AI Policy Template for Companies: What Employees Can Do

What is a company AI policy template?

A company AI policy template is a fill-in-the-blanks document that tells employees which AI tools they may use, what data they may put into them, what they must never do with them, and who decides when the answer is unclear. A good one fits on four to six pages, uses plain language, and names an owner. The template below is complete and ready to copy. Replace the bracketed items, have Legal and Security review it, and publish it.

TL;DR

• One policy, five jobs. It must say which tools are approved, which data is allowed, which uses are banned, who is accountable, and what to do when something goes wrong.
• Classify data, not tools. Employees can follow a three-tier data rule (green, yellow, red) far more easily than a list of tool-by-tool exceptions.
• A person stays accountable for every output. AI can draft, summarize and analyze, but the employee who sends or acts on the result owns it.
• A policy without an approval path gets ignored. People use unapproved tools when the request process is slow or unclear, so publish a fast route to yes.
• AI can draft your policy, but not decide it. Use the prompt below to get a first version, then have Legal, Security and HR make the judgment calls.
• Review it every six months. Tools, laws and vendor terms change faster than annual policy cycles.

What should an AI policy cover?

Most weak AI policies fail in one of two ways. They are a single paragraph saying "use AI responsibly," which tells nobody anything. Or they are a 40-page legal document nobody reads. Aim for the middle: specific rules, short sentences, and clear examples.

Every policy needs these sections:

1. Purpose and scope. Who it applies to (employees, contractors, interns) and what counts as AI.
2. Definitions. Plain meanings for "generative AI," "approved tool," "confidential data."
3. Roles and ownership. Who owns the policy, who approves tools, who handles incidents.
4. Approved tools and the approval process.
5. Data rules. What can go into which tool.
6. Permitted uses.
7. Prohibited uses.
8. Human review and accountability.
9. Disclosure. When you must tell customers, colleagues or regulators that AI was involved.
10. Intellectual property and confidentiality.
11. Employee-built AI tools and agents.
12. Vendors and third parties.
13. Incident reporting.
14. Training.
15. Enforcement and review.

What does an AI governance framework look like?

People searching "AI governance framework" usually want the bigger structure the policy sits inside. The policy is the rulebook employees read. Governance is the machinery that keeps it true: who decides, who checks, and how often.

A workable framework has four parts:

If you want to align with a published structure, three are widely referenced. The NIST AI Risk Management Framework organizes the work into four functions: govern, map, measure and manage. ISO/IEC 42001 is a standard for running an AI management system, which auditors and customers may ask about. The EU AI Act sorts AI uses into risk levels and applies stricter duties to higher-risk ones, which matters if you operate in or sell into the EU. You do not need to adopt all three. Pick the one your customers or regulators already ask about and map your policy sections to it.

The template: copy this

Replace everything in [brackets]. Delete sections that do not apply. Keep the sentences short.

---

[Company Name] Acceptable Use of AI Policy

Owner: [Role, e.g., General Counsel or Chief Information Security Officer] Approved by: [Executive sponsor] Effective date: [Date] Next review: [Date, six months out]

1. Purpose This policy explains how employees may use artificial intelligence (AI) tools at [Company Name]. It exists to help us use AI productively while protecting our customers, our people, our data and our legal obligations.

2. Who this applies to All employees, contractors, interns and temporary staff, on any device, whenever they use AI for company work.

3. What we mean by AI Software that generates text, images, code, audio, video or decisions from a prompt or data, including chatbots, writing assistants, meeting note-takers, coding assistants, image generators, AI features inside other software, and AI agents that take actions on your behalf.

4. Approved tools

• You may use the tools on the approved list at [link to list].
• You may not use a personal account, free-tier tool or browser extension for company work unless it is on the list.
• To request a new tool, submit a request at [link]. We aim to respond within [number] business days.
• Approval considers: where data is stored, whether the vendor trains its models on our data, security certifications, contract terms, and cost.

5. Data rules

If you are unsure which tier applies, treat it as the higher one and ask [contact].

