The Acceptable Use Policy People Sign and Ignore

Every employee signed it on day one, sandwiched between the benefits form and the tax paperwork. It is eleven pages long, last updated four years ago, and it forbids personal use of company systems in the same sentence where it permits it. Ask ten employees what it says and the most accurate answer is 'something about not doing bad things.'

The acceptable use policy is the most-signed and least-read document in the company. Its actual function in most organizations is legal cover: proof that employees were told. The function it should have is setting the handful of expectations that keep company systems and data out of trouble.

Those are different documents. The second one is short, current, and taught out loud, and it is the only one that changes behavior.

TLDR

• A policy nobody reads is legal cover, not a control.

• Cut to the rules that protect the business: data handling, personal use, AI tools, external sharing.

• Write for the reader: plain sentences, real examples, no defined terms section.

• Teach it in person once a year; the signature is the record, not the education.

• Review it annually against how people actually work now.

The binder problem

Policies grow by accretion: every incident adds a clause, every audit adds a paragraph, and nobody deletes. The result covers everything and communicates nothing. When the policy forbids both personal use and reasonable personal use, employees learn the real lesson: the document is not meant to be followed literally, so follow it loosely.

That lesson generalizes, and it is corrosive. A workforce trained to ignore one policy is trained to ignore the next one, including the ones that matter. The same dynamic shows up in why compliance frameworks fail to change behavior: paper compliance teaches paper compliance.

The five expectations that carry the weight

Strip the policy to what actually protects the company. For most mid-market organizations, five expectations do the work: company data stays in company systems; credentials are personal and never shared; external sharing uses approved channels; new tools, including AI tools, get approved before company data goes in; and report the mistake fast, without fear.

This fictional example shows the before and after of one clause. It is an illustration, not a prescription.

Before (page 7, subsection 3)	After (rule 3 of 5)
Users shall not utilize corporate information assets for non-business purposes except as permitted under the reasonable personal use provision, defined herein as...	Personal use is fine for banking and browsing. Company data, customer lists, and internal documents never go to personal email or personal accounts. Ever.

Notice what the short version gives up: the illusion of covering every case. What it gains is being memorable at the moment of decision, which is the only moment a policy can work.

The principles behind an acceptable-use policy people actually follow apply to the whole document, not just the AI clause.

Teach it; do not just publish it

The annual review is a fifteen-minute session, not a link in an email. Walk through the five rules with the stories that justify them: the shared spreadsheet that ended up in the wrong inbox, the AI tool that memorized the roadmap. Stories are how rules survive contact with Tuesday afternoon.

Keep the signature, but demote it. The signature is evidence for the file; the teaching is the control. When the two are confused, companies end up with perfect records of a policy nobody follows.

Retire clauses on a schedule

Every annual review should delete something. Each clause is asked to justify itself against how people work now: the VPN clause from before the cloud migration, the email attachment rule from before the file-sharing platform.

A policy that shrinks toward relevance stays believable. One that only grows becomes the binder nobody opens, signed by everyone.

The related discussion of acceptable-use policy is worth your time alongside this one. The related discussion of from checklists to culture is worth your time alongside this one.

Frequently asked questions

Will a shorter policy hold up if something goes wrong?

A clear, specific, taught policy is stronger evidence than an encyclopedic one nobody read. What matters is that the rule violated was actually communicated and acknowledged.

How long should the policy be?

One page for the rules, plus an appendix for the details auditors want. Employees read the page; auditors read the appendix; both find what they need.

How do we handle violations under a simpler policy?

More fairly, because the rules are clear enough to apply consistently. Enforcement of an unread policy is arbitrary by definition; enforcement of a taught one is defensible.

A Defensible Next Step

Find your acceptable use policy and time yourself reading it. If you cannot finish in five minutes, or you find rules you did not know existed, the rewrite is overdue. Book a Decision-Clarity Call if you want the one-page version drafted.