Many companies already use AI without having decided to. Employees try free tools, paste documents into assistants and automate tasks without management knowing. A usage policy does not stifle these initiatives. It sets a clear framework, so everyone knows what they can do, with which data, and who validates the result.

This guide sets out the sections a policy should cover, and how to write it without holding teams back. Legal rules must always be validated with your counsel.

Why a policy before the first tool#

Without written rules, every team improvises. The risk is not only technical: client data pasted into an external tool can leave the company, and a recommendation generated by a model can be reused without checking. A policy turns this grey area into a shared practice.

It also has an internal effect: it shows teams that AI is a topic leadership follows, not a personal initiative.

Scope: which tools, which uses, which people#

The first section defines what the policy covers. It lists the authorised tools, the tools that are forbidden or not yet assessed, and the intended uses: drafting, document analysis, meeting summaries, coding assistance, reporting. It also specifies who is concerned, including employees, contractors and interns.

A scope that is too broad becomes unworkable. A scope that is too narrow leaves real uses outside the framework.

Data: what must never be entered#

This is the most useful section day to day. It distinguishes three categories:

  • data forbidden in external tools, for example identifiable personal data, trade secrets, information on ongoing transactions;
  • data allowed under conditions, for example anonymised internal documents or tools hosted by the company;
  • unrestricted data, such as public documents and training materials.

The list must stay short and understandable. An employee should be able to remember it in a minute.

Human oversight: who reviews what#

An AI output is not a decision. The policy specifies which results must be reviewed before use, by whom, and against which criterion. An internal meeting summary needs a quick review. A financial analysis intended for a committee needs the figures checked at the source.

This section also protects people: it prevents an employee from bearing alone the responsibility for a result they could not check.

Traceability: what is kept#

The policy states what must be kept to account for a decision: the tool used, the date, the input data at category level, and the person who validated. The retention period and confidentiality requirements are set with your lawyer and your data protection officer.

Responsibilities: who validates, who answers#

Three roles are often enough: a policy owner, a contact person in each department, and someone in charge of incidents. The policy names these roles, without detailing them beyond what is necessary.

It also sets out the procedure in case of an incident, such as sensitive data entered by mistake: who to alert, how quickly, and what actions to take.

Training and updates#

A policy gets updated. Tools change, uses evolve, and so do regulatory obligations. The policy provides for a regular review, for example once a year, and training before access to a new tool.

How to write it without holding teams back#

Write the policy with the people who already use AI, not only with leadership. Test it on three or four real cases from the company. A rule that covers no concrete case is a rule nobody follows.

Present it as a framework that lets people use AI with confidence. A text that only forbids things is read as an obstacle.

Common mistakes#

  • A policy written in-house without legal review.
  • A list of forbidden tools with no alternative offered.
  • A policy signed and then never put into practice.
  • No contact person: nobody knows who to ask.

Where to start#

The policy relies on an inventory: which uses already exist, which data circulates, which tools are in use. A quick diagnostic makes it possible to write a realistic first version rather than a generic text.

Further reading#