What should we do when staff use AI tools without understanding the risks?
Start by finding out what is used and why, before writing rules. In most companies the first wave of AI use comes from people solving real problems: drafting e-mails, summarising documents, writing code or translating. A ban drives that use out of sight; an approved tool with clear guidance keeps it visible. Then explain the risks in the terms of people's work: a customer contract pasted into a personal chatbot may break the confidentiality clause; an AI summary can miss the one sentence that matters; generated code can carry vulnerabilities or licence problems. Give a short list of data that never goes into unapproved tools, show how to use the approved one, and name someone to ask. Short, repeated training works better than one long session, and since February 2025 the AI Act requires organisations that use AI to take measures that support their staff's AI literacy. Check progress with facts: from the Pro plan, NetSenX shows which AI services are actually used and how much data goes there.