AI faster than it is checking it. Call that the same gap, one floor higher.

Put the three surveys side by side and the shape is clear. Coverage, usage, and oversight are all climbing, and the slowest of the three is the one that decides whether the other two matter.

Why a signed policy stops at the screen

People do not ignore AI policy because they are reckless. They ignore it because the policy competes with an incentive, and the incentive wins.

Ivanti’s 2025 Technology at Work Report put a number on the motive. Of the employees using generative AI at work, 32% keep it secret from their employer. The reasons are revealing: of those staying quiet, 36% like the secret advantage it gives them over peers and 30% worry their job may be cut. A further 27% report a kind of imposter syndrome and do not want their ability questioned.

Usage in that survey had climbed from 26% to 42% of employees in a year.

None of those three motives responds to a policy. A document cannot reassure someone that disclosing a productivity gain will not get them replaced. It cannot make the tool feel less like cheating. Add an overly tight rule on top, and the behavior does not stop, it moves to a personal account on a phone, where you have no log, no retention setting, and no chance of coaching.

Teaching reaches all three motives, which is why it works where enforcement does not. A session where the manager uses the tool in front of the team removes the secret-advantage premium: the skill is now public, expected, and credited. A session that names the failure modes out loud removes the sense that using AI is a form of faking it, because verification is visibly part of the work. And a session run on the team’s own documents, instead of a vendor demo, makes the sanctioned path the easiest path, which is the only reliable way to beat a workaround.

The mechanics of designing a session that lands this way are the subject of our guide to building a workshop that changes Monday morning.

One more thing about secrecy. In the sessions we run, the question that surfaces first is almost never conceptual. It is some version of “am I allowed to paste this?” Somebody has been quietly unsure for months and has resolved the doubt by not asking. Every hour that question stays unanswered is an hour of unlogged guessing, and no amount of policy drafting resolves it, because the answer people need is a worked example, not a clause.

The eight clauses that earn their place

Most templates run twelve to twenty sections. Eight of them do real work. The rest either restate your existing handbook or describe a review process no one performs.

Clause	What it has to say	How it fails when it is vague
Scope	Who is bound, including contractors, and that it covers personal and free accounts used for work	Staff read “company tools” and conclude their own account is out of scope
Approved tools	The named products that are approved today, on which plan tier	“Use approved tools” with no list means any tool counts as approved
Data classes	Which categories of information may and may not be entered, in plain nouns	“Do not enter sensitive data” pushes the classification decision onto the least-trained person
Human review	Which outputs need a named human to check them before use, and what checking means	“Review AI output” becomes a glance, because nobody defined the check
Disclosure	When AI involvement must be disclosed, to whom, and in what words	Staff either over-disclose and look lazy, or never disclose and look deceptive
Prohibited decisions	The decisions AI must not drive, such as hiring, discipline, termination, credit, or medical judgment	Someone runs a résumé screen through a chat tool and nobody saw a rule against it
Output ownership	That generated material is not assumed original, licensed, or protectable, and when legal review is required	Marketing ships a slogan with an unexamined provenance problem
Owner and review date	One named person who answers edge cases, and a dated next review	Edge-case questions go unasked, and the policy ages into fiction

Two tests tell you whether a draft clause belongs. Can a person apply it in under ten seconds without asking anyone? And does it name something, a product, a data class, a person, a decision, rather than a quality? Clauses that fail both are decoration.

Keep the document short enough to be read. A policy people finish beats a complete one they skim, and the sections above fit comfortably on two pages. SHRM’s generative AI usage policy template is a reasonable starting shape if you want handbook-grade language, though it is member-gated, and like every template it hands you the document and leaves the teaching to you.

Where the law puts the burden on teaching

Two of the most-cited frameworks in this field already name training as the control. Neither asks you to produce a better document.

The EU AI Act is the blunter of the two, and it moved this summer. Article 4 has applied since 2 February 2025, and the AI Omnibus that entered into force on 27 July 2026 rewrote the wording. Providers and deployers must now “take measures to support the development of AI literacy” among their staff and anyone operating AI systems on their behalf, in place of an original duty to ensure a sufficient level of it.

