IT is usually not the one doing the enforcement. They typically only do the monitoring and may report some activity above thresholds.

Legal is usually the one initiating then engaging with HR to do enforcement.