How to write an AI usage policy for your company (free template)
An AI usage policy tells staff which AI tools they may use, what data they may put into them, when outputs must be reviewed or disclosed, and who to ask. A good policy is short, practical and specific to your business. It covers purpose and scope, approved tools, data classification, acceptable and prohibited uses, human review, disclosure, intellectual property, security, training, roles and a review cycle. Use the template below as a starting point and adapt it with your legal and security advisers.
Why does every company need an AI usage policy?
Staff are already using AI, often through personal accounts, whether or not the company has approved it. Without a policy, people either avoid useful tools out of caution or use them in ways that leak confidential data, breach client contracts or publish unchecked errors. A clear policy gives people permission and guardrails at the same time. In the EU, the AI Act’s AI literacy duty also expects organisations to support staff in understanding the AI they use; see our EU AI Act guide.
What makes a good AI policy?
- Short: Two or three pages people can read in ten minutes, with detail in appendices.
- Specific: Names real tools, real data types and real examples from your work.
- Enabling: Says what people can do, not only what they cannot.
- Owned: Names a person or team who answers questions and approves tools.
- Current: Reviewed regularly as tools and rules change.
What should the template include?
- 1. Purpose and scope: Why the policy exists, who it covers (staff, contractors) and which tools count as AI.
- 2. Approved tools: A list of tools, the plan or account type and what each may be used for.
- 3. Data rules: Which data classes may go into which tools: public, internal, confidential, personal, client.
- 4. Acceptable uses: Examples such as drafting, summarising, coding with review, research.
- 5. Prohibited uses: For example decisions about people without review, entering client secrets into unapproved tools, impersonation.
- 6. Human review: What must be checked before use: external content, code, advice, numbers.
- 7. Disclosure: When to tell clients, customers or readers that AI was used.
- 8. Intellectual property: Ownership of outputs, using third-party content and client contract terms.
- 9. Security: Accounts, access, connectors and reporting incidents.
- 10. Training and support: Required training and where to get help.
- 11. Roles: Policy owner, tool approvers and escalation contacts.
- 12. Review: How often the policy is updated and how changes are announced.
How do you set data rules?
Data rules are the heart of the policy. Link them to your existing data classification, then state which tools may handle each class. Business and enterprise AI plans usually offer contractual commitments not to train on your data, while free consumer accounts may not. Spell out common cases: client documents, personal data, source code, financial results and passwords or keys.
| Data type | Example | Allowed in |
|---|---|---|
| Public | Published blog posts, marketing pages | Any approved tool |
| Internal | Meeting notes, internal plans | Approved business-plan tools |
| Confidential | Client contracts, unreleased financials | Approved tools rated for confidential data only |
| Personal data | Customer records, HR files | Only where a lawful basis and data agreement exist |
| Secrets | Passwords, API keys | Never |
When must people review AI output?
Our guide to human-in-the-loop AI shows how to set review points that are meaningful.
What should the policy say about disclosure?
Disclosure rules depend on your market and contracts. In the EU, chatbots must tell people they are AI and realistic deepfakes must be labelled under Article 50 of the AI Act. Some clients require you to disclose AI use in deliverables. Advertising regulators expect AI-generated content not to mislead. Our guide to AI disclosure rules for marketers covers the detail.
How does the policy deal with unapproved tools?
Banning everything rarely works; people find workarounds. A better approach is to approve good tools quickly, offer a simple request process for new ones and explain the risks of personal accounts. Our article on shadow AI explains how to find and manage unapproved use.
How do you roll out the policy?
- Draft with input from legal, security, HR and the teams that use AI most
- Test it on real scenarios before publishing
- Announce it with examples and a short training session
- Put the tool list and FAQ where people work
- Track questions and update the policy every quarter
Pair the policy with a training plan; see our 30-day AI literacy plan.
What does this look like in practice?
A 60-person design and marketing agency in Dubai writes a two-page AI policy. It approves four tools on business plans, bans client confidential data in any other tool and requires a second person to review anything sent to clients. Client contracts are checked for AI clauses, and deliverables note AI use where clients ask. A named AI lead approves new tools within a week. After launch, use of personal AI accounts falls and staff ask fewer “is this allowed?” questions.
How UIUX Studio helps
We help companies set up AI tools, policies and workflows that teams adopt. Talk to our Technology Advisory or Agentic AI & Automation teams. This template is general guidance, not legal advice.
Frequently asked questions
What is an AI usage policy?
A document that sets rules for how staff use AI tools at work.
How long should it be?
Two or three pages, with detail in appendices.
Should we ban ChatGPT?
Usually better to approve business plans with clear data rules.
Who should own the policy?
A named person or team, often with legal and security input.
How often should we update it?
At least every quarter while tools change quickly.