Last updated October 23, 2026.
In a 2025 KnowBe4 survey of more than 12,000 employees in six countries, about 3 in 5 said they used AI tools at work, while fewer than 1 in 5 said they were aware of their company's policy on AI use.
Employees follow AI guardrails when responsible AI policies are easy to recall at the moment of use and safer to follow than to bypass. At The Decision Lab, we design AI adoption programs for organizations whose employees have working AI tools and still avoid them or use them out of sight.
Behavioral science explains why employees ignore AI policies. The rules are often too long to apply in the moment, the approved path can take more effort than an unapproved tool, disclosing AI use can feel risky, and rules can seem to apply differently to leaders. Responsible AI adoption improves when organizations redesign those conditions instead of relying on policy acknowledgments and penalties alone.
In The Decision Lab's work with a 20,000-person Fortune 500 workforce, unclear usage guidelines were one of five behavioral barriers to enterprise AI adoption we identified. The six principles below draw on that work and on research into why people follow rules at work when nobody is checking.
Why employees ignore AI policies
In our experience, employees often break AI policies because they cannot recall the relevant rule in the moment, or because the approved route feels more costly than the workaround.
The 2026 PagerDuty Shadow AI Survey, run by Wakefield Research with 1,250 office professionals at companies with at least $500 million in annual revenue, shows both patterns. Nearly 9 in 10 respondents believed their company had formal AI policies, yet about 3 in 10 employees who used AI for work tasks were unsure whether their use was permitted at all. About 4 in 10 respondents said they would rather use AI without telling anyone than disclose it and risk being told it was not allowed, a pattern we cover in our guide to why employees resist AI tools.
Length is part of the problem. When Jonathan Obar and Anne Oeldorf-Hirsch asked 543 students to join a fictitious social network in their study of how people read privacy policies and terms of service, the privacy policy should have taken about 30 minutes to read at average adult reading speed. About 3 in 4 participants skipped it entirely, and those who opened it spent 73 seconds on average. Almost all of them, 98%, missed a clause in the terms of service that handed over their first-born child as payment for the service, and information overload was a significant predictor of not reading. The study involved students and a fictitious service, so it does not show how employees read workplace rules, but long AI policies are likely to run into the same limit on attention.
Adam Beautement, Angela Sasse and Mike Wonham named a second mechanism the compliance budget. Their research on employee security behavior found that people weigh what a rule costs them personally against the benefit they see, and that the effort they will spend on compliance is limited. Every rule that adds friction draws on the same budget, so a long list of low-stakes rules can use it up before employees reach the ones that matter most.
Why fear-based AI compliance backfires
Warnings and penalties are the default response to AI policy breaches, and the research suggests they do less than most governance teams expect. A meta-analysis of information security policy compliance by Alec Cram, Jeffrey Proudfoot and John D'Arcy pooled 25 quantitative studies. Employees' personal attitudes and the norms around them were among the more important predictors of compliance, while the link between compliance and rewards or punishment was relatively weak. The authors later expanded the analysis to 95 papers in MIS Quarterly.
Tom Tyler and Steven Blader compared two strategies for getting employees to follow workplace rules in two studies of employees published in the Academy of Management Journal. One relied on detecting breaches and sanctioning them. The other relied on employees seeing the organization's rules as legitimate and in line with their own values. The second had the stronger influence on preventing rule-breaking and on employees deferring to policies voluntarily, although in one of the studies sanctions had more influence on basic compliance.
AI use makes that distinction sharper than most workplace rules do. A prompt entered into an unapproved personal tool may fall outside normal organizational visibility and audit controls, so a guardrail that depends on detection has little to work with.
Fear also has a cost that compliance dashboards rarely show. When visible AI use feels risky, people keep using AI and stop mentioning it, and the organization loses the information it needs to spot a real problem early. Amy Edmondson's study of 51 work teams at a manufacturing company found that teams with higher psychological safety, a shared belief that it is safe to take interpersonal risks, showed more learning behavior, such as asking for help and talking about errors.
Six behavioral science principles for AI guardrails employees will follow
We use these six principles when we design or audit AI guardrails with clients. Each one answers a specific behavioral barrier from the research above.
| Behavioral barrier | Guardrail design response | Example |
|---|---|---|
| Rules are forgotten in the moment | One-page if-then decision rules | A one-page data classification guide |
| Guidance sits outside the work | Reminders and controls at the point of use | A data warning inside the prompt window |
| Approved tools add friction | Make compliant use the easiest option | The approved assistant inside tools employees already use |
| Rules lack visible meaning | Name the person or risk each rule protects | A customer-trust explanation beside the data rule |
| Rules seem unfair | Apply the same rules to leaders, in public | Leaders sharing their own approved AI use |
| Employees fear exposure | Separate honest mistakes from misconduct | A near-miss reporting channel |
1. Use one-page if-then decision rules instead of policy prose
Give employees a one-page set of decision rules they can apply in the few seconds before they paste text into a prompt, and keep the full policy as a reference for legal and security teams.
