A policy is enforced by the decisions upstream of behavior, not by the record of behavior afterwards. Three of those decisions do most of the work: which account the work happens in, which data categories are off-limits in words people can repeat from memory, and what happens the first time someone gets it wrong. Monitoring is the last instrument in the set and the weakest, and the research says it can move the number the wrong way.
One clarification, because the term carries two readings. If you place an AI system on the European market, “AI policy enforcement” means market surveillance authorities and penalties reaching EUR 35 million or 7% of turnover. Different article. This one is for the person inside a US company of 50 to 500 people who has an AI use policy, suspects nobody follows it, and has been asked to fix that by Friday.
The answer you will find everywhere
Search the term and the first page is almost entirely security vendors: Tenable, Zscaler, Teramind, Strac, WitnessAI, Kovrr. Competent pages, converging on one answer. Enforcement means buying an inline layer that watches the traffic, inspects the prompt, and blocks the violation where it happens.
Each of them sells that layer. That does not make them wrong. It does explain why none opens with the question a mid-market operations leader actually has, which is what to do when you cannot buy anything this quarter. It also explains why the measured cost of watching people appears almost nowhere in the material.
The gap between the document and the behavior is the subject of the safe AI use playbook. This article closes it with instruments other than observation.
What the research says monitoring does
In the KPMG and University of Melbourne global study of AI at work, which surveyed roughly 48,000 people across 47 countries, 57% of employees said they hide their AI use and present AI-generated work as their own. Forty-eight percent had uploaded sensitive company information into public AI tools; 44% had knowingly used AI against their employer’s policy.
The same study reports the half that rarely travels with the first: only 47% had received any AI training, and only 40% said their workplace had any guidance on generative AI at all. Read the four numbers together and the behavior stops looking like defiance. People are using a tool that makes their work faster, without instruction, under a rule they half-remember, and concealing it because disclosure has no upside.
Then there is the finding that should change your plan. Chase Thiel and colleagues, writing in Harvard Business Review in June 2022, ran two studies on electronic monitoring and found that monitored employees were more likely to break rules — cheating on a test, taking equipment, working deliberately slowly. Monitoring shifted their sense of agency, so they felt less personally responsible for their own conduct. The effect softened when they believed they were treated fairly.
Applied to an AI policy, that is close to the worst available dynamic. The behavior you want to prevent is already hidden, and observation without permission produces better hiding. Hidden AI use is the exposure, not the use itself.
Six instruments, ranked by what each enforces
Enforcement is an ordered set. The cheap items at the top prevent the incidents the expensive items at the bottom can only record.
| Instrument | What it enforces | Cost | Watches anyone? |
|---|---|---|---|
| Account posture — a business tenant, not personal logins | Where data lands, who can revoke access, whether it trains a model | Seat cost | No |
| Admin configuration — connectors, retention, sharing | Every session’s default behavior | A morning | No |
| A short approved-tool list | Which products are in scope | An afternoon, quarterly | No |
| Data categories, not examples | The judgment call while pasting | A one-page rewrite | No |
| A no-blame disclosure route | Whether you hear about an incident in week one or month nine | A named person | No |
| Narrow logging, prevention of data loss | Evidence after the fact; blocking patterns | Platform tier or tool | Yes |
The first five require no observation of any individual, and each prevents a category of incident rather than catching an instance.
Account posture is deferred most often and moves the most. A consumer login sits outside your contract, your retention settings, and your offboarding process at once; the case for paying is in the security argument for enterprise AI accounts. Until that lands, nothing below it is enforceable.
Work through the admin controls to configure before you train anyone before writing a single rule, because a policy contradicting your tenant defaults teaches people the policy is decorative.
What your admin console already shows, by tier
A policy written against visibility you do not have is unenforceable the morning it ships. The verifiable position in October 2026 is narrower than the vendor material implies and more useful than the privacy rumors.
| Platform and tier | What an admin sees | Prompt and response content |
|---|---|---|
| Claude Team | Usage metadata: active users, utilization, per-user requests, tokens, cost | Not in standard reporting; the primary owner can run an on-demand organization export |
| Claude Enterprise | Plus audit logs of account and security events, plus a Compliance API covering activity, chats, and files | Available through the Compliance API, deliberately |
| ChatGPT Business | Workspace and member administration, app and connector controls, seats | The Compliance Platform is not offered on this tier |
| ChatGPT Enterprise and Edu | Audit, authentication, app and conversation-message logs via the Compliance Platform | Available; only a workspace owner can grant the conversation-messages permission |
Verify this against each vendor’s current documentation before writing it into a policy; the tiers change quarterly. Two consequences hold regardless.
