13: Building and Maintaining an IG Culture

Kotter’s 8‑Step Model (organization momentum)

Kotter’s model sequences actions leaders take to turn vision into collective behavior: create urgency, build a guiding coalition, craft and communicate the vision, remove barriers, generate wins, sustain acceleration, and anchor new norms in culture. The modern “8 Accelerators” emphasize parallel action and volunteer networks that speed change. [kotterinc.com]

Key implications for IG:

• Urgency: Use risk and business value to show why IG matters now—e.g., exposure from ungoverned AI or fines from poor data retention. [kotterinc.com]
• Guiding coalition: Include Legal, Compliance, IT, Security, Privacy, Data, HR, and business units—plus influential frontline “connectors.” [kotterinc.com]
• Short‑term wins: Demonstrate outcomes quickly (e.g., 30‑day reduction in retrieval time, drop in policy violations) to fund the next phase. [kotterinc.com]
• Anchoring: Bake IG behaviors into onboarding, performance goals, and procurement criteria (e.g., vendor data retention clauses). [kotterinc.com]

Prosci ADKAR (individual adoption)

ADKAR focuses on outcomes each person must achieve: Awareness (why), Desire (choose to support), Knowledge (how), Ability (do it), and Reinforcement (keep doing it). It is effective for identifying barrier points and tailoring communications, training, and coaching by audience. [prosci.com]

Practical uses:

• Map roles (e.g., call center agents, data scientists, records coordinators) against ADKAR to plan role‑specific interventions. [prosci.com]
• Use ADKAR diagnostics to pinpoint resistance (e.g., low Desire because workflows slow down; low Ability due to tooling complexity). [cdn.prod.w...-files.com]
• Reinforce with recognition, metrics, and manager one‑on‑ones; ADKAR stresses that sustained change needs visible Reinforcement. [prosci.com]

Overcoming Resistance and Securing Leadership Buy‑in

Resistance is often rational—people fear productivity loss, unclear rules, or “tool sprawl.” Use Kotter to build momentum and ADKAR to treat root causes (e.g., insufficient Knowledge or Ability). Executive sponsorship is decisive: the NIST CSF 2.0 Govern function calls for formal roles, risk appetite, and policy oversight—mechanisms only leadership can provide. [kotterinc.com], [nist.gov]

ARMA IGIM 2.1 operationalizes buy‑in with a cross‑functional Steering Committee (including AI oversight), clear Authorities (policies, laws), and Support Functions (training, comms, project management) that enable scale. [todaysgene...ounsel.com]

Table: Change Management Phases (Kotter + ADKAR)

Mandatory vs. Role‑Based Training

• Mandatory: Annual or semiannual core training on policy, retention, privacy, acceptable use, incident reporting, and AI usage principles (e.g., sourcing, sensitive data handling, and documentation). NIST AI RMF provides the “why” and “how” for trustworthy AI practices across Govern–Map–Measure–Manage. [nist.gov]
• Role‑based: Tailored modules for data stewards, frontline staff, developers, marketers, HR, and executives; map to risks each audience influences (e.g., developers on dataset documentation; sales on CRM data quality). IGIM 2.1 recommends aligning support functions (training, comms) with program domains. [todaysgene...ounsel.com]

Gamification, Microlearning, and “In‑Flow” Learning

Research shows gamification can improve motivation and engagement, but design quality and autonomy matter; overly intense gamification may reduce perceived autonomy and hurt outcomes. Use light‑weight points/badges/quests for practice and feedback, not for coercion. [link.springer.com], [tandfonline.com]

Microlearning (5–10 minute modules) is now a leading trend in compliance training: it improves retention, fits hybrid schedules, and is easier to update as rules change. Surveys show growing preference for short, targeted lessons; learning industry analyses highlight the cognitive science behind spaced repetition and reduced cognitive load. Embed just‑in‑time tips in the tools where work happens. [trainingindustry.com], [sai360.com], [elearningi...dustry.com]

AI Ethics and Responsible Use (Approx. 750 words)

Creating an IG‑aligned culture of responsible AI use requires a curriculum that teaches employees not only what the rules are but how to apply them in daily tasks. The NIST AI Risk Management Framework (AI RMF 1.0) and its 2024 Generative AI Profile provide the backbone for building this capability by defining governance expectations, trustworthy‑AI characteristics, and risk‑management actions across the AI lifecycle.