Example: "Do not paste customer, employee, financial or unreleased product data into public AI tools. Use the approved internal assistant, or ask your data steward if you are unsure."
Sorting data into a small number of categories, such as information that can go into any approved tool and information that never leaves internal systems, is easier to recall than a list of prohibited uses. Each rule should say what data can be used, which outputs need a human check before they are shared, when a person has to take over from the AI, and who to ask when a case is not covered.
We took this approach with a global ridesharing platform's safety communication, where drivers were contractors who could be sent guidance but not trained. We delivered the framework as an operational guide built on decision rules and worked examples, so every team that communicates with drivers works from the same standard.
2. Put reminders and controls at the point of use
Build the guardrail into the AI tool and the workflow where the risky decision is made, instead of relying on employees to remember a document.
Example: a banner inside the approved assistant that reads "Customer names and account numbers stay out of this chat. Use the redact button before you paste."
The World Health Organization's surgical safety checklist moved a short set of checks into the operating room itself. A study of nearly 8,000 patients across eight hospitals led by Alex Haynes found that the death rate fell from 1.5% of patients before the checklist to 0.8% after it, close to half. For AI, the equivalents include labels on documents that cannot be shared with external models, input filters that flag customer data before it is sent, and approved prompt templates that already include the required review step. Technical controls like these catch mistakes a policy document cannot, and they spare employees from remembering every rule.
3. Make the approved AI tool the easiest option
Remove the steps that make the sanctioned tool slower or harder to reach than a public chatbot on a personal phone, then remove low-value rules that draw down the compliance budget.
Example: the approved assistant opens from inside the email client and document editor employees already use, with single sign-on, so it takes fewer steps than a personal account.
In the KnowBe4 survey, only about 1 in 6 employees said they used AI at work with their IT or security team's knowledge. We treat every workaround as evidence about the approved path. When employees route around a guardrail, we look at what the workaround gives them, usually speed or a capability the approved tool lacks, and close that gap before adding enforcement.
4. Name the person or risk each guardrail protects
Attach a plain reason to every rule, phrased in terms of the customer or colleague at stake instead of a clause number.
Example: "Client documents stay in the approved assistant because our clients trust us with their data, and one leak can end that relationship."
People follow rules they see as legitimate, and a rule with no visible reason looks arbitrary. In two large field experiments on tax compliance covering more than 200,000 people in the UK, Michael Hallsworth, John List, Robert Metcalfe and Ivo Vlaev found that adding messages about what taxes pay for, such as public services, to standard reminder letters raised payment rates for overdue tax compared with the standard letter. In our ridesharing work, one of the factors we identified was whether drivers believed safety guidance served them or served the company, and we built the framework to align the platform's and the drivers' definitions of safety.
5. Apply the same AI rules to leaders, in public
Hold senior leaders to the same AI guardrails as everyone else, and let employees see them doing it.
Example: an executive explains at a town hall how they used the approved assistant to draft a board memo, including the review step they followed before sending it.
In the PagerDuty survey, about 4 in 5 respondents believed their company's AI rules were applied differently to leadership than to the rest of the workforce. Tyler's later analysis of employee rule-following traces employees' sense that rules are legitimate mainly to procedural justice, meaning whether they experience the organization's procedures as fair, so a rule that seems to bind only junior staff loses that legitimacy quickly. The tax experiments point the same way: descriptive norms, messages about what most people actually do, worked better than injunctive norms about what people ought to do.
6. Separate honest mistakes from deliberate misuse
State in writing that accidental mistakes reported promptly are handled differently from deliberate breaches, and give employees a channel for the cases the rules did not anticipate.
Example: "If you paste something into an AI tool that should not be there, report it in the AI help channel within a day. Mistakes reported promptly lead to a fix and a conversation, with no disciplinary record."
That channel only works if using it does not get people in trouble. When employees can say how they used AI on a piece of work without a reputational cost, the organization also learns where its rules are unclear.
How behavioral science improves responsible AI adoption
At The Decision Lab, we define responsible AI adoption as employees using AI productively and openly within the safeguards their organization has set. Governance and behavioral design do different jobs in getting there:
- AI governance defines the rules, risk thresholds, ownership and controls.
- AI guardrails translate those rules into practical limits and choices at the moment of use.