On a team tier you have adoption data and no content: enough to run an enablement program, not enough to run an investigation. That is the right ratio for most companies this size.
Content visibility is a deliberate purchase with a deliberate announcement attached, and buying an enterprise tier quietly converts a trust problem into a trust incident. What to turn on, and for how long, is in logging and auditing company AI use.
Write the data rules so people can remember them
The most common defect in a mid-market AI policy is not a missing clause. It is a prohibited-data section written as a list of examples, which asks every employee to perform legal analogy while trying to finish a task. Categories generalize where examples do not. Five that people retain:
- Anything identifying a customer, patient, or named individual.
- Anything covered by a confidentiality obligation you owe someone else.
- Credentials, keys, and access tokens.
- Unreleased financials and anything material to a transaction.
- Personnel matters, including performance and compensation.
Five rules recalled under pressure beat twenty skimmed once. Where your confidentiality terms already cover this, say so rather than drafting a parallel regime — the overlap, and where it breaks, is in what your NDAs already say about pasting client material into AI.
Pair each category with the account it is allowed in rather than a yes or no. “Customer records: business tenant only, never a personal login” is actionable. “Use good judgment with sensitive data” is not a rule, it is a mood.
The first violation decides whether the policy survives
Here is the question the vendor material dodges. Someone pasted a client document into a personal AI account to hit a deadline. What do you do?
The common ladder — warning, block, notify the manager — is designed for misconduct, and this usually is not misconduct. It is someone doing their job faster with the tool they had, under a rule nobody taught them. A sequence that holds:
Same day. Establish what data was involved, in which account, and whether that account retains it. Delete what can be deleted; document what cannot.
Within a week. Decide whether this is a notification event under a client contract or a regulation. That is a counsel question, and asking it early costs far less than asking it late.
Within two weeks. Fix the condition that produced it. Nine times in ten the person had no business account, or did not know the document class was covered.
Then consequence, if any. Reserve the disciplinary path for repeat behavior after instruction, or for concealment. Spending it on a first honest mistake buys one enforcement event and a permanent end to voluntary disclosure.
Name the person who receives these reports and make reporting easier than hiding. Your incident count will rise in month one — that is the control working.
Capability is the control nobody counts
Treat training as an enforcement instrument, not a nice-to-have beside the real controls. Someone who understands why a rule exists applies it to the case the policy did not anticipate. Someone who signed an acknowledgment applies it to nothing. That is the argument for AI enablement over license distribution, restated in a governance register.
Two standards bodies point the same way. NIST’s AI Risk Management Framework states it outright in GOVERN 2.2: an organization’s personnel and partners should receive AI risk management training that lets them perform their duties consistent with the related policies, procedures, and agreements. Training is a named governance control, not an adjunct to one. EU AI Act Article 4, applicable since 2 February 2025, asks deployers to support AI literacy among staff and others operating AI systems on their behalf; Regulation (EU) 2026/1744, the Digital Omnibus published in July 2026, softened the verb and deferred the high-risk deadlines without removing the obligation. Neither asks you to watch anyone.
In practice this is ninety minutes on the team’s own documents: the five data categories against real examples from their inbox, which account to work in, what verification is expected before work goes to a client, and who to tell when something goes wrong. Run it live, record it, put the recording in onboarding. What the AI-specific version adds over an annual security module is laid out in the options for AI security and risk awareness training.
Where narrow monitoring is the right answer
This is not an argument against logging. It is an argument for sequence and scope.
Monitoring earns its place when a specific obligation is satisfied by evidence: a client contract requiring audit trails, an auditor asking how access is revoked, a regulated data class, an insurer’s questionnaire. Buy the tier, log the category, keep the scope to AI interactions. The line between pattern-based prevention and reading people’s work is drawn in preventing data loss with AI assistants.
Notice is not optional everywhere. Several US states require private employers to give prior written or electronic notice of electronic monitoring, some with acknowledgment and a posted notice, with escalating per-violation penalties. Check your obligations with counsel; “we will tell people later” is a compliance decision, not a communications one.
Labor law has a view. The NLRB’s General Counsel issued a memorandum in October 2022 urging the Board to treat surveillance and algorithmic management as presumptively unlawful where, taken as a whole, it would tend to interfere with protected concerted activity. That is a prosecutorial position rather than settled Board law, and the Board’s composition changes — still worth knowing before deploying keystroke-level tooling.
