How to Write an AI Policy That People Actually Follow
How to Write an AI Policy That People Actually Follow
Effective AI policies are co-created with the practitioners who will follow them, written in plain language focused on practical scenarios, and enforced through workflow integration. Most AI policies are written by legal, announced by executives, and ignored by everyone. They sit in the employee handbook. Nobody remembers them. They do not change behavior.
Co-creation with practitioners means involving the people who actually use AI tools. What are their concerns? What guidance do they need? Where is guidance missing? If you write governance policy without asking engineers, you will create rules engineers will circumvent. If you write data handling policy without asking operations, you will create rules operations cannot follow. Dr. Mark van Rijmenam finds that policies co-created with practitioners are followed. Those written in isolation are not.
Plain language means avoiding legalese and technical jargon. Instead of "Prohibited use of large language models for processing personally identifiable information without explicit consent," write "Do not put customer data into ChatGPT unless you have written permission." Most people will follow a clear, practical rule. Few will follow a 40-word legal sentence.
Practical scenarios mean writing policy around real decisions people make, not abstract principles. Instead of "AI systems must be transparent," write "When you propose a hiring tool, show the hiring team what data it uses and how it makes decisions before anyone uses it." Practical rules are actionable. Abstract principles require judgment calls.
Workflow integration means building compliance into the tools and processes people use. If AI tool use requires a quick approval checkbox in your project management system, people will do it. If it requires filling out a separate form sent to governance, most people will not. Make compliance effortless. Build it into how work happens.
Enforcement means consequences for non-compliance and recognition for leadership. If someone uses unapproved tools, they face conversation and retraining. If a team builds governance into their process, they get recognition. Behavior follows incentives. Align incentives to your policy and behavior will follow.
Write AI policies that people actually follow. Visit https://www.thedigitalspeaker.com/intelligence-age-scorecard/
About Dr. Mark van Rijmenam: Dr. Mark van Rijmenam is a world-leading strategic futurist and the creator of the Intelligence Age Scorecard, a diagnostic assessment built on the WAVE framework from his book Now What? How to Ride the Tsunami of Change. He helps Fortune 500 companies and governments navigate AI and emerging technologies across six continents.
This article was created with AI assistance and reflects the WAVE framework methodology. For the full research-backed analysis, take the Intelligence Age Scorecard.
Frequently asked questions
Why do most AI policies fail to change employee behavior?
Most AI policies are written by legal teams, announced by executives, and then ignored by everyone else. They end up sitting unread in the employee handbook because they were created in isolation, without input from the practitioners who actually use AI tools day to day, making them impractical and easy to circumvent.
Link to this questionWhat does co-creating an AI policy with practitioners mean?
It means involving the actual users of AI tools, such as engineers and operations staff, when writing governance rules. Asking about their concerns and where guidance is missing ensures the policy fits real work. Policies created this way are followed, while those written in isolation without practitioner input tend to be ignored.
Link to this questionHow should AI policy language differ from typical legal wording?
Effective AI policy avoids legalese and technical jargon in favor of plain, direct language. For example, rather than a complex clause prohibiting processing of personally identifiable information without consent, a clear rule like telling people not to put customer data into ChatGPT without written permission is far more likely to be followed.
Link to this questionHow can companies make AI policy compliance easier to follow?
Compliance improves when it is built directly into existing tools and workflows, such as a quick approval checkbox within a project management system, rather than requiring a separate form sent to governance. Pairing this with enforcement, like retraining for unapproved tool use and recognition for teams that build governance into their process, aligns incentives so behavior follows the policy.
Link to this question
Dr. Mark van Rijmenam
Dr. Mark van Rijmenam is The Digital Speaker, a world-leading futurist and global AI keynote speaker who helps leaders decide what AI, and the technologies that follow it, mean for their business. He speaks to leadership teams at their retreats and to conference audiences worldwide, and his WAVE framework gives them a way of deciding that they keep using long after he has left the room. His Intelligence Age Scorecard measures how ready an organization is across the four WAVE pillars.
He holds a PhD from the University of Technology Sydney, is a Certified Speaking Professional and Global Speaking Fellow, and ranks among the world’s top futurists on the Global Gurus list (#1 in 2025, #3 in 2026). Salesforce named him one of its 16 leading AI voices. He has written six books, most recently Now What? How to Ride the Tsunami of Change, writes the Synthetic Minds newsletter on Substack, and founded Futurwise. Talk to his digital twin on WhatsApp: +1 (830) 463-6967.