That is a softening from a result to an effort, and it is the one change in this field most AI use policies have not caught up with. What did not move is the shape of the duty. It draws no line by company size, sector, or risk tier, so a fifty-person firm using a chat assistant for marketing copy is a deployer.

Commission guidance has held to two points throughout: there is no single approved curriculum, and general awareness training should be paired with role-specific instruction. Formal certificates are not required. Writing down what you taught and who attended is the only way to show you took measures at all, which under an effort standard matters more, not less. If you have customers, staff, or a subsidiary inside the EU, this applies whether or not your policy mentions it.

The US-side reference point is softer in force and identical in direction. NIST’s AI Risk Management Framework 1.0, published in January 2023, is voluntary, and it has become the standard auditors and insurers reach for. Its GOVERN function includes a subcategory, GOVERN 2.2, stating that an organization’s personnel and partners receive AI risk management training suited to their duties. The companion playbook goes further and suggests folding AI curricula into existing enterprise learning requirements, which is a polite way of saying this belongs in the same system as your security awareness program, not in a one-off memo.

Read together, both frameworks treat the trained person as the control surface and the document as evidence of intent. Most companies have inverted that: strong document, undocumented training, no record of who can do what. Fixing the inversion is cheap, and it starts by writing down which sessions happened and who attended.

What safe AI use training consists of

Here is where the category goes silent. Every policy guide tells you to train your staff. None tells you what the training is. The answer we would give any mid-sized company is three tracks, not one, with hours set by exposure rather than seniority.

Track	Who attends	Time per year	What it has to produce
Core safe use	Everyone with a license, including contractors	2 to 3 hours, in two sittings	Correct data calls, verified output, the approval path known
Role practice	Each function, in its own session	3 to 4 more hours	Two live workflows run end to end on real documents
Owner track	Policy owner, approvers, managers of regulated work	8 hours or more, ongoing	Edge-case rulings, incident handling, policy revision

Hours are a budget, not a goal. A single long session on a Thursday teaches less than the same hours split and spaced, because the behavior you want forms through repetition against real work, not through exposure to slides.

The core session everyone sits in

Run it as a working session, not a briefing, and anchor every minute to a document the attendees already handle. Four things have to come out of it.

A data call people get right under pressure. Not a definition of confidentiality, a sorting exercise. Put eight real artifacts on the screen, with the identifying details scrubbed, and have the room sort them while arguing. The disagreements are the lesson, and they surface every ambiguity your policy left behind.

A verification habit with a name. Pick one check per output type and drill it until it is automatic. Every figure traced to a source document. Every citation opened. Every quoted clause matched against the original text.

People do not skip verification because they doubt the need. They skip it because no one ever named the check.

One rehearsed failure. Show the tool confidently producing something wrong on the team’s own material, then take it apart. A session that only shows the tool working teaches staff to trust it, which is the opposite of safe use.

The approval path, used once. Have everyone in the room request approval for one tool or one new use case while the session is live. A path that has been walked once gets walked again. A path that exists only in writing never does.

The role sessions that follow

Risk is not evenly spread, and neither should the teaching be. Finance pastes bank details and forecast data. Sales pastes pipeline and contact records. HR pastes résumés, performance notes, and medical accommodations, and sits closest to the prohibited-decision list.

Engineering pastes source code and configuration, including the secrets buried in it. Customer support pastes whole conversation histories with names still attached.

Each function needs its own hour on its own material, with its own refusal list. The curriculum shape by role, and how to run nine of them without building nine programs, is covered in our breakdown of why one company needs nine different curricula.

Managers need a separate half hour that nobody else attends, covering two things: how to answer “can I paste this?” without guessing, and how to respond when a staff member discloses a mistake. The second one sets the ceiling on everything you will ever learn about your real exposure. If the first disclosure gets punished, it is the last disclosure you get.

The longer track for people who own the policy

Somebody has to rule on the cases the policy did not anticipate, and that person needs more than the core session. Their track covers how model providers handle data across consumer and business plan tiers, what your contracts say about retention and training, how to run a short review when a new tool is requested, how to handle an incident where regulated data entered a tool, and how to revise the policy on a cadence instead of after a scare.

At a company of 50 to 500 people, this is rarely a new hire. It is an operations lead, a chief of staff, or a CFO who picked it up as a second job. Giving that person a real curriculum, and the authority to say no, converts an unpaid burden into a functioning role.