Aggregate beats individual. Is adoption rising, which teams are stuck, where is risk concentrated — team-level reporting with a minimum group size answers all three without a single named dashboard.
What this costs
| Line item | Market range | Notes |
|---|---|---|
| Business AI seats | Roughly $20–30 per seat per month | Claude Team and ChatGPT Business both list in this band in October 2026; verify before budgeting |
| Enterprise tier for content logging | Seat minimums, annual commitments | For a named obligation, not reassurance |
| Policy rewrite into categories | A few hours of counsel time | One page, not forty |
| An applied AI enablement session | Roughly $2,000–15,000 in the open market | Varies with group size and custom material |
| Prevention of data loss, then monitoring | Low to mid five figures annually | Most expensive, lowest in the order |
The ordering is the point. A company that spends $40,000 on monitoring before issuing business accounts has bought a camera for a room with an open door.
A thirty-day sequence
Days 1–5. Inventory which AI products are in use and under which accounts. Ask rather than scan; an amnesty question answered honestly beats a scan that drives the next tool underground.
Days 6–12. Make the account decision, buy the seats, and set the admin configuration before anyone is invited.
Days 13–20. Rewrite the data section as five categories, each paired with a permitted account. Name the person who receives disclosures and say out loud what you can and cannot see at your tier.
Days 21–30. Run the first applied session, record it, book the next for sixty days out.
Frequently asked questions
How do you enforce an AI policy without monitoring employees?
Through the instruments upstream of behavior: put the work in a business account you control, configure tenant defaults before rollout, write prohibited data as five memorable categories tied to permitted accounts, create a disclosure route easier than concealment, and train people to apply the rule to cases the policy never anticipated.
Can we see what employees type into ChatGPT or Claude?
Only at specific tiers, and deliberately. OpenAI’s Compliance Platform, which exposes conversation-message logs, is Enterprise and Edu only. Claude Team gives admins usage metadata rather than prompt content; audit logs and the Compliance API are Enterprise features. Confirm against current vendor documentation.
Is employee AI monitoring legal in the US?
Generally yes on employer-owned systems, with conditions. Several states require prior written notice of electronic monitoring, sometimes with acknowledgment and a posted notice, and penalties escalate per violation. Labor law adds a layer: the NLRB’s General Counsel has argued that surveillance interfering with protected concerted activity should be presumptively unlawful. Check your footprint with counsel.
What should happen on a first violation?
Contain the data, decide whether it is a notification event, then fix the condition that caused it — usually a missing business account or an untaught data category. Reserve consequences for repetition after instruction, or for concealment. Punishing an honest first mistake ends voluntary disclosure, your cheapest detection system.
How do we find shadow AI without scanning everyone?
Ask, with an explicit amnesty, and make the answer consequence-free. Then look at what is visible without inspecting content: expense reports, single sign-on grants, browser extension approvals, and the connector requests queued in your admin console. A scan finds this quarter’s tools and teaches people to hide next quarter’s.
Will our incident count go up if we do this?
Almost certainly in month one, and that is the signal you want: incidents are moving from invisible to recorded. Judge the program on the trend from month three and on how fast disclosures arrive, not the raw count.
Do we need a tool to prevent data loss?
Not to start, and not before the first five instruments are in place. Buy it when a named obligation requires it — a client contract, an auditor finding, a regulated data class — and scope it to AI traffic.
Who owns AI policy enforcement when there is no Chief AI Officer?
Split it deliberately: one named owner for the policy and tool list, usually operations or legal, and one for the controls, usually IT or security. The failure at this size is not conflict but vacancy, where each function assumes the other owns it. Put both names in the document with a review date.
Key takeaways
- Fifty-seven percent of employees hide their AI use, but only 47% have had training and only 40% work under any guidance. This is a capability gap before it is a compliance gap.
- Monitored employees were measured breaking more rules, not fewer, because observation reduces their sense of personal responsibility.
- Five instruments enforce a policy before anyone is observed: account posture, admin configuration, a short tool list, data categories instead of examples, and a no-blame disclosure route.
- Know what your tier shows. Content logging is an enterprise purchase on both major platforms, and buying it quietly converts a trust problem into a trust incident.
- The first violation sets the policy’s real terms: contain, assess, fix the condition, and save consequences for concealment or repetition.
- Where monitoring is required, give notice, scope it to AI interactions, and report team-level aggregates.
If you want a second opinion on whether your policy is enforceable as written, or what a ninety-minute applied session for your team would cover, book a free AI-readiness call. We will look at your tier, your tool list, and your data rules, and name the instrument that is missing.
Dirk Jan van Veen, PhD
