By the Shadow AI Policy team
Replace the policy walkthrough with short scenario drills built around each person's real job, repeat them on a fixed schedule, and measure behavior (which tools people use and whether they ask before pasting data), not course completion.
This post covers why scenarios beat lectures, how to tailor training for engineers, sales and HR, a reinforcement schedule you can run with a small team, the metrics that show whether behavior changed, and how to fold all of it into onboarding.
Nobody changes how they work because they were told a policy exists. They change when they've practiced the decision at the moment it matters: "I'm about to paste this into a chatbot. Is that okay?" Train that decision, not the document.
Scenarios work better because the policy fails at a specific moment, when someone is mid-task with a deadline and an unapproved tool open in another tab. A lecture teaches people what the document says. A scenario rehearses what to do in that moment.
Replace the slide deck with five to eight realistic situations drawn from your own workflows. Each one should end with a forced choice. Here is one, labelled as a hypothetical:
Hypothetical: A customer success rep has a 4,000-word complaint thread and a 2 p.m. escalation call. Their approved tool is slow, and their personal ChatGPT account is already open. What do they do?
The point isn't the "right" answer. It's the conversation about why. Is the thread customer data? Is the personal account covered by any company agreement? What's the approved alternative, and who can speed it up? Those questions are what people carry back to their desks.
Give everyone the same three-question pause test to use in every scenario, and print it on a card or pin it in Slack or Teams:
The third question matters most. If asking takes three days, people will skip it. Set a response-time promise (same business day is realistic) before you launch training, or the drills will teach people the policy is impractical.
Build scenarios from your own risk, not generic examples. If you don't yet know which tools your people use, start with our overview of what shadow AI is and how it shows up. Then ask managers for the three AI shortcuts they'd bet their team is already taking.
Yes. Each role touches a different kind of sensitive data and has a different temptation, so a single generic session wastes most people's time. Keep a short shared core (the pause test, the approved tool list, how to ask for a new tool) and add a 10-15 minute role module on top.
| Role | Highest-risk data | Typical shortcut | Drill to run |
|---|---|---|---|
| Engineering | Source code, credentials, architecture details | Pasting a failing function, or a config file with keys, into a chatbot; installing an unvetted coding assistant | Spot the secret in a stack trace before it goes into a prompt; compare an approved assistant such as GitHub Copilot against a personal-account tool |
| Sales and customer-facing | Customer lists, pricing, contract terms, call recordings | Uploading a CRM export to draft outreach; using a free meeting-notes bot on customer calls | Rewrite a prospect email using only non-identifying details; decide whether a bot can join a call and who must consent |
| HR | Employee records, performance and medical information, candidate data | Summarizing a grievance file or ranking candidates in a general-purpose chatbot | Redact a performance review so it's safe to use for drafting; decide when a human must review any AI-assisted people decision |
| Finance and operations | Forecasts, vendor terms, banking details, unreleased results | Uploading a spreadsheet to "find the trend" | Turn a sensitive spreadsheet into a question that works on aggregated or dummy data |
Managers deserve their own short module too. They're the ones employees ask, and a manager who says "just use whatever works" undoes the whole program. Give managers a one-page script for the three most common questions and tell them where to escalate the rest.
Run role sessions as 15-minute team-meeting slots, not separate calendar events. Attendance and attention are both better when the training lives inside a meeting people already hold.
Plan on one launch session, a short follow-up within a month, quarterly micro-drills, and extra sessions whenever the policy or tool list changes. A once-a-year compliance course is the schedule least likely to change anything, because AI tools and workflows shift faster than annual training cycles.
Here's a schedule a 50-500 person company can run without a dedicated training team:
Between sessions, make the policy findable. Put the approved tool list and the pause test where people already work: a pinned channel message, the intranet home page, or a browser bookmark. If someone has to search a shared drive for a PDF, they won't.
Don't punish early self-reports. If the first person who admits "I pasted something I shouldn't have" gets a disciplinary meeting, you'll lose visibility into the problem. Decide in advance how good-faith reports are handled, say so in training, and then follow through.
Measure behavior change, not completion. A 100% completion rate tells you people clicked through a module, not that anyone stopped pasting customer data into unapproved tools. Pick three or four signals and track them before and after training so you can see movement.
Anonymous pulse surveys help here. Two questions are enough: "Do you know which AI tools you're allowed to use for your work?" and "Do you know who to ask if you're not sure?" If either answer is no for a whole team, that team's training failed, whatever the completion dashboard says.
Treat the results as a training signal, not a performance review. If one team keeps missing the same scenario, the scenario or the approved tool list probably doesn't fit their work. Fix that before blaming the people.
Put the pause test and the approved tool list into a new hire's first week, before they've built habits with whatever tools they used at their last job. People arrive with AI habits from their previous employers, and day-one training is your best window to reset them.
A workable onboarding sequence looks like this:
Also update the policy itself to match. If you're starting from scratch, our AI acceptable use policy template is a good base, and you can generate a tailored policy kit and then trim it to a one-page summary for onboarding. Anything that doesn't fit on one page belongs in the full policy, not in the training.
Finally, add AI policy to the checklists that already exist: contractor onboarding, role changes and promotions into people-management, and offboarding. Contractors often handle the same data as employees and are the group most often left out of training.
Run one 30-minute session that covers the three-question pause test, the approved tool list, and how to request a new tool. Add two or three scenarios based on how your teams actually work. Follow up with a 10-minute review a few weeks later and a short scenario each quarter. That covers the essentials without a training platform or a dedicated trainer.
Yes, for everyone with access to company data, including managers, contractors and executives. Make the policy acknowledgment mandatory, but keep the sessions short and relevant so people don't treat them as box-ticking. Executives matter most because they often handle the most sensitive information and set the example for everyone else.
Don't wait for the full tool list. Train the pause test and the data categories first, because they apply to any tool. Tell people plainly that unapproved tools are off-limits for sensitive data, and give them a fast route to request approval. Then update the training whenever you approve or reject a tool.
Look at behavior signals, not completion rates. Watch unapproved AI tool usage where your tooling can see it, the number and speed of tool requests, and how people answer a repeated scenario a month later. Add short manager conversations and an anonymous survey asking whether people know which tools are allowed and who to ask. If a team gets those wrong, the training needs a rewrite for that team.
Tailored to your industry and the AI tools your team uses. Free preview, then $149/mo to keep it current as the rules and vendor terms change — or $79 for a one-time snapshot.
Generate my policy kit →Writing policies for several clients? MSPs, IT consultancies and fractional CISOs keep a roster of client kits that refresh monthly, under their own branding. See partner plans →