GUIDE · AI GOVERNANCE
Company AI policy: one page of clear rules, written with the people who apply it.
An AI acceptable use policy says which tools to use, with which data, and who approves what. Short, concrete, written with the IT department and business teams, it can be reread in two minutes.
A 30-minute conversation with the team that will run your project, with no commitment.
- Eight sections, on one page
- Written with your IT department and business teams
- For
- Leadership, IT, DPO, business teams
- Format
- One page
- Updated
- October 15, 2026
THEY TRUST US
- Celio
- Plein Sens
- Shiseido
- Green-Got
- Promologis
- Bridgestone
IN BRIEF
What is an AI policy for?
An AI policy, or AI acceptable use policy, sets the shared rules for using AI in the company: approved tools, prohibited data, human review, responsibilities. It answers shadow AI with a framework rather than a ban.
No law requires an “AI policy” as such. But since February 2, 2025, the AI Act has required companies that use AI to ensure a sufficient level of AI literacy among their staff (Article 4), and the GDPR applies to any personal data processed by an AI tool. A policy is the simplest way to show this.
A good policy fits on one page, relies on tools actually made available, and comes with hands-on training. If it is not appended to the company’s work rules, it remains a good-practice guide: check with your legal department.
THE EIGHT SECTIONS
Purpose · Approved tools · Data · Review · Transparency · Security · Responsibilities · Updates.
Updated October 15, 2026.
WHY A POLICY FAILS
A policy no one reads protects no one.
The four most common flaws.
TOO LONG
Twenty pages of principles, not one rule anyone remembers.
DETACHED
It bans tools without offering others.
ONE-SIDED
Written by one department, discovered by the others.
FROZEN
Never revisited, while the tools change every quarter.
WHO WRITES IT
Leadership sponsors it. The IT department, the DPO and legal set its framework. Business teams check that it fits their daily work.
WHAT AN AI POLICY CONTAINS
Eight sections, one rule per line.
The outline we use with our clients. Each section fits in two or three sentences.
Purpose and scope
Why the company encourages AI, and who the policy applies to.
Approved tools
The list of AI tools selected with the IT department, and how to request a new one.
Data
What never leaves: customer data, personal data, trade secrets.
Human review
All AI-generated content is reviewed by a person before it is sent or published.
Transparency
When to say that content was prepared with AI, internally and with clients.
Security
Work accounts, access, reporting an incident.
Responsibilities
Who approves uses, who answers questions, who maintains the list of tools.
Updates
A review on a fixed schedule, at least twice a year.
Training
How everyone learns to use it, on their own cases.
BEFORE / AFTER
What changes with a living policy.
| NO POLICY | WITH A POLICY AND TOOLS | |
|---|---|---|
| Tools | Everyone picks their own. | A short list, known to all. |
| Data | No one knows what can go out. | A simple rule, shown in the tools. |
| Questions | Asked to no one. | One contact per team, a single address. |
A policy is judged by its use: we review it with you after the first sessions.
OUR METHOD
The policy is written in step 3.
The four steps of our method, in a loop. Each can be done on its own; together, they organize AI across the whole company.
Inspire your leadership team
A keynote built on cases from your business. Your leadership decides where AI will be useful, and where it will not.
Map your operations
We spot the bottlenecks, rank use cases by gain and difficulty, and name the tools to adopt.
Bring your teams on board
In a hands-on session, everyone arrives with a real problem and leaves with the AI agent that solves it. An AI policy sets the shared rules.
Build with the AI Factory
Our engineers build AI-ready business tools with you. You keep the keys.
YOUR QUESTIONS
Questions about the AI policy.
What is an AI policy?
A short document that sets the rules for using AI in the company: approved tools, data to protect, human review, responsibilities and updates.
Is an AI policy mandatory?
No law requires it under that name. But since February 2, 2025, Article 4 of the AI Act has required a sufficient level of AI literacy among staff, and the GDPR applies to personal data. A policy helps demonstrate this.
How do you write an AI acceptable use policy?
Start from real usage, not principles. First select the tools with the IT department, write one rule per line on one page, have it reviewed by business teams and the DPO, then present it in a hands-on session.
What should an AI policy contain?
Eight sections: purpose, approved tools, data, human review, transparency, security, responsibilities, updates. Add training: a rule without practice does not get applied.
Should it be appended to the company’s work rules?
That is a legal decision, to be made with your legal department and according to the applicable procedure. Without an appendix, the policy remains a good-practice guide.
Should employee representatives be involved?
We recommend it from the scoping stage: AI affects how work is organized. Your legal department will tell you whether a formal consultation is required.
Is there an AI policy template?
The eight-section outline on this page is one. We adapt it with you to your tools, your data and your teams, usually in one or two working sessions.
SOURCES
The texts and studies cited on this page.
Every figure on the site is sourced. See all our sources.
European Union, Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (AI Act), June 13, 2024. eur-lex.europa.eu (new tab)
CNIL, Comment déployer une IA générative ? La CNIL apporte de premières précisions, 2024. cnil.fr (new tab)
ANSSI, Recommandations de sécurité pour un système d’IA générative, April 2024. cyber.gouv.fr (new tab)
KPMG and the University of Melbourne, Trust, attitudes and use of artificial intelligence: A global study 2025, April 2025, 48,340 people in 47 countries. kpmg.com (new tab)
LET’S TALK ABOUT YOUR PROJECT
Let’s write your AI policy.
Thirty minutes to see where you stand, and how we would write it with your teams.
Your contact
The AI Origin team that runs the projects
You talk directly with the people who will run your project, from scoping to go-live.
No specific project yet? Start with a hands-on session: everyone brings a real problem and leaves with the AI agent that solves it. See step 3, Bring your teams on board
Thank you, we have received your request.
We will get back to you to schedule a time.
Write to us in two lines.
Your company, the AI tools already in use, your deadline. We will get back to you to schedule a time.
Write to contact@aiorigin.io Or book a time slotOr write to us: contact@aiorigin.io