When executives break AI policy too: why a policy alone is not enough

Most organizations have written a policy for using AI. A recent survey shows those policies are widely ignored in practice, and not only by employees but by senior executives too.

What the survey found

CalypsoAI, a company that works on AI security, surveyed more than 1,000 office workers in the United States in August 2025. The main findings:

• More than half of workers (52%) said they would ignore company policy if an AI tool made their job easier.
• A quarter admitted using AI tools without checking whether they were allowed.
• Nearly 30% had sent AI-generated content to others without reviewing it.
• More than a quarter of senior executives had entered proprietary company information into AI tools, and more than two thirds said they would use AI to make their job easier even if it broke policy.

Why a policy alone does not work

These numbers are not about discipline; they are about incentives. An employee under time pressure picks the tool that gets the job done sooner. If the approved tool is slow, limited or unfamiliar, or does not exist at all, a policy will not stop them. When senior executives do the same, the message is clear: the rules are for writing, not for following.

This has happened before. In the early years of cloud computing, many organizations moved to cloud services before they had the controls and visibility to manage them, and spent years catching up. AI is following the same path faster, because all it takes to start is a browser.

What works

1. Make the approved tool better than the public one. An assistant that knows your own documents and cites its sources is more useful for daily work than a public chatbot, and then there is no reason to go around the rules.
2. Keep the data inside. When the model runs on your own servers, even careless use does not send data outside.
3. Teach, do not just warn. People need to know which data is sensitive and why. In another survey published the same summer, 3 in 5 employees said they would welcome more training on the risks of AI.
4. Leaders go first. When senior managers use the approved tool themselves, others follow.

Vakav's view

Vakav Autonomous was built for exactly this: a knowledge assistant that runs entirely on the organization's own servers with no internet connection, gives each department its own workspace with defined access, and answers from the organization's own documents. Employees keep the convenience, and the organization keeps control of its data.

To learn more, see the Vakav Autonomous page or get in touch.