Writing a one-page AI usage policy

Why one page is enough

An AI usage policy tells everyone what is allowed, what is forbidden and who to ask. The CNIL, France’s data protection authority, recommends governing the use of generative AI with internal policies or charters. It advises defining clearly which uses are allowed and which are forbidden. A short page gets read. A long document rarely does.

This document also serves as a record for Article 4 of the AI Act, which asks you to support your staff’s AI literacy.

The six sections to include

1. Approved tools, with the plan used, free or professional.
2. Forbidden data: personal data of customers or employees, confidential information, trade secrets.
3. Checking: an AI assistant can produce answers that are wrong but convincing. All content is reread before use.
4. Transparency: when to say that content or a conversation comes from an AI.
5. Caution: a document or a web page can contain hidden instructions that hijack the assistant.
6. Contact and updates: a named contact person and a review date.

The template to copy

Replace the items in square brackets. Delete anything that does not apply to you.

# AI usage policy of [Company name]
Version of [date]. Contact person: [first name last name, email]

## 1. Approved tools
- [Tool 1], [professional or free] plan, for [tasks]
- [Tool 2], [...] plan, for [tasks]
Any other tool is approved by [contact person] before use.

## 2. Data never to enter
- Personal data of customers, employees or job applicants,
  except in [tool] covered by a data processing agreement
- Confidential information: prices, contracts, [other]
- Passwords and access codes

## 3. Check before using
- AI can be wrong with confidence: I reread everything.
- I check figures, names, dates and sources.
- I remain responsible for what I send or publish.

## 4. Be transparent
- A customer chatbot says that it is an AI.
- A realistic AI-generated image, voice or video is labelled.

## 5. Stay careful
- A document or a web page can hide instructions
  that hijack the AI: I check what it produces.
- The AI sends, pays for and deletes nothing without my approval.

## 6. Training and questions
- Basic training: [aidock path or other], before [date]
- Questions and incidents: [contact person]
- Next review: [date]

Mistakes to avoid

• Copying a large group’s charter. It will be too long and will talk about tools you do not use. Start from how you really use AI.
• Banning everything. Without an approved tool, employees may use their personal accounts, with no safeguards at all. Offer at least one option with proper safeguards.
• Forgetting people outside the company. Article 4 of the AI Act also covers people who use AI on your behalf, such as a contractor or a temporary worker. Send them the policy.
• Writing in jargon. A rule should be clear on first reading. Prefer “I do not paste CVs into the tool” to legal wording.

How to put it in place

• Present it in a meeting, with two or three examples from your business: a quote, a customer follow-up, a product description.
• Send it to the whole team and note the date it was sent. This is a useful record.
• Review it as soon as a new tool arrives.
• Add shared training, for example with the Learn path.

To choose the tools for the list, use the Index. To check the rest of your approach, go through the self-assessment.