Getting every person to read and agree to the AI policy

Writing the policy was the easy part. Now forty people need to read it, understand it and agree to follow it, and you need to be able to show later that they did. An email with an attachment and the words please read will get you about a third of the way.

This post covers the rollout: how to get attention, what to record, and what to do about the people who never respond.

Why the record matters

An acknowledgement does two jobs. First, it makes people stop and read, because they know they are agreeing to something. Second, it gives you evidence. When a client's security questionnaire asks whether staff have accepted an AI-use policy, or when something goes wrong and you need to show the person knew the rule, the record is what you point to.

For that evidence to hold up, it has to say more than a name and a tick. A useful record contains:

• Who agreed: the person, identified by their company account rather than a typed name.
• What they agreed to: the exact version of the policy, with its wording as it was at that moment.
• When: a date and time.
• The statement they agreed with, such as: I have read this policy and I agree to follow it.

A link to the current policy is not enough, because the current policy may have changed since. The record needs to point to the version the person actually saw.

Make the rollout short and clear

1. Announce it in person or on a call. Five minutes from a founder or manager explaining why the policy exists does more than any email.
2. Send the policy itself, not a link to a folder, with one line on what you are asking: read it and agree by a date.
3. Give a deadline of a week or two. Long enough for holidays, short enough to stay on people's minds.
4. Offer a named person for questions. Questions are a good sign; they mean people are reading.

The people who never click

There will always be a few. At Northfield Clinics, a group of four clinics with 70 staff, eleven people had not agreed a week after the deadline. Most were part-time staff who rarely opened email. The practice manager printed a list, walked round on the next shift, and had everyone done in two days.

Reminders work best when they are personal and specific. A message from a manager saying you are one of three people who have not yet read the AI policy works better than a fourth general reminder to all staff.

Keep a list of who is still outstanding and review it weekly until it is empty. If someone refuses to agree, that is a conversation for their manager, not something to ignore.

New joiners

Add the policy to onboarding, alongside the other things people read in their first week. The acknowledgement should happen before they get access to AI tools, not months later when someone notices. A new joiner reads the policy with fresh eyes, so it is also a good test of whether it makes sense. If you are still drafting yours, the first-policy post sets out the sections.

New versions

When the policy changes in a way that matters, ask everyone to agree again. A changed rule about which data may go into which tool is a meaningful change; fixing a typo is not. Keep the old agreements: the fact that a person agreed to version two in March is still true after version three is published in September.

Include a one-line summary of what changed at the top of the new version. People are far more likely to read a policy a second time if they know which paragraph to look at.

In Openn Shield

In Openn Shield, publishing a policy creates a numbered version whose text never changes afterwards. Each person agrees to that version with the statement I have read this policy and I agree to follow it, and the record keeps who, which version and when. Publishing a new version asks everyone again, while earlier agreements stay exactly as they were. People who still need to agree get an alert, and you can see who is outstanding. See how acknowledgements work.