1. Establishing Foundations: Roles, Governance, and Accountability
Training should begin with the RMF’s Govern function, which emphasizes leadership oversight, accountability, and organizational policies. Employees must understand not only the existence of AI policies but the reasoning behind them — including trustworthy‑AI attributes like safety, security, privacy enhancement, fairness, and transparency. The RMF positions governance as an enterprise responsibility, not a technical afterthought, which aligns well with broader IG culture‑building.

Learners should also understand the basic division of responsibilities across AI roles — creators, evaluators, operators, end‑users, and managers. Each role interacts with different risks; for example, frontline users must follow acceptable‑use rules, while developers must document model assumptions and limitations. This clarity ensures everyone recognizes where they fit into the governance structure.

2. Mapping AI Use Cases and Understanding Context
The next layer of training aligns with the Map function, which requires documenting the purpose, stakeholders, data inputs, intended use, and potential harms of an AI system. Employees should learn to complete short “AI Use Case Profiles” capturing this context. These are lightweight but important: they create traceability and prevent the all‑too‑common problem of teams quietly adopting AI tooling without understanding risks.

The GenAI Profile expands these expectations specifically for generative systems, noting risks like unintended memorization, prompt leakage, and harmful or misleading content generation. Training should give concrete illustrations: for instance, how a genAI tool might inadvertently reconstruct sensitive training data in its outputs when insufficiently constrained. Employees should practice identifying whether a proposed use case lies in a higher‑risk category requiring additional oversight or testing.

3. Data Protection, Prompt Handling, and Information Controls
One of the most critical elements involves teaching employees how to handle data when interacting with AI systems. The Generative AI Profile calls out the importance of capturing prompts and outputs (when appropriate and legally permissible), applying data‑minimization principles, and enforcing strict controls around sensitive or regulated content.

Training must be very explicit here. Employees need rules of thumb like:

• Never paste customer PII or confidential business information into external or non‑approved genAI tools.
• Use redaction or anonymization before prompt entry.
• Use only approved enterprise connectors and internal models for sensitive tasks.
• Log prompts and outputs in designated systems when policy or risk level requires it.

Hands‑on exercises should reinforce this: for example, a scenario where an employee accidentally considers pasting unredacted client data and must choose the correct alternative.

4. Measuring and Evaluating AI Outputs
Under the RMF’s Measure function, employees must learn how to evaluate AI behavior for reliability, safety, fairness, and security. They don’t need to become data scientists, but they do need to understand red flags and how to escalate them. For example:

• Outputs that appear discriminatory or systematically skewed.
• Hallucinated or fabricated factual claims.
• Results that violate policy, contain unsafe recommendations, or show adversarial manipulation.
• Signs of prompt injection, jailbreak behavior, or other genAI‑specific vulnerabilities.

The Generative AI Profile highlights the importance of security and adversarial evaluation for genAI systems. Training should include simple exercises — such as spotting a subtle prompt‑injection attempt or recognizing when a system has drifted into unsafe output territory.

5. Managing AI Risks and Responding to Incidents
The RMF’s Manage function emphasizes ongoing monitoring, incident handling, and mitigation. Employees should learn how to respond when something goes wrong: stopping system use, capturing evidence, reporting through established channels, and engaging AI governance staff. Training should introduce an “AI incident taxonomy” so employees know what qualifies — e.g., privacy exposure, harmful content generation, model malfunction, or security anomalies.

Scenario‑based drills should require learners to walk through the full path: identifying an issue, documenting it, escalating it, and outlining possible mitigations like adding a human‑review step or tightening model constraints.

6. Human Oversight and Decision‑Making
Human oversight is a central theme in the AI RMF and essential to IG culture. Training should make clear that AI outputs are recommendations, not authoritative or self‑executing decisions. Employees must know their oversight responsibilities: reviewing outputs for accuracy, applying professional judgment, and documenting rationale when accepting or rejecting system recommendations.

Managers need an additional coaching layer: how to review team AI use, check for policy compliance, and reinforce correct behavior. They should learn to ask questions like:

• “Was this AI‑assisted task performed within approved scope?”
• “Is there sufficient documentation of inputs, decisions, and outputs?”
• “Did a human apply meaningful review before finalizing the result?”

7. Documentation and Audit Readiness
The RMF and AIRC materials emphasize traceability: documenting inputs, versions, evaluations, and decisions throughout the lifecycle. Training should show employees how to maintain required records — such as prompt logs, data lineage notes, approval memos, and evaluation results — so AI use remains auditable and defensible.