A data rule people can remember under pressure

The failure point in most policies is the data section, because it offloads classification onto whoever is in a hurry. A rule has to be recallable at speed, which means three buckets at most.

Open. Anything you would already send to a counterparty or publish: your own draft language, public market data, marketing copy, published filings. Goes into approved tools without a second thought.

Internal. Unpublished business information with no personal data in it: forecasts, pricing models, strategy documents, internal reports. Goes into approved tools on a business-tier plan only, never a personal account.

Restricted. Personal data, health or financial records, credentials, source code with secrets, anything under NDA or regulatory duty. Does not go in at all unless a named approver has signed off on that tool for that purpose, in writing.

Two rules make the three buckets work. Any mixed document inherits the highest class in it, which stops the common error of treating a mostly-harmless report with one customer name as internal. And when someone cannot place an item, the answer is to ask the owner, not to guess, with the resulting ruling added to a running page of worked examples. After a month or two, that page covers nearly every case that comes up, and it is a better teaching artifact than the policy itself, because it is made of real decisions and not categories.

The plan-tier distinction deserves a line of its own, because it is where employee belief and vendor terms diverge most often. On business and enterprise plans, the major providers state that customer inputs are not used to train their models by default; on free consumer tiers the protections are weaker and the settings sit with the individual. That difference is the entire reason to pay for licenses rather than let staff bring their own accounts. Verify the current terms of the specific plan you buy at purchase time, because these terms change, and a policy that cites a two-year-old setting is worse than one that cites none.

The approval path for a new tool

Shadow AI is usually a routing problem wearing a compliance costume. Somebody needed a transcription tool on a Tuesday, had no idea how to ask, and signed up with a work email. The fix is a path short enough to use.

1. A request takes five minutes. One form, one channel, five fields: tool, purpose, data class it will touch, who else wants it, link to the vendor’s data terms. If requesting takes longer than signing up, people will sign up.
2. A named owner answers in days, not weeks. Publish the response target. Silence is read as a no, and a no with no reason is read as an invitation to proceed quietly.
3. The review asks six questions. What data class does this touch, is there a business tier, does that tier exclude training on inputs by default, who administers the account, what happens to data on cancellation, and is an approved tool already doing this job adequately.
4. The answer is published. Approvals and refusals both go on the approved-tools page with a one-line reason. The reasons teach more than the list does, and they stop the same request arriving four more times.
5. The list gets a dated review. Quarterly is enough. An approved-tools list with no date on it is a list no one trusts.

Most refusals should be redirections. “No, and the tool you already have does this” closes the loop without creating an adversary. Whether a given capability belongs in a tool you buy, a workflow you build, or a habit you teach is a judgment covered in our look at when to buy capability and when to build it.

Nine questions that reveal whether your policy governs anything

Ask these in one sitting. You will know inside twenty minutes whether you have a control or a document. Any three noes mean the policy is not operating.

1. Can you name the approver for a new AI tool request, and can three random employees name the same person?
2. When was the last time somebody actually filed a request, and how long did the answer take?
3. Can a staff member outside IT state your data classes correctly, without reading them off a screen?
4. Does anyone know which plan tier your licenses are on, and whether that tier excludes training on your inputs?
5. Has anybody been shown the tool failing on your own material, and not just succeeding in a vendor demo?
6. What is the named verification check for your highest-volume AI-assisted output?
7. Has a single person disclosed a mistake with AI output in the past quarter, and what happened to them?
8. Do you have a written record of who was trained, on what, and when?
9. Is your license count higher than your weekly active user count, and by how much?

Question seven is the diagnostic one. A quarter with no disclosed mistakes in a company with hundreds of AI licenses does not mean no mistakes occurred. It means they are not reaching you. Question eight is the one an auditor or insurer will ask, and the one few companies can answer, which is also the easiest to fix from today forward.

What to measure once the training is done

Four numbers on one page, reviewed monthly. Attendance is not one of them.

Correct data calls. Re-run the sorting exercise from the core session 60 days later with different artifacts. The score, not the attendance sheet, is your evidence of AI literacy, and it is the record Article 4 documentation should rest on.

