AI policy in business: free downloadable template

AI policy in business: free downloadable template

An AI policy is the internal document that sets out what your teams may do with artificial intelligence: which tools are approved, which data may go into them, who checks what before anything goes out. You will find a complete template below, published in full, ready to copy and adapt. No form, no email required.

Most templates circulating online are three-page documents listing ethical principles and closing with a reminder about data protection. That is not what a 40-person company needs. It needs a short, concrete text that a salesperson understands in ten minutes, and that holds up legally the day an employee challenges a sanction. This article is part of our EU AI Act compliance guide for SMEs and nonprofits.

An AI policy governs usage, it does not replace GDPR or the AI Act

An AI policy is an internal organisational document: it turns legal obligations into everyday rules. On its own, it does not create compliance.

Three documents are often confused, and they serve different audiences:

A common shortcut is to assume that a charter signed by everyone covers the company. It covers nothing by itself. It does two things: it reduces operational risk, meaning data leaks and false content published in the company's name, and it builds a body of evidence if someone asks one day what you actually put in place. On how the two European texts divide up, see our comparison of the AI Act and GDPR.

No, an AI policy is not legally mandatory, but it is hard to avoid

No text requires you to write an AI policy. Article 4 of Regulation EU 2024/1689, however, has required a sufficient level of AI literacy among the people operating these systems on your behalf since 2 February 2025.

That literacy obligation is demonstrated through a combination: training completed, documentation available, written rules. The AI policy is the cheapest building block in that set, and often the first one requested. We cover the obligation itself in AI Act Article 4: is AI training mandatory?.

Two calendar points matter, because they change what your policy needs to say:

• The transparency obligations under Article 50 have applied since 2 August 2026. In practice, when a user interacts with an AI system or receives generated content, they must be able to know it.
• Regulation EU 2026/1744, known as the Digital Omnibus and adopted by the Council on 29 June 2026, pushed the obligations for Annex III high-risk systems back to 2 December 2027, and those in Annex I to 2 August 2028. The full sequence is in our AI Act timeline.

That postponement covers neither Article 4 nor Article 5. If you use AI in recruitment or staff evaluation, you gain time on heavy documentation, not on internal rules. See AI Act Article 6: high-risk AI systems to check whether you fall within scope.

The template fits in ten sections, not one more

An effective AI policy runs four to six pages and covers ten points. Beyond that, nobody reads it, and an unread document protects nothing.

Here is the structure we use with our SME and nonprofit clients:

1. Purpose and scope: who is covered, including employees, interns and contractors.
2. Short definitions: AI system, generative AI, confidential data.
3. Approved tools: the named list, with versions and account types.
4. Prohibited tools and the procedure for requesting an addition.
5. Data classification: what may go into a tool, and what may not.
6. Verification rules before any generated content is used externally.
7. Transparency: when and how to disclose that content was produced with AI.
8. Framed or prohibited use cases: recruitment, evaluation, individual decisions.
9. Incidents: what to do after a data leak or the publication of faulty content.
10. Governance: who decides, who reviews, how often.

Point 3 is where policies succeed or fail. A policy stating "generative AI tools approved by management" is useless. A policy stating "ChatGPT Team, company account only, and Claude through the company subscription" is enforceable the next morning.

AI policy template to copy and adapt

The text below is a baseline. Bracketed passages need completing. Budget two hours to adapt it, not two weeks.

Article 1. Purpose. This policy sets out the conditions for using artificial intelligence systems within [Company]. It applies to all employees, apprentices, interns and contractors acting on behalf of the company, on any device, whether company-issued or personal.

Article 2. Definitions. AI system: software producing content, predictions or recommendations from data. Generative AI: a system producing text, images, audio or code. Confidential data: any non-public information relating to clients, employees, pricing, contracts or ongoing projects.

Article 3. Approved tools. Only the following tools are approved: [named list, with version and account type]. Using free personal accounts for work purposes is prohibited, including for tasks involving no sensitive data.

Article 4. Requesting a new tool. Any request to use a tool not on the list is submitted to [AI lead] in writing, stating the intended use and the data involved. A decision follows within [10] working days. No use begins before approval.

Article 5. Data that must never be entered. The following must not be entered into an AI system: personal data of clients or employees, information covered by a confidentiality agreement, health data, credentials or passwords, non-anonymised contractual documents, proprietary code [adapt to your business].

Article 6. Verification before release. Any content produced with the help of an AI system and intended for external use is reviewed by a person competent on the subject before release. Figures, dates, quotations and legal references are checked against the source. The person releasing the content is accountable for it.

Article 7. Transparency. Where [Company] makes an AI system available in direct interaction with a person, that person is informed. Publicly released generated content discloses the use of AI where its nature could otherwise mislead.

Article 8. Prohibited uses. It is prohibited to use AI as the sole basis for a decision producing legal effects on a person, in particular in recruitment, evaluation, discipline or access to a service, as well as any use falling under the practices prohibited by Regulation EU 2024/1689.

Article 9. Incidents. Any accidental entry of confidential data, any release of faulty AI-generated content and any abnormal tool behaviour is reported to [AI lead] without delay. A good-faith report cannot lead to sanction.

Article 10. Training. Every employee using an AI system completes the internal training provided for that purpose. Attendance is recorded and the certificate retained.

Article 11. Governance and review. [AI lead] maintains the tool list and the AI systems register. This policy is reviewed at least once a year and whenever regulation changes materially.

