AI Usage Policy for Companies: Template and Rules

AI usage policy for companies: template and rules

In short

An AI usage policy is a short document that sets the rules for using artificial intelligence in a company: approved tools, prohibited data, checking results and accountability. This page offers an 8-rule template to adapt. A policy does not replace training: it completes it.

Updated on 1 October 2026

The rules in this policy are covered in module 5 of my AI training for companies.

Why a company needs an AI usage policy

Employees already use AI, often with no framework. According to the 2024 Work Trend Index from Microsoft and LinkedIn, based on 31,000 people in 31 countries, 78% of AI users bring their own tools to work, and 80% in small and medium-sized companies. In the same survey, 52% are reluctant to admit using AI for their most important tasks, and only 39% have received training from their company.

Without a written rule, each person decides alone what to paste into an assistant. A policy makes the use visible and makes it safe.

AI usage policy template in 8 rules

Key takeaways

Artificial intelligence usage policy — [Company name] 1. Approved tools. Only the following tools are approved for professional use: [list]. Any other tool must be approved by [owner]. 2. Accounts. AI is used with the account provided by the company, never with a personal account. 3. Prohibited data. Never enter: personal data of customers, employees or candidates; health data; passwords; contracts and confidential documents; non-public financial information. 4. Anonymisation. Before submitting a document, remove names, contact details and anything that identifies a person or a customer. 5. Verification. Every AI output is reviewed by a person before it is used. Figures, quotes and legal references are checked against the source. 6. Accountability. The person who uses an output remains responsible for it, as if they had written it themselves. 7. Decisions. AI makes no decision about a person (hiring, evaluation, sanction, credit). AI prepares and a person decides. 8. Transparency and training. Every employee is trained before using AI and reports any significant error or questionable use to [owner]. The policy is reviewed every [6] months.

How to adapt this template

List the real uses. Ask teams what they already do with AI. The policy starts from practice.
Choose the tools. One shared tool with a company account is better than ten personal accounts.
Specify the sensitive data in your field. A clinic, an accounting firm and an agency do not have the same.
Keep it short. One page that gets read beats ten pages that get ignored.
Present it during training. A rule people understand is a rule people apply.

The four decisions leaders need to make first are explained in AI training for executives and managers.

AI policy, GDPR and the EU AI Act

A policy helps you comply with two laws. The GDPR governs any use of personal data, including inside an AI assistant. Article 4 of the EU AI Act asks companies to take measures to develop their staff's AI literacy: a policy combined with training is a concrete, documentable measure. The guide Is AI training mandatory? explains this obligation.

This template is a starting point to adapt. It is not legal advice. Depending on your organisation, putting it in place may require consulting employee representatives and a legal review.

Book a free 30-minute assessment

Frequently asked questions

Is an AI usage policy mandatory?

No law requires a document with that name. It is a simple way to set the rules and show that the company governs its use of AI.

Who should write it?

Leadership, with the heads of the teams concerned and the person in charge of data protection, if the company has one.

How long should it be?

One to two pages. The rules should be readable in two minutes.