Picture a marketing coordinator at ten past four on a Thursday. She has a client brief, a deadline and a GenAI tool open in the next tab. She wonders whether she is allowed to paste the brief in. She could search the intranet, or wait for her manager to come out of meetings, or she could just get on with it. Most people get on with it.
That small decision is where governance actually happens. Boards approve frameworks, legal teams draft acceptable use clauses, and a PDF lands in a folder three clicks deep. Everyone then assumes the job is done. The Deloitte UK GenAI Workforce Survey, with fieldwork in May and June 2026 across a weighted base of 13,798 employees who had used GenAI for work, suggests the assumption is shaky.
What the survey found
Fewer than half of those GenAI users (44%) report that their company has a GenAI policy. A further 34% say there is no policy, and 23% do not know either way. Only 28% say their company has a policy, they know where to find it, they know what it says and they believe it is clear and up to date. That last figure is the one I would put on the first slide of any governance review.
These are perceptions, of course, and a policy can be sound on paper. But perception is what drives behaviour at the desk. If the person using the tool cannot find the rules or does not trust them to be current, the policy is absent in every way that matters to the risk you are trying to manage. The 23% who do not know whether a policy exists are a particularly telling group, because they are using these tools for work without any sense of where the boundaries sit.
Why policies go unfound
The survey does not say why, so this is my reading. Policies tend to be written by lawyers for the purpose of protecting the organisation, which produces careful language and very little help for someone deciding what to do with a spreadsheet at four o'clock. They are launched once, with an all-staff email, while the tools change every few weeks. And nobody owns the everyday question of whether a given use is fine, so people answer it themselves, or ask a colleague who is guessing too.
What to do on Tuesday
Start with a simple test. Ask five people at different levels to find your GenAI policy in two minutes and tell you one thing it allows and one thing it forbids. The results will tell you more than a compliance attestation does.
Then rewrite the policy for the person at the desk. Keep it to one page in plain language, with real examples of green, amber and red uses drawn from the work your teams actually do (client data, draft copy, code, meeting notes). Name an owner and a review date, and put a link to it inside the tools and templates people already use. Ask managers to spend ten minutes walking their teams through it, because a policy people have heard discussed is one they can remember.
Finally, treat questions as data. Whatever people ask about most is where the policy is unclear, and that is your next edit.
Who may let it act
If you want help turning a policy into something people actually use, our AI governance workshop takes leadership and frontline teams through exactly this work. Run the five person test this week and see what you get.
Write the rule in an AI governance workshop before the pilot sends anything. Squads can start from AI governance for non-lawyers.
