The debate around AI in the workplace has largely, up until this point, focused on the technology itself, from its potential to improve productivity and streamline workflows to concerns around accuracy, transparency and risk. More recently, however, focus has shifted towards the regulation introduced to govern it.
Organisations have been working to determine which tools employees should be allowed to use, which AI systems may present unacceptable risks and how they should prepare for new compliance requirements. However, regulation alone is not enough. Frameworks like the EU AI Act can set the expectations for how AI should be governed, but organisations rely on employees to put those principles into practice.
As AI becomes more embedded in everyday work, often without clear rules or oversight, the security and compliance risks are no longer confined to the technology itself. They also stem from how employees use AI, what information they share with it and whether they know when its output can be trusted.
The EU AI Act’s transparency obligations, which came into effect on 2 August 2026, apply to organisations using or developing AI systems in the EU. From banks and insurers using AI in decision-making to retailers and technology companies developing customer-facing chatbots, most organisations will be impacted by these requirements in some form.
A key focus of the Act is AI literacy, ensuring that the people using AI systems understand how they work, where their limitations lie and what risks they may introduce. This means organisations need visibility into how AI is being used across the business and must ensure that employees have the knowledge and awareness to use these tools responsibly. That challenge is particularly pressing given that 68% of businesses already identify employees as their biggest cyber risk. For CISOs, AI governance is therefore not just a compliance issue, but a people and security issue as well.
Rethinking AI governance
AI is amplifying many of the behavioural risks cyber security teams have been trying to manage for years: from employees taking shortcuts under pressure, to sharing information without fully understanding the consequences and placing too much trust in technology. In the case of generative AI, those behaviours can lead to sensitive data being exposed, inaccurate information entering business processes or unapproved tools being used outside established security controls.
In many cases, this is happening faster than organisational policies, security awareness programmes and governance frameworks can keep up, and is resulting in a growing gap between approved AI governance and employees’ actual behaviour: a human risk challenge that can quickly become a cyber security problem.
Closing that gap starts with accepting that employees are already experimenting with AI, whether an organisation has a policy in place or not. Organisations therefore, need to understand which tools employees are using, what information they’re entering into them, and how they’re using AI-generated outputs in their day-to-day work.
The answer to managing this securely shouldn’t be to tell employees to “check everything” AI spins up. Verification needs to be proportionate to the level of risk. A low-risk task like internal brainstorming may just require a quick sense-check. While using AI to process information that could influence financial decisions or involve sensitive data that could be weaponised by bad actors may require a formal review and meaningful human oversight.
Turning AI awareness into secure behaviour
AI training risks falling into the same trap as traditional cyber security awareness training if guidance is too vague or generic. For instance, the risks facing marketing teams will differ from those faced by finance, HR or software development teams.
Employees can tell the difference between guidance built around the actual decisions they make and training that could apply to anyone. It’s for this reason that 81% of CISOs admit that their security awareness training fails, as it’s too generic to feel relevant.
AI security training, whether that’s how to properly judge AI-output, or how to stay safe against malicious threats, must be role-based, built around realistic scenarios and targeted to each division.
Knowing the rules doesn’t necessarily help change behaviour. Human-based cyber security threats have repeatedly demonstrated that employees can understand a risk and still make a mistake when under pressure.
The goal isn’t to make employees afraid of AI, but to give them the knowledge and confidence to question it and use it responsibly.
Building the right culture around AI
The EU AI Act is helping to formalise expectations around transparency, accountability and AI literacy, but meeting those requirements will depend on more than a policy or compliance checklist. It will depend on whether employees know the security risks, recognise the limits of AI and make the right decisions when using it.
That’s why building a secure AI culture should be viewed as an extension of an organisation’s wider human risk management strategy. Technology controls and compliance frameworks are essential, but they cannot compensate for every rushed decision made by an employee interacting with an unapproved AI tool.