Disclosed near-misses. Count the mistakes people bring to you voluntarily. This number should rise after training and keep rising for a quarter or two. A rise means the reporting path works; a flat zero means it does not.

Sanctioned share of use. Weekly active users on approved tools against your license count, read alongside whatever visibility your tooling gives you into unapproved use. Moving this number is the actual goal of the policy, and it is the only one that lowers exposure instead of describing it.

Requests filed. A policy with an approval path and no requests is a policy no one is using. Three or four requests a quarter from a 200-person company is healthy traffic, not a problem.

None of these measure whether AI made anyone faster, which matters separately and gets measured differently. The method for proving capability moved, and not merely that a session happened, is set out in our guide to measuring enablement.

What this costs and who sells it

Three kinds of vendors will answer a request for AI governance training, and they are not substitutes.

Catalog e-learning comes from the large course libraries: Coursera, Udemy Business, LinkedIn Learning, Skillsoft, Pluralsight. Priced per seat per year, cheap at scale, and the fastest route to a completion report. The format is a recorded module and a quiz. It produces a compliance record.

The defining weakness is that it never touches your documents, your tools, or your data classes, so it cannot change the four-second judgment that is the whole point. Catalogs change quarterly, so check the current curriculum and seat pricing on the vendor’s own page before you commit.

Instructor-led public courses come from training firms such as General Assembly, BrainStation, NobleProg, and Certstaffix, usually as a scheduled class an individual attends. Better than a video for an individual learner. Still generic, still priced per seat, and it trains one person without changing how a company operates.

Delivered workshops on your own material are the format that moves behavior, because the exercises use your documents and the rulings land in your worked-examples page. In the current market, hands-on team workshops run roughly $2,000 to $15,000 depending on length, depth, and headcount. Custom automation work, which is a different purchase entirely, sits in the $25,000 to $150,000 range. Pricing scales with scope rather than with seats, which makes it worse value for training one person and better value for making a function competent.

Compare cost per changed behavior, not price per seat. A $40 course that 300 people finish and none of them apply cost you $12,000 and bought a spreadsheet. The full economics of that trade, including what a program should cost end to end, are worked through in our playbook on moving from license rollout to measurable capability.

Where to start if you have a policy and no training

The common starting position at a company of 50 to 500 people is a signed policy, a license count that looks fine, a usage dashboard that looks adequate, and no record of anyone being taught. If that is where you are, the first thirty days matter more than the next six months.

Week one. Name the owner and the approver publicly, by name and not by department. Publish the approved-tools list with plan tiers. Open the worked-examples page with the five questions your team has already asked.

Week two. Confirm which plan tier each license sits on and read that tier’s current data terms. This is a one-hour task that settles the question the whole company has been guessing at.

Weeks three and four. Run the core session twice, so shift and schedule conflicts cannot exclude anyone, and record attendance in a form you could hand an auditor. Use real documents. Include one rehearsed failure.

Month two. Run the role sessions for the two functions with the heaviest restricted-data exposure, usually HR and finance. Start the monthly four-number review.

Month three. Re-run the sorting exercise, read the four numbers, and revise the policy against the rulings on the worked-examples page. A policy revised from real decisions is the first version of the document that describes how your company actually behaves.

If you want a second opinion on where the gap sits in your organization before committing to any of it, we run a free AI-readiness call that works through the nine questions above against your actual setup and tells you which of the three tracks you need first. No preparation required, and if the answer is that your policy is already governing well, that is a useful thing to hear too.

Frequently asked questions

Do we need an AI use policy before we roll out AI tools?

You need three decisions before rollout and the full document can follow. Name the approved tools and their plan tier, write the data classes in plain nouns, and name the person who answers edge cases. That fits on one page and is enough to start safely. Teams that wait to roll out until a complete policy clears legal review usually find staff have been using personal accounts for months by the time it lands, which is a worse exposure than an incomplete policy.

Does the EU AI Act require us to train employees on AI?

Yes, if you are a provider or deployer of an AI system with EU exposure. Article 4 has applied since 2 February 2025, and the AI Omnibus that took effect on 27 July 2026 changed the standard from ensuring a sufficient level of AI literacy to taking measures that support its development. There is still no exemption by company size, sector, or risk level, and no prescribed curriculum or certificate. Commission guidance recommends pairing general awareness training with role-specific instruction and keeping documentation of what was delivered, which in practice means an attendance record and a summary of content.

