AI Policy Acknowledgements Don’t Prove Employees Are Complying

Summary

Jamf argues that AI-use policies alone cannot verify employee behavior, and recommends visibility into AI tools, agents and MCP servers, plus controls over platform access and configuration, to govern data-protection risks.

Key points

• Jamf says employees may use unapproved AI tools or expose company data even after acknowledging an acceptable-use policy.
• It identifies limited visibility into AI platforms, data processing, MCP server access and on-device agents as barriers to proving compliance.
• The article recommends maintaining visibility into AI tools, agents and MCP servers across an organization’s devices.
• It also recommends controlling which AI platforms employees can use, who can access them and how each platform is configured.
• Jamf cites a Ponemon Institute and DTEX report that put the average cost of an insider-risk incident at $19.5 million in 2025, up by over $2 million from 2024; the article attributes a 15% year-over-year rise in insider negligence to the report.
• Jamf says its 2026 survey found that organizations with deeply integrated AI experienced AI-related incidents at 1.4 times the rate of organizations just beginning to explore AI.