{"id":269,"date":"2026-06-30T13:06:56","date_gmt":"2026-06-30T11:06:56","guid":{"rendered":"https:\/\/p-j4su3f.project.space\/2026\/06\/30\/an-ai-policy-alone-does-not-solve-the-problem\/"},"modified":"2026-07-02T12:57:49","modified_gmt":"2026-07-02T10:57:49","slug":"an-ai-policy-alone-does-not-solve-the-problem","status":"publish","type":"post","link":"https:\/\/euaiact-academy.com\/en\/2026\/06\/30\/an-ai-policy-alone-does-not-solve-the-problem\/","title":{"rendered":"An AI policy alone does not solve the problem"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">When it comes to AI, many companies do the obvious and the right thing: they draw up a policy. A document that sets out what is and isn\u2019t permitted. That\u2019s a good step \u2013 but only the first. After all, a document on the intranet doesn\u2019t in itself change behaviour at the desk. What matters is not whether the rules exist. What matters is whether they are put into practice in day-to-day life.     <\/p>\n\n<h4 class=\"wp-block-heading\">A policy is a start, not a solution<\/h4>\n\n<p class=\"wp-block-paragraph\">Of course, internal guidelines are important. Without them, there is no benchmark. But there is a greater gap than one might think between \u2018there is a policy\u2019 and \u2018people act in accordance with it\u2019.  <\/p>\n\n<p class=\"wp-block-paragraph\">For an AI policy to be effective in day-to-day practice, employees need to be able to do four things \u2013 and these build on one another:<\/p>\n\n<ul class=\"wp-block-list\">\n<li><strong>Know the rules. <\/strong>It sounds trivial, but it isn\u2019t. A policy that was sent out once by email and then filed away on the intranet is hardly remembered by anyone after three months. <\/li>\n\n\n\n<li><strong>Understand the rules. <\/strong>Knowing isn\u2019t the same as understanding. \u2018No personal data in public tools\u2019 is easy enough to write. But is an email with the sender\u2019s name already considered personal data? Is an anonymised customer quote acceptable? Anyone who has merely read the rule but hasn\u2019t fully grasped it will be at a loss when faced with the first borderline case.    <\/li>\n\n\n\n<li><strong>Recognising typical borderline cases. <\/strong>Everyday life rarely consists of clear-cut cases. It consists of \u2018it depends\u2019. It is precisely these grey areas that determine whether a policy is helpful or merely a piece of paper.  <\/li>\n\n\n\n<li><strong>Remaining capable of taking action. <\/strong>Ultimately, someone has to make a decision at a specific moment \u2013 usually under time pressure, without having the policy to hand.<\/li>\n<\/ul>\n\n<p class=\"wp-block-paragraph\">When policy and practice diverge, a scandal rarely ensues. Something quieter, but just as delicate, happens: uncertainty, evasive behaviour, unspoken habits. When in doubt, someone pulls out their private mobile phone with their private AI account \u2013 and suddenly, usage takes place entirely outside the scope of any rules.  <\/p>\n\n<p class=\"wp-block-paragraph\">That is why good AI governance is not just a matter of documents. It is just as much a matter of <strong>comprehensibility<\/strong>. <\/p>\n\n<h4 class=\"wp-block-heading\">Many training courses fail not because of their content, but because of their format<\/h4>\n\n<p class=\"wp-block-paragraph\">This brings us to the crux of the matter. If understanding determines success or failure, then the way the material is delivered is not a side issue \u2013 it is the crux of the matter. <\/p>\n\n<p class=\"wp-block-paragraph\">Most of us are familiar with this: compulsory training as a series of slides to click through. Forty slides you click through whilst your inbox flashes in the background. At the end, a test where you\u2019re more likely to guess the answers than actually know them. Ticked off. What sticks isn\u2019t knowledge, but a tick on a list.    <\/p>\n\n<p class=\"wp-block-paragraph\">When it comes to AI, this format is particularly disastrous. Because this isn\u2019t about rigid rules that you learn once and then apply. It\u2019s about exercising judgement in unclear situations.  <\/p>\n\n<p class=\"wp-block-paragraph\">What companies need instead is something different:<\/p>\n\n<ul class=\"wp-block-list\">\n<li><strong>Clear categorisation<\/strong> rather than an information overload \u2013 what\u2019s really important, and what\u2019s just detail.<\/li>\n\n\n\n<li><strong>Plain language<\/strong> instead of legal jargon that nobody outside Legal \/ Compliance would voluntarily read.<\/li>\n\n\n\n<li><strong>Everyday examples<\/strong> instead of abstract principles.<\/li>\n\n\n\n<li><strong>Recognisable situations <\/strong>\u2013 scenarios in which someone recognises themselves: \u2018Ah, I do that too.\u2019<\/li>\n\n\n\n<li>Comprehensible standards, which you can remember because they make sense \u2013 not because you\u2019ve learnt them by heart.