How-to7 min read · Updated

How to write an AI policy for your company: a 10-section outline you can adapt today

An AI policy should answer the questions staff actually ask, in two to four pages. This outline gives you the sections, sample wording and the EU AI Act basics.

The short answer

An AI policy for your company should name the approved tools and accounts, set data rules, list allowed and banned uses, make people accountable for what they send, cover transparency and training, and name an owner who reviews it quarterly. In the EU, Article 4 of the AI Act has required AI literacy measures since 2 February 2025, enforced nationally from 2 August 2026. The European Commission says no certificate is needed; an internal training record will do.

What you need before you start

  • An owner and a deadline. One person writes it, one person approves it, and it goes live within a month. A good policy in use beats a perfect one in draft.
  • A list of the AI tools in use today, including personal accounts. A two-question staff survey finds them quickly.
  • Your existing data and IT rules, so the AI policy points to them instead of repeating them.
  • Someone to review it. This guide gives you a strong draft; a lawyer or HR adviser should check it against your contracts, sector rules and country.

Keep it short. Two to four pages is enough for most companies under 500 people. Staff will read a page of clear rules; they will not read twenty pages of principles.

Why the EU AI Act makes this urgent

Article 4 of the EU AI Act, on AI literacy, has applied since 2 February 2025, according to the European Commission. As amended by the AI Omnibus, it requires providers and deployers of AI systems to take measures to support the development of AI literacy of their staff and other people who use AI systems on their behalf, suited to their knowledge, experience, training and context of use. It does not require you to guarantee any specific level of literacy for any individual. It applies to organisations outside the EU too when their AI systems are used in the EU or affect people there.

The Commission's AI literacy Q&A, updated on 20 October 2026, answers the questions most companies ask:

  • A company whose employees use ChatGPT to write advertising text or translate is in scope and should inform staff of the tool's specific risks, such as hallucination.
  • No certificate is required. Organisations can keep an internal record of training and other guidance instead.
  • No AI officer is required, and no specific literacy level is mandated.
  • National market surveillance authorities enforce the rules from 2 August 2026, proportionately, and a sanction is more likely if an incident results from inadequate training or guidance.
  • The AI Omnibus, in force since 27 July 2026, amended Article 4 but kept the duty on providers and deployers.

The Commission also says chatbot users should be made aware they are interacting with a machine, with the AI Act's transparency rules taking effect in August 2026. A written policy plus a training log is the simplest way to show you have taken AI literacy seriously.

The AI policy outline: 10 sections to adapt

  1. Purpose and scope. Example: "This policy covers everyone who works for or on behalf of [Company], including contractors and agencies, whenever they use AI tools for company work."
  2. Approved tools and accounts. Name them and the plan. Example: "Approved: ChatGPT Business and Gemini with your company Google account. Use company accounts only. Request any other tool from [owner] before using it with company data."
  3. Data rules. Use four levels. Public: anywhere. Internal: approved tools only. Confidential (contracts, pricing, unreleased plans): approved tools only, names removed where possible. Personal data about customers or staff, health data, passwords, keys and payment details: never, unless [owner] has approved a specific tool for it.
  4. Allowed uses. Drafting, summarising, translating, brainstorming, research with sources, coding help, analysing non-personal data.
  5. Uses that need extra review. Anything published, anything sent to a customer, contract wording, financial figures and translations of legal or safety text.
  6. Uses that are not allowed. Decisions about hiring, pay, performance or dismissal made by AI; legal, medical or financial advice to customers without a qualified person; generating images or voices of real people without consent; entering credentials into AI tools.
  7. Human review and accountability. Example: "You own anything you send, publish or decide, whether or not AI helped. Check facts, numbers, names and quotes against the source."
  8. Transparency. Tell customers when they are talking to an AI rather than a person; follow client contracts that restrict AI use; say when a deliverable is substantially AI-generated if the client asks.
  9. AI literacy and training. Example: "Everyone completes the one-hour AI basics session within 30 days of joining, and a short refresher each year. [Owner] keeps the attendance record." The Commission suggests covering what AI is, your organisation's role, the risks of the tools you use and how to reduce them.
  10. Incidents, owner and review. Who to tell if data is shared by mistake or an AI error reaches a customer, within how many hours; who owns the policy; the next review date.

