The Sheriff of Notconsideringyouham: Draft Better Policies by Starting With the User

Sheriff of Nottingham: “Locksley! I’m gonna cut your heart out with a spoon.”

Robin Hood: “Then it begins.”

Later, Sheriff of Nottingham’s cousin, Guy of Gisbourne, asks a good follow-up question: “Why a spoon, cousin? Why not an axe? Or…”

Sheriff of Nottingham: “Because it’s DULL, you twit. It’ll hurt more.”

(Robin Hood: Prince of Thieves (1991))

There are a few surprising issues worth discussing: 1. Robin Hood: Prince of Thieves is nearly 35-years old; 2. Robin Hood: Prince of Thieves only has an IMDB rating of 6.9/10 (I wholeheartedly disagree); 3. The Sheriff of Nottingham, though a character derived from the 12^th century (or 20^th century Hollywood), seems to truly understand what it’s like for most employees to read corporate policies.

For lawyers who work within the corporate space, drafting policies to meet business, legal, or regulatory requirements can be fairly formulaic work. Generally, the process involves hours of research into the existing legal or regulatory landscape, reading and re-reading the laws and regulations to confirm your understanding (along with a few helpful legal blogs posted by Big Law), considering the drafter of the legislation’s intention, and, importantly, how the user (employee or client) will apply that concept in their role. Each of us then implements our own personalized writing practices (outlines, important headings, etc.). The drafting process is routine and proceeds without much thought. As you’re reading this, I will guess that most of you have some kind of AI-related policy sitting in Word waiting to be completed.

Once you’ve drafted the AI Policy, there’s more drafting that springs from that original policy, which is equally formulaic. In a proper Compliance Program, the Policy often leads to procedures (how employees/users will apply the law or regulation), training (how we introduce employees/users to the law or regulation and practical application of the concept), monitoring/testing processes (developing tests to determine compliance with the law or regulation) and reporting requirements (notifying Senior Management and Board Members about the law or regulation, how the organization is complying and when people didn’t comply). This is, in broad strokes, how corporations manage organizational risk.

But like the Guy of Gisbourne, when that AI Policy is drafted and the employee is required to read and understand it, they’re left wondering why you used the “dull spoon” approach and why you didn’t opt for a quicker death by way of the axe instead – “Because it’s DULL, you twit. It’ll hurt more.”

Considering who will use the Policy is the most important question drafters should consider, but it’s the one we most often forget. Instead, we follow our established processes and just write. The user-experience gets the spoon. It isn’t just that the spoon is “dull”, it is that reducing the dullness can lead to improved understanding fostering increased compliance, and increased compliance reduces operational risk. Reducing the dullness can also enhance employee productivity because they’re spending less time struggling through compliance requirements.

Often policy drafters do not take the time to consider their audience, the user. The policy is important because it is the seed from which the entire compliance framework on that topic springs.

It’s time to ‘pause’ the formulaic approach and start instead by thinking about the reader. Write down all the characteristics that make up that user. Are they in construction or finance? What does their day-to-day job look like? When they pick up their AI Policy to read it, where will they be and what will they be doing? How will they use the AI Policy? Start there. Put it at the top of the page, then start the standard formulaic process but tailor those processes to a person.

Once your AI Policy is drafted, it is important to collect analytics about the Policy itself. Who is reading it? How often is it referred to? Are people failing to meet their legal or regulatory obligations and why? It might just be the drafting that’s the culprit of non-compliance. If it is, consider whether the Policy requires a more thoughtful user-centric re-draft.

A thoughtful starting point considers the user first. This is how we can increase strategic drafting and enhance organizational compliance. Let’s re-write the script in Robin Hood: Prince of Thieves:

Sheriff (Policy Writer): “Employees! Yes, we lawyers have our writing processes, but this time I’m not gonna cut your heart out with a spoon. I’m gonna start-off by considering your needs.”

Robin Hood (Employees): “Bless you, Sheriff. My eyes had previously glazed over somewhere around ‘heretofore’….”

And that, my friends, is how the Sheriff and Robin Hood learned to live in harmony. From this point on, the Sheriff gave alms to the poor and Robin Hood was able to assist in significantly reducing organizational risk by stealing from the rich and saving damsels in distress only on an “as needed” basis but reported each such incident to his supervisor, as required.

(Robin Hood: Policy Writing 101 (2025), IMDB rating of 10/10)