The AI in the Second Window
Emi wants to do her job well. Her employer has introduced an enterprise-wide AI platform and the pressure to use it is intense. The IT department is thorough and professional, and they have set up systems to ensure that information doesn’t move around in ways that might create risks. This limits quite severely the functionality and usefulness of the tool. On most days, Emi, like many of her colleagues, has a second window open with her own AI model running. She shares with it the information it needs to do the work well. It’s from another large, commercial provider and she feels comfortable that the files and spreadsheets she’s giving it won’t end up in the wrong hands. She’s pretty sure that this is a violation of company policy, a document that seems to be updated weekly. She is paying for the second model herself, and she sees many others doing the same. She assumes that the company won’t be willing to punish everyone. Plus, it’s allowing her to be more efficient in getting her work done and advancing her employer’s objectives.
If this story isn’t a familiar one, then you might be sitting on the other side of the decision. The organization creates policies to mitigate organizational risk. The leadership team prioritizes collective success and assumes that staff like Emi treat the organization’s risk as their own. Management is concerned about data protection, confidentiality, legal and regulatory liability, quality control, bias, and accuracy. These are also issues about which Emi is concerned, but a bit more abstractly.
So where does this “policy-reality gap” come from?
Often, it comes from culture, or the conditions people read in the world around them before they act. It can be hard to see culture, because we are inside it and shaped by it, but we can sometimes see evidence of its operation in the habits, artifacts, and interactions that emerge.
Emi understands the policies and the motivations behind them. However, she has made a personal determination that learning and adhering to the policies requires too much work and will involve giving up too much. People in Emi’s role are rewarded for productivity, and the personal AI tool supports this goal. Perhaps Emi doesn’t trust that leadership has her best interests at heart and feels insecure in her position. Perhaps she doesn’t believe the organization’s work is meaningful, and that individual sacrifice isn’t justified. Perhaps she believes that she is replaceable and that since everyone else is using their own AI tools, that she shouldn’t risk falling behind and becoming the next person replaced.
These beliefs aren’t written down but they show up in subtle and obvious ways. When someone is let go or when praise is offered, these serve as signals for what behaviours are esteemed and which are not. A colleague shares something sensitive with human resources and then is punished for it, and a collective hush falls over anyone else who might consider transparency. We are each careful observers of our own environments. Emi weighed the risks of breaking the rules, the costs involved in getting the rules changed, and concluded that arguing the policy wasn’t worth it.
Emi’s decisions about AI use are never recorded and are usually only revealed when something goes amiss. Whether her choices are the right ones or the wrong ones is beside the point. The policy is excellent and airtight, and nobody follows it. Whether a policy or initiative takes root and thrives will be determined, in part, by the culture(s) in which the policy is planted and how receptive that culture is to these new rules, processes, or procedures.
Instead of deciding on the right language and limits for an AI policy and procurement process, the organization might have dug into what stakes employees have in the organization’s success, how they make sense of the messages around them, and how safe they feel falling behind in one area (productivity) in service to another (information security).
Of course, the organization could implement even tighter IT controls and ensure that staff don’t make use of their own AI solutions on work hardware and that bringing one’s own device becomes more challenging. Files then end up on a USB stick and shared on a personal laptop. Or employees interpret the changes as a lack of trust and begin acting as if this assessment were true.
When there is a conversation about these policies, all sides must be circumspect in how they share their insights about how things actually work. Emi is unlikely to divulge that the organization’s mission isn’t all that meaningful. Management will be hesitant to share that employees are too often careless. Some look around and see deadlines and the limits of the new tool. Others look at the same workplace and see vulnerable client data and exposure.
All of this asks us to work with evidence that can be very hard to uncover. There is a wonderful, if apocryphal, story attributed to Margaret Mead that argues that the first evidence of civilization is a healed human femur. In the story, if your thigh bone breaks, you die. If others are there to take care of you, you might survive. Of course, animals do survive and take care of each other, and humans did the same long before what we know as civilization, but the point is an important one. The bone is an artifact of a relationship, evidence that someone was cared for. Policies and workarounds are artifacts too. The task is to read them for what they show about who carries what for whom.
Ursula K. Le Guin, drawing on Elizabeth Fisher’s hypothesis, argued that the first human technologies were probably for carrying things. She says, “If you haven’t got something to put it in, food will escape you — even something as uncombative and unresourceful as an oat.” We often associate early humanity with violence and hunting, and the reason might be that stories of spears and conflict are compelling. Stories of oats make for pretty dull tales, but they are more likely to capture the reality of life. The bags and carriers tend to rot away, and we are left with butchered animal remains.
Emi also hears heroic stories and responds accordingly. The high performer gets the bonus and the public recognition. The fastest to ship gets more resources in the next round. Those who take time off to care for family members see their desks moved to the outside of the circle and their opportunities for promotion dwindle. The cautious, careful language of the policy is perfectly consistent with how Emi might like to work, but the culture around her urges otherwise.
Everyone at Emi’s work is perfectly correct in their reasoning and yet the outcomes are not ideal for anyone. So, what is to be done?
Read workarounds as evidence, not insubordination. If Emi or one of her colleagues were discovered to be violating the company policies, the first instinct is to change the behaviour. However, these workarounds should be taken as evidence and as an opportunity to ask ‘why’ and track down root causes. Why would someone use their own money to use a prohibited AI model at work? Why would they keep it a secret? Why wouldn’t they bring their concerns to IT or upper management? There are too few channels that allow for the sharing of views on organizational culture that don’t punish the one who speaks. Anonymity and someone from outside the power structure can be helpful to surface how the culture is actually being felt by those in it.
Compare the assumptions that inform a policy and the assumptions that shape people’s work. Policies often carry the assumptions of their creators, which may differ from those accountable to deliver on them day to day. Do policies assume that employees are invested in the organization’s success? Do employees assume that reduced productivity will be overlooked if in service to safety? Employees ‘ought to’ find their work meaningful but this is a dangerous assumption to build governance around.
Change one small thing and see what happens. Small experiments that test the assumptions can uncover tremendous opportunities to find a better fit between policies and the culture on the ground. Experiments should focus on how people make sense and meaning from their surroundings. If the assumption is that employees are valued for productivity rather than information security, then publicly and substantively rewarding employees who go out of their way to protect client data is one way to see how people respond.
A healed bone is evidence that a group is willing to care for one of its members in a moment of crisis. A trophy and free tickets to Cancun for the top salesperson are evidence of where people should be directing their energy and attention. Each of us has our eyes open for evidence about the cultures we occupy. What is safe? Who is reliable? What behaviours will provide me with what I need? What use of authority is likely to be effective? A policy is a cultural artifact, a way of organizing behaviour. However, if the underlying culture provides evidence that the policy is unlikely to support outcomes that are beneficial to those implementing it, it will be ignored or circumvented.
Values can differ across organizations or teams, but coherence between rules and conditions is essential for success. As a leader, you have choices. You can provide policies that are likely to take root, or you can change the conditions of the soil so that necessary changes can find a home.