Montro

Episode

Why People Break the Rules Around AI at Work

Rules on paper rarely survive contact with people. In episode two of Montro In Practice, Ankur Arora sits down with behavioural scientist David DeFranza on why employees reach for AI tools they're not meant to use: the gap between personal productivity and organisational risk, why we behave more rationally when we think we're dealing with AI, and where that quietly becomes dangerous.

Published

24 August 2026

Duration

56 minutes

Guest

About the speaker

Dr. David DeFranza is an Assistant Professor of Marketing at University College Dublin, where his research applies computational social science to how people make decisions around technology, policy, and risk. Before his PhD at the University of Utah, he spent over a decade in industry - in content marketing, product marketing, and behavioural consulting.


His research looks at how people actually behave around AI, not just how they're expected to, which is exactly what this conversation gets into.

Episode guest

In this episode

Every organisation writes policy assuming people will follow it. Most people don't, and it's rarely carelessness. The trade-off they're actually making usually doesn't match the one the policy assumed they'd make. This conversation gets into why that gap exists, what it looks like specifically with AI tools, and what actually closes it.


The Benefit Is Personal. The Risk Isn't.


People run a cost-benefit trade every time they pick up a tool they weren't given, and from the outside it can look irrational. It isn't. An employee feels the productivity gain from an AI tool the moment they use it. The risk that tool creates rarely touches them at all. It sits with the organisation, and it tends to surface much later, if it surfaces at all.


"If I'm the employee, and the tool helps me improve my own productivity, that's something I feel immediately. But the risk is disintermediated, it's to the organisation. It doesn't affect me directly." - Dr. David DeFranza


There's a useful comparison here to climate change, where the same mismatch shows up: the cost of changing behaviour is personal and immediate, the benefit is collective and years away, so behaviour barely moves. Training people on policy doesn't fix this on its own, because the training doesn't touch who holds the cost and who holds the benefit. What does move things is incentive design, making the approved path pay off in roughly the same currency the unapproved one already does.


A 90-10 Split, and Why It Feels Different with a Machine


A decades-old economics experiment makes the pattern concrete. Two players split a sum of money. One proposes how to divide it, the other can accept or reject the offer, and a rejection means both players walk away with nothing. Play this with two humans and people reject uneven splits constantly, even past the point where rejecting costs them money they'd otherwise keep.


Replace one player with an AI and the rejections drop off. People start accepting splits that are far more lopsided, closer to the outcome a purely rational calculator would choose. Trust has surprisingly little to do with it. What changes is the belief that AI is a rational actor rather than an emotional one, a belief most people picked up from decades of film and television long before they ever opened a chatbot. The same instinct likely shows up at work, in how little scrutiny an AI tool gets compared to what a new hire or a new vendor would face, simply because handing something to a machine doesn't feel the same as handing it to a person.


Where AI Sharpens Judgment, and Where It Gets in the Way


That shift has a practical flip side inside a business. For work that rewards consistency and calculation, teaming up with an AI tool tends to make judgment sharper. Decisions that lean on emotion, intuition, or reading a room are a different story. There, the same pull toward a more "rational" mode of thinking can quietly work against the person making the call.


Knowing which kind of decision is on the table matters before deciding whether AI belongs in it at all.


What Actually Changes Adoption


Tighter policing of who's using what tool rarely works on its own. What tends to work is alignment.


"We need to think about how we align the incentive people get from productivity improvement with the incentive to be compliant with a corporate risk management policy." - Dr. David DeFranza


People also learn a tool's real limits fastest through direct, low-stakes experimentation. A policy document can tell them what to expect. Using the tool and watching it fail at something teaches them faster.


The risk was never really about the tool. It's about knowing who's carrying the cost of using it, and why the incentive to look away is usually stronger than the incentive to raise a hand.

More

More from the series

Worth your time – security, privacy, and resilience leaders across Europe.

When Controls Meet RealityOperational Resilience, DORA, Risk Management, Financial Service
FriSept 2026

When Controls Meet Reality

A framework that reads well for auditors can still fail when pressure hits. In this episode of Montro In Practice, Ankur Arora sits down with Emmanuel Ranchin, VP of Information Protection Governance at State Street, on the gap between documented controls and lived ones: why compliant isn't the same as resilient, how big institutions break where silos meet, and what DORA really asks of the board.

Watch now
Compliant on Paper Isn't Compliant in RealityGDPR, EU AI Act, Privacy Engineering, AI Governance, Data Protec
TueSept 2026

Compliant on Paper Isn't Compliant in Reality

A policy can say all the right things and still not describe what's actually running. In this episode of Montro In Practice, Ankur Arora sits down with Abhishek Bansiwal - DPO, lawyer, and privacy-and-AI governance leader, on the gap between paper compliance and lived reality: why "anonymised" often isn't, why the AI Act is closer to a product safety law than a privacy one, and the one question every leader should start asking - "so what?"

Watch now
Why Compliance Isn't SecurityCybersecurity, NIS2, Third-Party Risk, Multi-Cloud, Compliance
MonAug 2026

Why Compliance Isn't Security

"Compliant" and "secure" are not the same thing. In this episode of Montro In Practice, Ankur Arora sits down with Roopesh Srivastava, a cyber and resilience leader with two decades across military and enterprise, on why tick-box compliance leaves you exposed: people as the weakest link, building security into multi-cloud without slowing the business, getting third-party risk under control, and what NIS2 really asks of you.

Watch now
View all

Don't miss the next conversation

Get new Expert Series episodes and governance insights in your inbox.

Browse episodes