6. Permitted uses With approved tools and the right data tier, you may use AI to:

• Draft, edit and summarize documents and emails
• Brainstorm ideas, outlines and options
• Analyze data you are authorized to access
• Write and review code, following [engineering standards]
• Translate and transcribe, with consent where recording is involved
• Prepare research, which you must verify

7. Prohibited uses You may not:

• Enter Red data into any unapproved tool
• Use AI to make or finalize decisions about hiring, firing, promotion, pay, credit, insurance, or discipline without human review and sign-off from [HR/Legal]
• Present AI output as verified fact without checking it
• Use AI to create deceptive content, impersonate a person, or produce deepfakes of colleagues, customers or public figures
• Record or transcribe meetings with AI note-takers without telling participants and following [recording policy]
• Bypass security controls, or connect an AI tool to company systems without approval
• Use AI in ways that violate law, contract terms or our Code of Conduct

8. Human review and accountability AI output can be wrong, biased, outdated or invented. You are responsible for anything you send, publish, submit or act on, whether or not AI helped write it. Check facts, figures, quotes, citations, legal references and code before use.

9. Disclosure

• Tell customers when they are interacting with an AI system rather than a person.
• Follow [department-specific rules] for regulated communications, filings and client deliverables.
• Where a contract or regulation requires disclosure of AI use, disclose it.
• Internally, say so when AI materially produced work you share, if a colleague would reasonably want to know.

10. Intellectual property and confidentiality Do not paste third-party copyrighted material, licensed content or confidential partner information into AI tools unless the license or contract allows it. Treat AI-generated content as needing review for originality and for resemblance to existing work before external use. [Legal to add company position on ownership of AI-generated work.]

11. Building AI tools and agents Employees who build AI-powered workflows, apps or agents must register them at [link] before they handle company data or other people's work. Each one needs a named owner, a description of what data it touches, an access list, and a review by [Security/IT] before wider use. Anything that takes actions (sends email, edits records, spends money) requires human approval for those actions unless [Role] has approved otherwise.

12. Vendors and third parties Vendors that use AI on our data or deliver AI-generated work must disclose this and meet [Company Name] security and privacy requirements. Procurement will include AI terms in contracts, including data use, retention and breach notification.

13. Reporting problems Report suspected misuse, data exposure, harmful or biased output, or a tool behaving unexpectedly to [email/channel] immediately. Reporting in good faith will not be penalized. If you pasted restricted data into the wrong tool, report it right away. A fast report limits the damage.

14. Training All covered personnel must complete AI-use training within [30] days of joining and [annually] after.

15. Enforcement and review Violations may lead to disciplinary action, up to and including termination, and may carry legal consequences. This policy will be reviewed at least every six months and when laws, tools or business needs change.

---

How do you fill in the template? (A worked example)

Here is how a fictional company, a 3,000-person regional insurance firm, would adapt the highest-impact sections. The details are illustrative, not recommendations for your business.

Approved tools (Section 4). The firm approves one enterprise chat assistant under a business contract, the AI features built into its existing office suite, and a coding assistant for engineering only. Everything else goes through the request form.

Data tiers (Section 5). The firm fills the table like this:

Prohibited uses (Section 7). The firm adds: "AI may not decide whether a claim is approved or denied. It may summarize a claim file for an adjuster, who makes the decision." This reflects real regulatory and fairness risk in insurance. A retailer would write something different.

Disclosure (Section 9). Because the firm runs a customer chatbot, it adds: "The chatbot must state that it is automated and offer a route to a human at any point."

Employee-built tools (Section 11). The firm's claims team has built a spreadsheet macro that calls an AI model. Under the new policy, the team registers it, the owner lists the data it reads, and Security reviews it before it spreads to other teams.

Notice the pattern. The structure stays the same, while the examples, the red-tier list and the prohibited decisions come from the firm's industry and risk. Those are the parts to spend time on.

How can AI help you write your AI policy?

AI is good at producing a structured first draft and tailoring language to your industry. Paste this prompt into your approved AI tool. Use a tool and data tier suitable for internal drafts, and do not paste confidential documents into it.

You are helping a [Legal / Compliance / IT / HR] professional draft a company policy on employee use of AI.

Company context:
- Industry: [industry]
- Size and locations: [e.g., 3,000 employees, US and Germany]
- Regulated activities: [e.g., handles health data, financial advice, none]
- AI tools currently in use or approved: [list]
- Main concerns: [e.g., customer data leaks, biased hiring decisions, copyright, meeting recordings]
- Audience reading level: general employees, not lawyers

Task: Adapt the policy template below to this company. For each section:
1. Rewrite it in plain language, with short sentences.
2. Add 2 to 4 examples specific to our industry in the data rules and prohibited uses sections.
3. Flag any section where you are making an assumption, and list the questions Legal must answer.
4. List which laws, regulations or contract obligations might apply to us, as questions for counsel to confirm. Do not state them as settled fact.

