Guide and template to copy

AI usage policy: a template ready to adapt, and the method to make it stick

An AI usage policy is the document that tells your teams which AI tools to use, for which tasks, with which data and under what human oversight. A good company AI usage policy fits on one page, sorts uses into allowed, conditional or prohibited, and names who approves. Our template is ready to adapt.

Book 20 minutes with us See the template

02The content

What an AI usage policy should contain

A useful AI usage policy answers three questions for each task: which tool, which data, who approves. Our template breaks them down into eight sections.

Uses, in three colors

Allowed, conditional, prohibited. Decide task by task (summarizing meeting notes, writing a proposal), not tool by tool. Example applied to a Claude deployment in a company.

Data, in four levels

Public, internal, confidential, personal. Each level says which tool it can go into. For the legal framework, see AI and GDPR.

A name on every line

Who approves a new tool, who answers questions, who updates the policy. A rule with no owner is followed by no one.

03The template

AI usage policy template to copy

Replace the fields in brackets and remove whatever doesn't apply to you. Keep it to one page: that's what it takes for it to be read.

AI usage policy of [Company name]

Version [1.0] of [date] · Owner: [name, role] · Next review: [date]

1. Purpose and scope

  • This policy sets the rules for using generative AI tools for the employees, interns and contractors of [Company name].
  • It complements the IT policy and the data protection policy.

2. Approved tools

  • Approved tools: [Claude Team, ChatGPT Business, Microsoft 365 Copilot], with a work account only.
  • Any other tool, extension or connector requires approval from [IT department or CISO] before use.

3. Uses

  • Allowed: rephrasing, summarizing, translating, preparing a first draft from public or internal data.
  • Conditional: [writing a client proposal, analyzing a contract], with approval from [manager].
  • Prohibited: letting AI decide alone on a hire, a disciplinary sanction or a customer refusal.

4. Data

  • Public and internal: allowed in approved tools.
  • Confidential (contracts, unpublished figures, source code): only in [tool], never on a personal account.
  • Personal (customers, employees, candidates): prohibited, unless the use is approved by [the DPO].

5. Human oversight and accountability

  • All AI output is reviewed before being sent, published or integrated.
  • The person who uses the result remains responsible for it.

6. Intellectual property and transparency

  • Do not submit protected content the company does not hold the rights to.
  • Disclose the use of AI when the recipient expects human work.

7. Security

  • Work accounts with strong authentication, no shared credentials.
  • Connectors to email, files or code: enabled by [IT department] only.

8. Training, reporting and updates

  • Every user completes [the internal training] before getting an account.
  • Mistake, leak or doubt: notify [contact] the same day; a good-faith report is never sanctioned.
  • Policy reviewed every six months by [owner], with feedback from the teams.

04The method

Making the AI usage policy stick: 5 steps

An AI usage policy gets followed when it starts from real uses and makes work easier instead of blocking it.

  1. Start from real uses

    Ask teams which tools they already use, including on personal accounts. That's where shadow AI hides.

  2. Decide by task

    For each frequent task, choose the color and the tool, with IT, the CISO and the DPO.

  3. Provide the tools

    Open work accounts and shared workspaces. A rule with no approved tool pushes people toward personal accounts.

  4. Train

    Present the policy on real cases from each job: this is the moment to train your teams on AI, not to get a document signed.

  5. Review every six months

    Tools change fast. Put a review date and a name at the top of the policy.

Need an outside perspective? We can write the policy with your teams.

Book 20 minutes

05The pitfalls

Common mistakes in an AI usage policy

Most AI usage policies fail for one of these four reasons.

  • Too long: beyond two pages, nobody rereads it.
  • Banning everything: the uses carry on, but on personal accounts.
  • No owner: questions go unanswered.
  • No review date: the policy describes tools that no longer exist.

Written by Rémi Carbonnefounder and CTO of Kailli

Frequently asked questions about AI usage policies

What is an AI usage policy?

An AI usage policy is an internal document that sets the rules for using artificial intelligence in the company: approved tools, permitted uses, allowed data and human oversight. It applies to everyone who uses AI on the company's behalf.

Is it mandatory to have an AI usage policy?

No law requires an AI usage policy as such. The AI Act does, however, require building teams' AI literacy, and the GDPR requires protecting personal data: a policy is the simplest way to address both.

What is the difference between an AI usage policy and an IT policy?

The IT policy covers hardware, accounts and the network. The AI usage policy covers what you hand to an AI tool: tasks, data, review. It can become an appendix to the IT policy.

Who should write the AI usage policy in the company?

Leadership owns it, with IT, the CISO, the DPO and representatives of the teams that use AI. Without the users, the policy describes uses that don't exist.

Do you need to consult the CSE?

Often yes: if the policy is appended to the internal rules (règlement intérieur) or provides for sanctions, it generally follows their procedure, including consultation of the CSE (employee representative body). Have your lawyer confirm this point.

How often should you update an AI usage policy?

Every six months, and with every new tool or sensitive use. Write the date of the next review at the top of the document.

Twenty minutes. And you'll know whether we can help.

No sales pitch. You tell us where you stand with AI, we tell you how far you can go.

Book 20 minutes Prepare for the call