- Behavioral science designs the working environment so employees are able to follow the guardrails and choose to.
- Responsible AI adoption is the outcome, and the one we measure.
In our experience, organizations put most of their effort into the first two and expect the fourth to follow. The gap usually sits in the third, where the approved behavior is harder or riskier for the employee than the alternative. Our behavioral framework for AI adoption strategy covers how this fits into a wider adoption program.
How we design AI guardrails at The Decision Lab
We start every guardrail engagement with a diagnosis using our SPROUT framework, validated with data from more than 20,000 employees, to measure the behavioral conditions behind AI use, as described in our guide to the AI adoption readiness assessment. Two of its dimensions bear directly on guardrails. Organizational Enablement covers whether policies, leadership, incentives and culture support AI use, and Psychological Readiness covers how open individuals feel toward AI, including whether they fear being replaced.
In our work increasing AI adoption across a 20,000-person Fortune 500 workforce, at an HR technology company, unclear usage guidelines appeared alongside time constraints, workflow integration, low trust in AI accuracy and perceived complexity as one of five behavioral barriers. We designed 20 candidate programs, each aimed at a specific barrier for a specific group of employees, and piloted eight of them for one month with more than 100 employees against a control group. The programs ranged from hands-on tasks embedded in real workflows to a mission-based challenge series run in Slack. Confidence in exploring AI tools, measured before and after the pilot, rose 41% among participants and fell 26% among control-group colleagues over the same period. Unclear rules also hold back adoption more broadly, a pattern we cover in our guide on how to increase AI adoption across your workforce.
Guardrails also belong in the design of AI systems themselves. When we worked with BDC, Canada's bank for entrepreneurs, on designing AI capabilities that preserve human judgment, each of the ten AI capabilities in the resulting specification kept human judgment, from account managers to community partners, as the point of trust.
How to measure whether AI guardrails work
Signed policy acknowledgments show that employees received a document and say little about how they behave afterwards, so we track measures closer to what a guardrail is meant to change. These include the share of AI use that runs through approved tools, how often employees disclose AI use on their work, whether they apply a rule correctly in a realistic scenario, and how many near-misses get reported.
Where the stakes justify it, we test a new guardrail design against a comparison group before rolling it out, although a controlled experiment is not always necessary for low-risk changes. Taking the same measures before and after a change is the minimum.
A practical AI guardrail checklist
We usually open a guardrail redesign with these six steps.
- Reduce the employee-facing policy to one page of data, tool, review and escalation rules.
- Map the three most common AI workflows and identify where employees currently use workarounds.
- Put a short reminder, template, approval flow or technical control inside each workflow.
- Publish examples of leaders following the same guardrails.
- Create separate reporting paths for accidental mistakes and deliberate misuse.
- Measure approved-tool use, correct rule application, disclosure and near-miss reporting before and after the changes.
Frequently asked questions
How do you get employees to follow AI guardrails?
Make the rules short enough to recall when employees are about to use AI, build them into the approved tools, apply them to leaders as visibly as to staff, and make the approved route easier than the workaround. Pair enforcement with a safe way to report mistakes, and test changes against a comparison group when the risk justifies it.
Why do employees ignore AI policies?
Employees often break AI policies because they cannot recall the rule when it matters, or because following it seems to cost more than it protects. Long policy documents go largely unread, and rules that seem to apply differently to leaders lose legitimacy. Many breaches are better understood as workflow and comprehension failures than as deliberate defiance.
What does behavioral science add to responsible AI adoption?
Behavioral science treats an AI policy as a behavior change problem. It asks what makes the approved behavior costly at the moment employees use AI and which social cues shape it, then tests changes against comparison groups. It complements a governance framework, which defines responsible use, by working out how to get people to practice it.
Should AI policies include penalties for misuse?
Penalties belong in a policy for deliberate misuse of sensitive data, but they should not be its main mechanism. Research on workplace rule-following finds that whether employees see rules as legitimate predicts rule-breaking more strongly than sanctions do. Separate honest mistakes from deliberate breaches in writing, so employees report errors instead of hiding them.
How long should an AI acceptable use policy be?
Keep a full version for legal and security teams and a one-page set of decision rules for everyday use, since studies of policy reading find people spend about a minute on documents that take half an hour to read. The short version should cover what data can go into which tools, which outputs need human review, when a person must take over, and where to ask.
How do you measure whether AI guardrails are working?
Track behavior instead of acknowledgments: the share of AI use running through approved tools, disclosure rates, near-miss reports, and whether employees apply rules correctly in realistic scenarios. Where possible, compare against a group without the change. A rise in reported near-misses after a launch is often a good sign, since it usually means employees trust the channel enough to use it.
