Embed the AI policy in the AI itself

Conventional AI policy delivery looks like an HR rollout: a document, a training session, an acknowledgement form, a reminder six months later. It moves the policy out of the lawyer’s drafts and into a folder where staff occasionally remember it exists. Compliance with this kind of policy depends on memory and good intent — both of which decay.

A different mechanism works better. Load the policy into the AI tool’s system instructions and tell staff that the AI is the first place to ask about its own use. When someone wants to know if a particular use is in scope, they ask the AI. The AI’s answer reflects the policy because the policy is in its context. The act of getting the answer simultaneously teaches the staff member how to use the tool, what its limits are, and what the rules say. Policy training collapses into tool training, with the tool doing the teaching. This is consistent with the broader argument in AI literacy is not a training problem.

Two consequences follow.

First, this only works if the policy has been written in a form the AI can usefully consult — that is, structured and readable for AI consumption rather than buried in formatted documents. A PDF in SharePoint is not ideal. See Structure documents for AI consumption, not just human reading.

Second, the enforcement is only as good as the policy. If the policy is vague, the AI’s enforcement is vague. If the policy is silent on a question, the AI improvises. This is a feature: the gaps become discoverable through staff queries, which is faster feedback than waiting for an incident. See Start AI governance imperfect; iterate rather than wait.

The mechanism scales because it does not depend on training events or HR cadence. Every new joiner asks the AI; every staff member asks again when the situation is unfamiliar; the policy’s surface area grows in step with use rather than in step with re-training. The conventional alternative — annual training, recertification, posters — does not.