Company AI use policy: what it is for, what to put in it, and a template

What is an AI use policy for?

Your employees already use AI, often on personal accounts. A policy sets the rules for that use: everyone knows what's allowed, what isn't, and who to ask.

It protects your data (contracts, clients, payroll, live bids), makes clear who is responsible for a text written with AI, and shows what you've done to train your teams.

What should an AI use policy cover?

Eight sections cover the essentials:

• Purpose and scope: who it applies to (employees, interns, contractors) and which tools.
• Approved tools: a named list, on company accounts.
• Data: what can go into a tool, and what must never go in.
• Review: who checks, and what they check before anything goes out.
• Disclosure: when to tell a client or a colleague that a text came from AI.
• Prohibited uses: decisions about a person, misleading content, getting around access rights.
• Training: what everyone needs to know before using the tools.
• Contact, incidents and review: who to report an error to, and when the policy gets revisited.

AI policy template: tools and data

The rules below are examples to adapt to your tools and your business. Have your lawyer review the final text.

• 1. This policy applies to anyone using an artificial intelligence tool on behalf of [the company], on any device.
• 2. Only the tools listed in the appendix are approved, on an account provided by [the company]. Requests for a new tool go to [the AI lead].
• 3. Green: public information, text with no client-specific names or figures. It can go into any approved tool.
• 4. Amber: internal documents, procedures, templates. Only in approved tools connected to our documents, never in a personal tool.
• 5. Red: health data, payroll, bank details, passwords, source code, live bids, contracts that name clients. Never in an AI tool, unless [leadership] has approved a tool for that data.

AI policy template: review, report, learn

The rest of the template:

• 6. The author of a text remains responsible for its content, whether or not AI helped write it. Every figure, name, date or commitment is checked against a source document before sending.
• 7. No document produced with AI goes to a client without review by an authorized person.
• 8. A text delivered to a client states that it was prepared with AI when [the client requires it / the contract says so].
• 9. AI may not be used to make a decision about a person on its own (hiring, evaluation, discipline), or to reach documents the user has no right to see.
• 10. Every user completes [the internal training] before using the tools, and again whenever a tool changes.
• 11. Errors, leaks or doubts are reported to [the AI lead] right away, with no penalty for anyone reporting in good faith.
• 12. The policy is reviewed every [six months] and whenever a new tool is added.

How does it relate to the EU AI Act?

Since February 2, 2025, Article 4 of the EU AI Act requires companies that use AI systems to take measures so their staff know how to use them, which the Act calls AI literacy. The article was revised in summer 2026 and the obligation stayed.

A policy, a short training session and a list of who completed it are the simplest way to show what you have done. The other AI Act obligations have their own page.

How do you make it binding on employees?

In France, for a rule in the policy to support disciplinary action, the policy is usually attached to the company's internal regulations (règlement intérieur). It then follows the same procedure: the works council (CSE) gives its opinion, and the labor inspectorate receives a copy (French Labor Code, articles L1321-4 and L1321-5).

It can also extend an IT acceptable use policy you already have. Either way, have an employment lawyer sign off on the final version, especially outside France.

Why do so many policies stay on paper?

Because they prohibit without providing anything. "No client data in public tools" won't hold if the only tool available is public. "Check your sources" means nothing if the tool gives none.

And because they cover a licensed minority. When licenses are priced per user, people without one stay on personal accounts, outside the policy.

How do agents that cite their sources make the policy workable?

With Saména, our engineers build agents connected to your documents in SharePoint, OneDrive or Dropbox. Every answer cites the documents it comes from, so "check before you send" becomes one click on the source.

A sentence stating a figure or a proper name that none of the documents the agent read contains is removed before it's shown. This check compares figures and names, it doesn't judge meaning: human review stays, and nothing goes out until someone at your company approves it.

Internal documents stay inside an approved tool: what Saména keeps from them is encrypted with a key unique to your company, with no copy of your files. The subscription covers the whole company with unlimited users, so nobody needs a personal account to get work done.

Frequently asked

Is an AI use policy mandatory?

No law requires a document by that name. The EU AI Act does require measures to build your teams' AI literacy, and a policy paired with a short training is the simplest way to meet it.

Do we need to consult employee representatives?

In France, if the policy is attached to the internal regulations or sets general, permanent rules, yes: it follows the same procedure, including the CSE's opinion. Your lawyer will tell you what applies to your company.

Should the policy ban ChatGPT?

Banning personal accounts for internal data, yes. Banning all AI without offering a tool just pushes usage onto phones, where you cannot see it.

Who should write the policy?

Leadership, with HR or legal, and one or two people who use AI every day. They know which rules will hold up in real work.

A separate AI policy or part of the IT policy?

Both work. An AI chapter in your existing IT policy saves a document, as long as someone keeps the approved tool list current.