Writing a Company AI Usage Policy: What to Include

A company AI usage policy: what it should include and how to write it

A written policy turns haphazard AI use into organised use that protects the company and encourages staff to make the most of it. Here we set out its core components and how to write it in plain language.

Data and AI 5 min read

By Nour Aldein Tleti. Updated 7 October 2026.

What should a company AI usage policy include?

The policy covers the approved tools and permitted accounts, the types of data that must not be entered, rules for reviewing outputs before use, who is responsible for errors, and how to report problems. It works best when it is short and clear, backed by practical examples, and reviewed whenever the tools or ways of working change.

Core clauses of the policy

Purpose and scope: Why the policy exists and who it applies to: employees, contractors and freelancers.
Approved tools: A list of the tools allowed for each type of task, and how to request approval for a new tool.
Forbidden data: Personal, financial and health data, contracts and passwords, with clear examples of each.
Output review: Every text, figure or translation is reviewed by a responsible person before it is sent to a customer or published.
Disclosure: When the customer or the relevant party must be told that content was produced with the help of AI.

Responsibilities and follow-up

Policy owner: A person or small committee that oversees implementation, answers questions and updates the text.
Employee responsibility: Employees are responsible for the work they deliver, even if a tool helped produce it.
Incident reporting: Clear steps to follow if sensitive data is entered by mistake or an error reaches a customer.
Regular updates: The policy is revised when new tools appear or when service terms or legal requirements change.
Approving new uses: Any use that touches customers directly, such as a chatbot on WhatsApp, needs prior approval from the policy owner.

Common mistakes when writing the policy

A total ban: Banning every tool pushes staff to use them secretly with personal accounts.
Complex legal language: Staff won’t follow a policy they don’t understand, so write it in plain language with examples.
No training: Emailing the policy without explanation or examples doesn’t change behaviour.
Ignoring local reality: If some tools are unavailable or the internet is weak, name the approved alternatives instead of assuming tools the team can’t reach.
Copying a ready-made policy as is: A policy copied from another company doesn’t reflect your tools, your data or the way you work.

How to write and apply the policy

01
Ask the team first
Find out which tools staff use and why, without blame.
02
Write a short draft
Two pages covering tools, data, review and responsibilities.
03
Review it with each department
Finance, sales and HR have special cases that should appear in the text.
04
Train with examples
A short session with examples taken from the company’s actual work.
05
Launch and review
Set a date to review the policy after a period of use, and adjust it based on feedback.

A short template of usage rules

Department	Allowed	Not allowed
Marketing	Ideas and draft posts reviewed before publishing	Publishing figures or claims without checking
Customer service	Drafting general replies without personal data	Entering a full customer conversation with their name and number
Finance	Explaining concepts and drafting general reminder messages	Entering account statements or payroll
Human resources	Drafting job ads and interview questions	Evaluating named candidates or employees

Read also

Data and AI

Frequently asked questions

Does a small company need a written policy?

Yes, even if it is one page. What matters is that everyone knows what is allowed, what isn’t, and whom to ask when in doubt.

Should we ban personal accounts?

It is better to provide approved tools and accounts for work, and to make clear that company data is not entered into personal accounts.

Should customers be told when AI is used?

That depends on the nature of the work, current legal requirements and customer expectations. With chatbots, it is better for customers to know they are talking to an automated assistant.

Who writes the policy?

Management, together with the technical lead and whoever handles legal or administrative matters, with feedback from the people who actually use the tools.

How often should we review it?

When tools change, after an incident or when requirements change, and at a fixed regular date even if nothing has happened.