AI policy

AI policy template: your company’s AI policy in five minutes

A good AI policy fits on one page. It says the company wants people to use AI, which tools to use at three levels, what information may go into them and who decides on new tools and connectors.

Fill in your answers and the policy writes itself. Read it and copy it for free, or download it as a Word document ready to share.

Write our AI policy
Generator

Answer six questions, get your AI policy

Level 1: your official AI toolsCompany accounts, may be connected to your systems.
Level 2: approved for specific teamsCompany accounts, a clear use case, no connections.

Our AI policy

Owner: CEO. Applies to everyone who works for our company, employees and consultants alike. Reviewed every six months.

1. Our view on AI

We want everyone at our company to use AI in their work. Try things, keep what works and share it with your colleagues. This policy is here so you can do that safely: it says which tools to use, what information may go into them and who to ask when you are unsure.

2. Our AI tools, in three levels

  • Level 1, our official tools: Claude and Microsoft Copilot. Use them with your company account. They may be connected to our systems through approved connectors.
  • Level 2, approved for specific teams: ChatGPT and Cursor. Used by teams with a clear use case approved by Head of IT, with a company account. Not connected to our systems.
  • Level 3, everything else: other AI tools may be tried privately, to learn. Never with company information that is not public.
  • Never okay: AI note-takers that record meetings without everyone knowing, browser extensions that read every page you open, and company information in a private account of any AI tool.

3. Our information, in three levels

  • Open: what we have published or would publish without a second thought. Website text, press releases, public reports.
  • Internal: everyday information that is not secret but not meant for outsiders. Processes, project plans, drafts, meeting notes without personal data.
  • Confidential: information that could harm customers, colleagues or the company if it got out. Personal data, customer data, contracts, salaries, unpublished financial figures, passwords and access keys.

4. Which information goes where

OpenInternalConfidential
Level 1YesYesYes, through approved connectors and only what the task needs
Level 2YesYes, with a company accountNo
Level 3YesNoNo

5. New tools and connectors: how we decide

  1. Talk to your manager about what you want to do and why.
  2. Your manager takes it to Head of IT.
  3. Head of IT checks what the tool or connector can reach, where the data is stored and whether we have a data processing agreement, and gives an answer within 5 working days.
  4. What is approved is added to the lists in this policy.

6. You own what AI produces

AI drafts, a person decides. Read and check anything AI has produced before it leaves the company or is used for a decision. AI never makes decisions about people on its own, such as hiring, pay or dismissal.

7. Training

Everyone who uses AI at our company gets an introduction to our tools and to this policy. The EU AI Act (Article 4) requires companies that use AI to make sure their people have enough knowledge to use it well.

8. Common sense, and nothing illegal

No policy covers everything. If something feels wrong, it probably is: stop and ask your manager or Head of IT, before rather than after. Never use AI for anything illegal, or for anything you would not do without AI.

9. Who owns this policy

CEO owns this policy and Head of IT keeps the lists of approved tools and connectors. We review it every six months, because the tools change fast.

What goes into it

The five parts of an AI policy people actually follow

1 · Our view

Say that you want people to use AI

Most policies start with what is forbidden. Start with the opposite: the company wants everyone to try AI, keep what works and share it, in a safe and structured way. People who are unsure what is allowed do nothing, and the most careful ones are the first to stop.
2 · Tools

Your tools in three levels

Level 1 is your official tools, such as Claude or Copilot, with company accounts and connected to approved systems. Level 2 is tools approved for a team with a clear use case, such as ChatGPT or Cursor, without connections. Level 3 is everything else, fine to try privately but never with company information.
3 · Information

Your information in three levels

Open, internal and confidential, with concrete examples of each. Then one table that says which information may go into which level of tool. That table is the part people remember.
4 · Decisions

How you decide on new tools and connectors

Ask your manager, the manager takes it to IT, IT checks quickly and gives an answer within a set number of days. Without a short path, people find their own way around the policy.
5 · Common sense

Common sense, and nothing illegal

No policy covers everything. A person checks what AI produces, AI never decides about people on its own, and when something feels wrong, stop and ask.
The matrix

Which information may go into which tools

OpenInternalConfidential
Level 1: official tools, connectedYesYesYes, through approved connectors
Level 2: team tools, not connectedYesYes, company accountNo
Level 3: everything else, privateYesNoNo

Add one line for what is never okay: AI note-takers that record meetings without everyone knowing, browser extensions that read every page, and company information in private AI accounts.

With Deployed OS

A policy on paper is read once

Most AI policies are read the day they go out and forgotten the week after. Nobody checks a document before asking ChatGPT a question.

Deployed OS makes your AI policy active in every question your team asks. The rules follow every conversation in Claude, ChatGPT and Copilot, strict rules are held by the platform, your level 1 tools reach only the systems each group may use, and every call is logged.

Tools
Level 1 tools connect to your systems through Deployed OS, with access set per group.
Information
Confidential information only flows through the approved connectors, never pasted into a private account.
Rules
The policy becomes guardrails that come with every question, in every AI tool your team uses.
Decisions
New connectors are added in one place when IT says yes, and are live for the right groups at once.
Proof
Every call is logged, so you can show what the AI read and did when a customer or auditor asks.
Already have one?

Send us your current AI policy

Paste it or send a link, and we will tell you what is missing compared with the five parts above.

FAQ

Questions about AI policies

An AI policy is a short internal document that says how a company wants its people to use AI: which tools are approved, what information may go into them, who decides on new tools and what is never okay. A good one fits on one or two pages.

The company’s view on AI, approved tools in levels, information in levels with a table of which information may go into which tools, how new tools and connectors are approved, that a person checks what AI produces, training, and who owns the policy.

In practice, yes. An AI acceptable use policy is the part of an AI policy that says what employees may and may not do with AI tools. For most companies with 20 to 500 people, one short policy covers both.

The AI Act does not require a document called an AI policy. Since 2 February 2025, Article 4 requires companies that use AI to make sure their staff have enough knowledge to use it. A clear policy and a short introduction for everyone are the simplest way to show that.

Yes, if the policy says so and they use a company account. On ChatGPT Business and Enterprise, OpenAI does not train on your data. The risk is private accounts, where the company has no agreement and no control.

Someone in management, often the CEO, with IT keeping the lists of approved tools and connectors. Review it every six months, because the tools change fast.

Make the approved way the easiest way, and put the rules where the work happens. Deployed OS makes the AI policy active in every question: the rules follow every conversation, tools reach only approved systems and every call is logged.

Read also