Article 12. Sanctions. Failure to comply with these rules may lead to the sanctions set out in the internal rules of the company.

Sort your use cases into three levels, not ten

A three-colour grid is enough and will actually be used. Five-axis risk matrices end up in a drawer.

This grid goes on a wall. That is the only valid test: if your classification does not fit on one page, it will not be followed.

Without employee representative consultation, your policy is not enforceable

This is the point generic templates skip, and it decides the legal weight of the document.

An AI policy that provides for sanctions contains general and permanent requirements. Under French labour law, article R1321-1 of the Labour Code treats such service notes as additions to the company's internal rules, subject to the same formalities. In practice:

• Internal rules are mandatory from 50 employees upward (article L1311-2 of the Labour Code). Below that threshold they remain optional, but where they exist, additions follow the same regime.
• The works council must be consulted and issue an opinion. Late consultation, or none at all, strips the text of disciplinary effect.
• The document is sent to the labour inspectorate and filed with the registry of the competent labour court (article L1321-4).
• It takes effect one month after the filing and publicity formalities are completed.

There is an alternative: write a purely informative policy with no disciplinary section, and leave sanctions to the existing internal rules. That is faster and less protective. The choice depends on what you want to be able to do the day an employee pastes a client file into a consumer tool.

This point belongs to labour law rather than to the AI Act. Have your final version reviewed by your usual counsel before release, especially if you keep the sanctions section. Requirements differ outside France, so check the equivalent employee consultation rules in your jurisdiction.

Five mistakes make an AI policy useless

They show up in almost every document we review.

1. The catalogue of principles. "We use AI responsibly and ethically." That sentence helps nobody decide anything on a Tuesday afternoon.
2. The missing tool list. With no named list, everyone interprets. That is exactly what the policy was supposed to prevent.
3. The blanket ban. Prohibiting generative AI does not make it disappear, it moves to personal phones and free accounts. You lose visibility without gaining security.
4. The document signed once and forgotten. With no annual review and no named lead, the tool list is out of date within six months.
5. The policy without training. Article 4 is about AI literacy, not about the existence of a rulebook. A document emailed round proves nothing. A training session with an attendance sheet and a certificate does.

On that last point, the financial exposure is covered in our article on AI Act sanctions in 2026.

Keep the document alive, otherwise it proves nothing

Three things turn a policy into evidence: a named lead, an up-to-date register, and a record of distribution.

The AI lead does not need to be a lawyer. In a company of 30 to 80 people it is usually the IT manager, the administrative director, or whoever pushed the topic internally. The role fits in three lines: approve new tools, maintain the register, trigger the annual review.

The AI systems register records, for each tool: name, vendor, purpose, categories of data processed, estimated risk level and go-live date. A spreadsheet is enough. It will also serve you the day you need to check whether a tool has moved into high-risk territory.

For distribution, keep the trail: send date, acknowledgement of receipt, attendance sheet from the briefing session. Those are the items that matter in an inspection, not the literary quality of the document. To place your company within the scope of the regulation, our article on who the AI Act applies to sets out the criteria.

Frequently asked questions

Is an AI policy mandatory for an SME? No. No text requires one. Article 4 of Regulation EU 2024/1689 does require a sufficient level of AI literacy among users, and has done since 2 February 2025. A policy is the simplest way to give that requirement substance, alongside training.

AI policy or AI charter: what is the difference? None in substance. "Charter" suggests a statement of commitment, "policy" an organisational text. What matters is the content, and compliance with the formalities if the document provides for sanctions.

Should every employee sign the policy? Not required, but recommended. A dated acknowledgement of receipt proves distribution. It does not replace works council consultation or filing, which are what make the disciplinary section enforceable.

Can we ban generative AI outright? Legally yes, as an employer you set the rules for work tools. In practice a blanket ban pushes usage onto personal accounts and phones, outside any visibility. A narrow approved perimeter works better than a ban people work around.

What happens if an employee pastes client data into ChatGPT? You are facing a potential personal data breach under GDPR, requiring assessment and notification to the supervisory authority within 72 hours where the risk is established. That is precisely the scenario Article 5 of the template is meant to prevent, and Article 9 to surface quickly.

Do we need an AI policy separate from the IT acceptable use policy? Both approaches work. An AI annex to the existing IT policy avoids a further filing and a new consultation cycle. A standalone document is easier for teams to read. If your IT policy predates 2023, rewriting the whole thing is often simpler.

Does the Digital Omnibus postponement change my policy? Very little. Regulation EU 2026/1744 pushes Annex III high-risk obligations to 2 December 2027. Article 4 on AI literacy, Article 5 on prohibited practices and Article 50 on transparency are unaffected.

How GrowthPerf supports SMEs and nonprofits on this

We work on three fronts, and rarely on just one.

The first is inventory. Before writing anything, you need to know what is actually in use. In most of the organisations we audit, the gap between official tools and tools in use is wide, and that gap is where the risk sits.

The second is drafting, starting from the template above and adapting it to your sector, your size and your existing tools. We do not deliver a twenty-page document, we deliver the one your teams will follow.

The third is training, because that is what Article 4 targets. Our programmes qualify for OPCO funding under our Qualiopi certification. See our AI training for business and the operational AI track.

If you want to take stock before starting, book a free 30-minute audit. We go through your tools, your real usage and what is missing for you to be compliant. You leave with the template adapted to your context, whether you work with us afterwards or not.