<\/li>\n<\/ul>\n\n<p class=\"wp-block-paragraph\">Because AI isn\u2019t about memorising terms. Nobody needs to be able to recite the wording of a legal provision. It\u2019s about <strong>making better decisions at the right moment<\/strong> \u2013 for example, the split second when someone is about to post a deceptively realistic AI image on LinkedIn and pauses briefly: \u201cShould I actually label this?\u201d  <\/p>\n\n<h4 class=\"wp-block-heading\">The real risk isn\u2019t intent, but routine<\/h4>\n\n<p class=\"wp-block-paragraph\">This is the point that is most frequently underestimated in the discussion. When people talk about the risks of AI, many think of malicious behaviour. In fact, the risk is much more mundane \u2013 and precisely for that reason, greater: it is routine.  <\/p>\n\n<p class=\"wp-block-paragraph\">Employees turn to whatever helps them. The assistant uses the tool to quickly summarise the lengthy meeting minutes. The Sales team feeds the draft quotation into the tool. This is understandable \u2013 and in many cases, exactly what we want. Nobody wants employees who shy away from tools that make their work easier.    <\/p>\n\n<p class=\"wp-block-paragraph\">That is precisely why it is not enough to rely on reason alone. Reason is there. But reason does not make decisions in the heat of the moment \u2013 habit does. Companies need a framework that does not work against everyday life, but with it:   <\/p>\n\n<ul class=\"wp-block-list\">\n<li><strong>Simple enough<\/strong> to actually be used \u2013 not a hurdle to be circumvented.<\/li>\n\n\n\n<li><strong>Clear enough<\/strong> to provide guidance in a specific situation.<\/li>\n\n\n\n<li><strong>Concrete enough<\/strong>, to reduce uncertainty rather than create new uncertainty.<\/li>\n<\/ul>\n\n<p class=\"wp-block-paragraph\">The key point is this: when the safe route is unclear and the quick route is obvious, everyday life makes the decision for itself \u2013 and almost always in favour of the quick route. This is not a question of character or good will. It is a question of <em>design<\/em>. If you want people to take the safe route, you must make it the easy route.   <\/p>\n\n<h4 class=\"wp-block-heading\">Governance is not decided in a filing cabinet<\/h4>\n\n<p class=\"wp-block-paragraph\">This brings us full circle. An AI directive is a good start \u2013 but it does not take effect in a filing cabinet, but in the mind of the person currently faced with a decision. Whether this succeeds depends less on the document itself than on whether the rules have been understood, whether they can be applied to real-life situations, and whether the safe path is also the convenient one in everyday life.  <\/p>\n\n<p class=\"wp-block-paragraph\">Good governance is therefore, ultimately, not just a matter of paperwork. It is a question of clarity. And that is precisely where it is decided whether good intentions are turned into everyday practice.  <\/p>\n\n<p class=\"wp-block-paragraph\"><em>This is exactly what the EU AI Act Academy aims to achieve: not a series of clicks to tick off a list, but clear training with real-life examples that empowers staff to act at the right moment \u2013 and provides the evidence required by the EU AI Act.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>When it comes to AI, many companies do the obvious and the right thing: they draw up a policy. A document that sets out what is and isn\u2019t permitted. That\u2019s a good step \u2013 but only the first. After all, a document on the intranet doesn\u2019t in itself change behaviour at the desk. What matters [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[14],"tags":[],"class_list":["post-269","post","type-post","status-publish","format-standard","hentry","category-eu-ai-act"],"blocksy_meta":[],"_links":{"self":[{"href":"https:\/\/euaiact-academy.com\/en\/wp-json\/wp\/v2\/posts\/269","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/euaiact-academy.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/euaiact-academy.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/euaiact-academy.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/euaiact-academy.com\/en\/wp-json\/wp\/v2\/comments?post=269"}],"version-history":[{"count":5,"href":"https:\/\/euaiact-academy.com\/en\/wp-json\/wp\/v2\/posts\/269\/revisions"}],"predecessor-version":[{"id":274,"href":"https:\/\/euaiact-academy.com\/en\/wp-json\/wp\/v2\/posts\/269\/revisions\/274"}],"wp:attachment":[{"href":"https:\/\/euaiact-academy.com\/en\/wp-json\/wp\/v2\/media?parent=269"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/euaiact-academy.com\/en\/wp-json\/wp\/v2\/categories?post=269"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/euaiact-academy.com\/en\/wp-json\/wp\/v2\/tags?post=269"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}