Can we just block the AI tools instead?

Blocking moves the behavior rather than stopping it. Verizon’s 2026 report found frequent employee AI use tripled from 15% to 45% in a year, and shadow AI is now the third most common non-malicious source of data leakage. Technical controls are worth having, especially data-loss prevention on known endpoints, and they work best as a backstop behind a sanctioned path that is genuinely easier to use than the workaround. A block with no approved alternative produces usage you cannot see, which is the exposure you were trying to avoid.

Who should own the AI use policy, IT, HR, or legal?

One named person owns it, and the useful question is who answers the edge cases rather than who drafts the text. Legal should review the language, IT should own technical controls and plan tiers, and HR should own the handbook integration and the disclosure path. At a company of 50 to 500, the day-to-day owner is most often an operations lead or chief of staff, because the role is mostly answering “can I paste this?” quickly and consistently, which needs availability more than specialist depth.

Is it safe to put company data into ChatGPT, Claude, Gemini, or Microsoft Copilot?

It depends on the plan tier, not the product. On business and enterprise plans, the major providers state that customer inputs are not used to train their models by default; on free consumer tiers protections are weaker and the relevant settings sit with the individual user. The practical rule is company-administered business accounts for internal information, no personal accounts for work, and restricted data only with a named approval for that tool and purpose. Check the current terms of the specific plan at purchase, because these terms are revised regularly.

What should AI security training for employees cover?

Four things, taught against your own documents: which data classes may enter which tools, one named verification check per output type, at least one demonstration of the tool failing on your material, and the approval path used once live in the session. Two to three hours split across two sittings covers it for general staff, with a further three to four hours per function for the teams handling regulated or customer data. A recorded module and a quiz produce a completion record rather than a changed judgment.

How do we know whether anyone is following the policy?

Measure behavior, not attendance. Re-run a data-classification exercise 60 days after training and score it. Count the near-misses people disclose voluntarily, and expect that number to rise for a quarter if the reporting path is working. Compare weekly active users on approved tools against your license count. Count the approval requests filed. A quarter with zero disclosed mistakes and zero requests at a company with hundreds of licenses tells you the policy is not in use, whatever the signature page says.

How much does AI governance training cost?

Catalog e-learning is priced per seat per year and is the cheapest line item on the page, which is why it dominates completion reports and changes little. Hands-on team workshops delivered against your own documents run roughly $2,000 to $15,000 in the current market, scaling with length, depth, and headcount instead of seat count. Custom automation work is a separate purchase in the $25,000 to $150,000 range. The comparison that matters is cost per changed behavior, where a cheap course that nobody applies is the expensive option.

How often should the AI use policy be reviewed?

Quarterly for the approved-tools list and the plan tiers, annually for the policy text, and at once when a provider changes its data-handling terms or you adopt a tool in a new data class. Date the next review inside the document, because an undated policy is read as optional. The best input to a revision is the running page of worked examples from real edge cases, which tells you where the current wording left people guessing.

Key takeaways

• A policy is a decision record, not a control. The control is a person who can classify data and verify output in a few seconds under deadline pressure.
• The measured gap is wide: 90% of organizations believe staff use AI, 38% have a full policy, and 33% train everyone, while frequent employee AI use tripled to 45% in a year.
• Policies get ignored for behavioral reasons, not reckless ones. A third of AI users hide their use, mostly to keep an advantage or protect their job, and no document addresses either motive.
• Eight clauses do the real work: scope, named tools, data classes, human review, disclosure, prohibited decisions, output ownership, and a named owner with a dated review.
• EU AI Act Article 4 and NIST AI RMF GOVERN 2.2 both put the duty on training rather than drafting, and the July 2026 Omnibus made Article 4 an effort standard. Keep a record of who was taught what, because that record is the evidence.
• Train in three tracks sized by exposure: a core session for everyone, role practice for each function, and a longer track for whoever rules on edge cases.
• Measure correct data calls, disclosed near-misses, sanctioned share of use, and requests filed. Attendance proves a session happened and nothing else.