AI usage policy template for companies
In most companies, generative AI is already used every day — with no written framework, no list of approved tools, and nobody sure what’s allowed. The risk isn’t that teams use it. It’s that they use it while guessing the rules.
Here is a complete policy in ten articles. It reads in ten minutes and adapts by filling in the bracketed fields. It is deliberately permissive: a policy that bans everything gets worked around in the first week, and whatever happens after that is no longer visible.
How to use it
- Copy the ten articles below and fill in the bracketed fields — there are only a few, and each marks a point where your organisation has to make a call.
- Draw up the list of approved tools in Article 3. This is the only real work: it means checking what each vendor does with the data you enter, and that check is worth more than the policy itself.
- Have the final version reviewed by your legal counsel, and present it to employee representatives if your organisation has them.
- Roll it out with a training session, not by email alone. A policy skimmed in an inbox changes no behaviour — the session is what makes the rule stick.
Generative AI usage policy
Template — [COMPANY NAME], version of [DATE]. Adapt before distribution.
Article 1 — Purpose and scope
This policy sets out the conditions for using generative artificial intelligence tools at [COMPANY NAME]. It applies to all staff, including interns, apprentices, temporary workers and contractors acting on the company’s behalf.
It covers any tool that produces text, code, images, audio or video from a prompt — whether accessed through a browser, built into business software or called through an API.
Article 2 — General principle
The use of generative AI is encouraged for work purposes. It is a work tool, just like a spreadsheet or a search engine.
Employees remain responsible for any content they produce, share or use, whether they wrote it themselves or obtained it from an AI tool. Using AI never reduces that responsibility, and cannot be invoked to excuse an error.
Article 3 — Approved tools
Only the tools on the list below are approved for work use. The list is maintained by [TEAM / PERSON RESPONSIBLE] and reviewed [FREQUENCY].
Using a tool not on this list requires prior approval from [PERSON RESPONSIBLE]. This rule is not a formality: each tool has its own terms for how the data entered into it is used, and that is precisely what gets checked.
- [TOOL 1] — approved uses: [USES]
- [TOOL 2] — approved uses: [USES]
- [TOOL 3] — approved uses: [USES]
Article 4 — Data that must never be entered
The following categories of information must not be entered into any generative AI tool that has not been approved by the company:
- Identifying personal data: names, contact details, social security or national ID numbers, bank details, HR or health records.
- Data covered by a non-disclosure agreement, a confidentiality clause or professional privilege.
- Non-public contractual documents: contracts, priced commercial proposals, negotiated terms.
- Trade secrets: proprietary source code, processes, formulas, strategic plans, unpublished financial data.
- Credentials, passwords, API keys and any other technical secret.
Article 5 — Human review
No AI-generated content may be shared outside the company, sent to a client, published, or used as the basis for a decision without being reviewed and approved by an employee competent in the subject.
Review covers three points, in this order: the accuracy of facts and figures, the actual existence of any sources cited, and consistency with the company’s tone and commitments. Models produce plausible references that do not exist: an unverified source is a missing source.
Article 6 — Uses requiring heightened care
Some uses commit the company beyond the content itself. They require prior approval from [PERSON RESPONSIBLE]:
- Any decision affecting a person — hiring, appraisal, promotion, disciplinary action, candidate screening.
- Any legal, accounting or regulatory output intended for a third party or an authority.
- Any content published in the company’s name.
- Any generated image or voice depicting an identifiable person.
- Any use involving the processing of customers’ or employees’ personal data.
Article 7 — Transparency
Use of generative AI does not need to be disclosed for routine assistance: rewording, proofreading, translation, summarising an internal document, help with research.
It must be disclosed when the result is presented as personal work that reflects a professional skill — in particular a client deliverable, a signed editorial piece, or work on which the individual is being assessed.
Article 8 — Intellectual property
Employees must ensure that the content produced does not reproduce a protected work. AI output can reproduce fragments of existing content without flagging it.
The legal status of AI-generated content remains uncertain in several jurisdictions. Accordingly, no content that is predominantly AI-generated may be registered, claimed as an original creation of the company, or included in a deliverable whose contract guarantees originality, without approval from [PERSON RESPONSIBLE].
Article 9 — Data protection and regulatory framework
Any processing of personal data by an AI tool falls under the GDPR: it requires a lawful basis, information provided to the people concerned, and an entry in the record of processing activities kept by [DPO / PERSON RESPONSIBLE].
The EU Artificial Intelligence Act also places obligations on professional users of these systems — notably a sufficient level of AI literacy among the people who use them, and particular care with uses affecting employment and access to services. [COMPANY] meets this through the training set out in Article 10.
This document is a template to adapt to your organisation. It does not constitute legal advice: the final version should be reviewed by your legal counsel and, where applicable, presented to employee representatives.
Article 10 — Training, support and enforcement
[COMPANY] provides its employees with training in the professional use of generative AI, covering what the tools can and cannot do, how to write effective prompts, and the rules of this policy.
Questions about this policy should be addressed to [PERSON / TEAM]. Use that clearly breaches its provisions — in particular disclosure of the information listed in Article 4 — may lead to the measures set out in the company’s internal rules.
This policy takes effect on [DATE] and will be reviewed at least once a year, since the tools evolve faster than the rules that govern them.
What this policy doesn’t do
It doesn’t replace a data protection impact assessment where a processing activity calls for one, nor checking each vendor’s contractual terms — that’s where confidentiality is really decided, not in the text of the policy.
It isn’t legal advice. The final version should be reviewed by your legal counsel, and whether it is enforceable depends on how it is communicated and incorporated into your internal rules or employee handbook.