How to write and launch it, step by step

  1. Survey current use. Ask which tools, which accounts and which tasks, anonymously.
  2. Choose the approved tools first. The policy is only usable if it names a tool people can actually use. Business plans matter: ChatGPT Business, Claude Team and Enterprise, Google Workspace with Gemini and Microsoft 365 Copilot with work accounts do not use your content for training by default.
  3. Draft with the outline above. Write each rule as an instruction with one example. The prompt below turns the outline into a draft.
  4. Test it on three real situations. "Can I paste this customer email into ChatGPT?" "Can I use AI to write a job advert?" "Can the support bot answer refund questions?" If the policy does not answer them, fix it.
  5. Get it reviewed by HR, IT and a legal adviser, especially for personal data and employment rules.
  6. Launch it with training, not an email. Walk through it in a 60-minute session, log attendance, and pin a one-page summary where people work.
  7. Review it every quarter. Tools change fast. OpenAI retires custom GPTs on 11 December 2026, and Gems on personal Google accounts become read-only on 17 November 2026; a policy that names tools has to keep up.

Worked example: one rule, before and after

A 40-person accounting firm's first draft said: "Staff must use AI responsibly and protect client data." Nobody could act on it. The rewrite says: "Client names, tax IDs and figures go only into ChatGPT Business with your firm login. Never into a personal ChatGPT, Claude or Gemini account, even with training switched off. If you need help with a client file outside ChatGPT Business, replace names with Client A and remove ID numbers first." The second version answers the question staff actually have, names the tool and gives a safe fallback.

Common mistakes and how to fix them

  • A blanket ban. It pushes use onto personal accounts you cannot see. Fix: approve one tool and make it the easy path.
  • Principles with no instructions. Fix: every rule needs a "do this" and an example.
  • Forgetting contractors and agencies. The Commission notes that "other persons" in Article 4 can include contractors and service providers. Fix: include them in scope and in training.
  • No training record. Fix: keep a sheet with name, date and session, the kind of internal record the Commission suggests.
  • Never updating it. Fix: put the quarterly review in the owner's calendar now.

Which tools to name in your policy

Name the business plan that fits your software: Microsoft 365 Copilot for Microsoft companies, Gemini for Google Workspace, ChatGPT Business as an all-rounder, Claude Team for sensitive long documents. See the best private AI for sensitive data, ChatGPT vs Claude, the Copilot guide, and the rollout plan in how to roll out AI to your team. Ready-made prompt sets for each department are in Yuzoki kits.

Prompts to copy

Turn the outline into a draft

Write an AI policy for [Company], a [size] [industry] company in [country]. Use these ten sections: [paste outline]. Approved tools: [tools and plans]. Write each rule as a plain instruction with one example from our work: [describe typical tasks]. Maximum three pages, with a five-line staff summary at the top.

You get: A first draft to review with HR and a legal adviser

Stress-test the policy

Here is our AI policy: [paste]. Act as a new employee and ask me ten realistic questions about using AI in [role] that this policy does not clearly answer. For each, suggest the shortest rule that would answer it.

You get: The gaps, found before staff find them

Make the one-page summary

Turn this AI policy into a one-page summary staff can pin up: five do's, five don'ts, which tools to use, and who to ask. Plain English, no legal language. [paste policy]

You get: A summary people will actually read

Write the training check

Write ten multiple-choice questions to check staff understand this AI policy, using realistic scenarios from [industry]. Mark the correct answers and give a one-line explanation for each. [paste policy]

You get: A quick check you can log as part of your AI literacy record

Keep going

Start the ChatGPT lessons Start the Claude lessons