Your organisation has an AI policy. But do you know if anyone follows it?

Most organisations I speak to now have some form of AI policy. A memo, a directive, a paragraph in the information security policy. Duly approved, neatly archived. And that is often where the story ends. Because between that document and what actually happens on Monday morning at the front desk, in the policy department or out in the field, there is a gap. The question almost nobody asks: do you know whether your staff follow that policy? And do they even understand it?

What the UN panel established on 1 July 2026

On 1 July 2026, the UN panel of forty international AI experts presented its first report, led by Turing Award winner Yoshua Bengio and Nobel Peace Prize laureate Maria Ressa. It fed into the first global dialogue on AI governance, held in Geneva on 6 and 7 July 2026.

Two findings stood out. One: there are already more than forty AI governance frameworks and guidelines worldwide, but they are fragmented, inconsistent and rarely tested on the only question that matters: do they work? Two: policymakers face what the panel calls the evidence dilemma. You need reliable knowledge to regulate AI well, but by the time that knowledge exists, the technology has already moved on.

That is about states and treaties, not about your organisation. But the pattern behind it is uncomfortably familiar: writing frameworks without ever checking whether they work.

The same pattern, closer to home

In many organisations, the AI policy is exactly that kind of framework: drafted, approved and never again held up against everyday practice. Nobody knows whether employees are aware of it. Nobody knows whether they follow it. Nobody knows whether it even matches the tools that are actually being used by now. We examined in a separate whitepaper how widespread that unauthorised AI use is in smaller organisations.

And the workplace has its own, smaller version of that evidence dilemma. When your policy was written, a good share of the AI features your staff use today did not yet exist. The colleague who discovered last month that the word processor can now "think along" did not reach for your memo at that moment. AI no longer enters only through procurement, where you can attach conditions to it. It is also built into the software you already have, and it evolves faster than any document.

A policy on paper does not steer behaviour. People do, when they understand what they are using and why there are limits.

Why a better document alone is not enough

The reflex is predictable: tighten the policy, write a version 2.0, add another annex. A clear, practical policy has real value, don't get me wrong. If you do not have one yet, you can start with our two-page template. But it does not solve the core problem. The gap is not in the text. The gap is between the text and the people.

The UN panel pointed to something comparable at global level: many AI safety assessments today are carried out by the companies that build the systems. Organisations, in turn, often rely blindly on whatever their software provider calls "safe". If the only party that understands what an AI tool does is the provider, then your policy is a signature under someone else's homework.

The EU saw this too. It is no coincidence that AI literacy sits right at the front of the EU AI Act: Article 4 asks organisations that provide or use AI to take measures to develop the AI literacy of their staff and of others working with AI systems on their behalf. The law does not demand a guaranteed level of knowledge per individual. It does demand demonstrable measures that fit role, experience and context. That no level has to be guaranteed for any individual has been written explicitly into the text since the Digital Omnibus. Not a paper exercise, then, but a practical obligation you must fulfil in a demonstrable way. Our free EU AI Act Compliance Checklist takes you through what you can record for that. Which is only logical: someone who does not understand what a language model can and cannot do cannot follow a policy about exactly that.

What actually closes the gap: AI literacy in practice

Three things, in this order.

Know what is being used. Not what was purchased, but what is actually in use. Including the AI that rides along in existing software and the tools employees have found for themselves. A simple tool inventory that gets half an hour of attention every quarter is enough. You measure the chatbot part of that free of charge with the AI Adoption Scan, and you add the AI inside existing software and vendor packages yourself.

Make sure people understand what they are working with. That is not a study day on neural networks. It is basic knowledge: what can this do, what can it not do, which information may go in and which never should. AI literacy training does not have to be heavy. It mainly has to happen, for everyone who comes into contact with AI. Our AI literacy training under the AI Act is built on that principle, and if you work in public services there is an in-depth module with the scenarios of that sector. And test the understanding, not the reading: a short knowledge check says more than a signature under the memo. With us that check is part of every module, with a certificate for each member of staff and a price per person. We calculated separately what training delivers.

Test the policy against practice, in a fixed rhythm. Concretely: check every quarter whether the policy still matches what employees actually use. Update the tool inventory, review a few real work products where AI played a part, set up an accessible reporting point for incidents and doubtful cases without a blame culture, and record twice a year, in a short meeting with senior management, what needs adjusting. Not an audit project, but a recurring business rhythm. Our own AI Incident Procedure is public and shows what such a reporting point can look like, and you are welcome to use it as a model. Precisely the point where the world's frameworks fail, according to the UN panel: they get written, not tested.

On 6 and 7 July 2026, governments in Geneva discussed how to keep AI governable at global level. Important work. But it changes nothing about what happens in your organisation today. Nobody will close that gap for you. The good news: it is a gap you can close yourself, and the first step is not a thicker document. It is people who know what they are doing. If you would like to know where you stand or how to begin, you can get in touch.

Rob Ummels, AIAdopt. AI adoption, AI literacy and practical guidance for organisations that want to use AI wisely.

Written by Rob Ummels in collaboration with Claude (Anthropic). Editorial responsibility: AIAdopt.