Do not invent company facts. Where information is missing, leave a [bracketed placeholder].

Template:
[paste the template above]

What to check in the answer

• Every legal reference. AI sometimes cites laws, article numbers or requirements that are wrong, outdated or from the wrong jurisdiction. Have counsel confirm each one.
• Whether examples match your real data. A generic "customer information" example is weak. Check that the red tier names the actual records your company holds.
• Contradictions. Make sure the data table, prohibited uses and approved tools sections do not conflict.
• Invented process. The draft may mention committees, SLAs or tools you do not have. Delete or build them.
• Tone. If it reads like a contract, ask for a shorter, plainer rewrite.

Where not to trust AI

Do not let AI decide your risk appetite, your red-tier list, which employment decisions are off limits, or your disclosure duties to regulators. Those depend on your contracts, your jurisdictions and your leadership's judgment. AI can draft the sentences. People have to own the choices.

How do you roll the policy out so people follow it?

A published policy is not the same as a followed one. These steps matter more than any clause.

1. Get the sponsor named. An executive puts their name on it. Without one, it reads as optional.
2. Interview three or four teams before finalizing. Ask what they already use. You will find unapproved tools, and you want to know before you ban them.
3. Publish the approved list and the request form the same day as the policy. A "no" with no route to "yes" pushes people to personal accounts.
4. Promise a response time on requests, then meet it. Slow approvals are the main reason shadow AI exists.
5. Give examples in training. Show five real scenarios, such as "Can I paste this customer email into the chatbot?" and walk through the tiers.
6. Make reporting safe. If people fear punishment for admitting a mistake, you will learn about leaks from customers instead.
7. Schedule the review. Put the six-month date on the calendar and assign it to someone.

What are common mistakes in AI policies?

• Banning everything. Blanket bans do not stop use. They hide it.
• Listing tools instead of rules. Tool names change every few months. Data rules last.
• Ignoring AI features inside existing software. Your CRM, office suite and video platform may now have AI switched on. The scope section should cover them.
• Forgetting agents. Tools that act (send emails, update records) carry different risk than tools that draft text. Give them their own rule.
• Skipping contractors. They often handle the most sensitive work, so name them in scope.
• No owner. If everyone owns it, nobody updates it.

How can you track AI requests and approved tools without another subscription?

Once the policy exists, you need somewhere to keep the approved tool list, take intake requests, record who approved what, and register employee-built tools. Many teams start in a shared spreadsheet and outgrow it. With Remy, you can describe that system in plain English, for example an intake form with a status workflow, an approved-tools register, and role-based access so only Security can approve, and Remy builds and deploys it as a full-stack app. It includes sign-in, SSO for organizations, and an audit log, and you own the code. Platform pricing is flat, with AI usage billed at cost, so check the pricing page before committing.

Frequently Asked Questions

5 questions

01Who should own the company AI policy?

Usually Legal, Compliance or Security owns it, with a named executive sponsor. HR, IT, Privacy and a business representative should review it. Ownership matters more than which department holds it. Someone must be responsible for updates and for answering questions.

02Should we ban ChatGPT or other public AI tools?

A blanket ban often pushes use onto personal devices, where you cannot see or protect anything. A more effective approach is to approve specific tools under business terms, set clear data rules, and block only what you cannot make safe. Whatever you choose, check each vendor's current terms on data use and retention, because they change.

03How long should an AI policy be?

Four to six pages for the main policy is a practical target. Put the detailed lists, such as approved tools and department-specific rules, in linked appendices so they can be updated without rewriting the policy. Employees should be able to read the core rules in about ten minutes.

04Do small companies need an AI policy?

Yes, though a shorter one works. Even a one-page version covering approved tools, the data tiers and a named contact prevents the most common problems. Customer contracts and security questionnaires increasingly ask whether you have one.

05How often should we update it?

Review at least every six months, and sooner when a major tool, vendor term or law changes. Keep the approved tools list in a separate document so it can change weekly without reopening the whole policy.