AI Use Policy: How to Write One for Your Company

An AI use policy is a short internal document that tells employees which AI tools they may use, for what, with which data, and who checks the results. Most companies need one now, because staff are already using AI assistants whether or not anyone approved them. A good policy fits on two or three pages, is written in plain language, and makes the safe way to use AI the easy way.

This guide explains what to put in a company AI use policy, gives a section-by-section template, shows how to classify data so rules are clear, and covers rollout, training and review. It is practical guidance, not legal advice; for regulated sectors, involve your legal adviser or data protection officer.

Why your company needs an AI use policy now

Without a policy, people make their own rules. Some avoid AI entirely and lose time; others paste customer lists, contracts or source code into whatever free tool they found. Neither outcome is good, and both are common.

A policy solves four problems:

• Data leakage. It defines what must never go into an AI tool, and which tools are approved for which data.
• Quality. It makes clear that a person is responsible for anything AI helped produce.
• Legal exposure. It connects AI use to your existing obligations under data protection, confidentiality and sector rules.
• Uncertainty. It gives cautious employees permission to use AI productively, within clear limits.

The regulatory angle in the EU

The EU AI Act includes an obligation for organisations that deploy AI systems to take measures to ensure their staff have a sufficient level of AI literacy. A written policy plus basic training is the most straightforward way to show you have taken that seriously. Our plain-language summary of the EU AI Act covers the wider rules. GDPR also still applies whenever personal data is involved, AI or not.

What an AI use policy should cover

Keep it short enough that people actually read it. These are the sections that matter.

Section	What it answers	Typical length
Purpose and scope	Why the policy exists, who and which tools it covers	One paragraph
Approved tools	Which AI tools may be used, on which accounts	A short list
Data rules	What data may go into which tool	A table
Allowed and prohibited uses	Examples of good use and red lines	Two short lists
Human review and accountability	Who checks output and who is responsible	A few sentences
Transparency	When to disclose AI involvement	A few sentences
Intellectual property	Ownership, third-party rights, confidentiality	A paragraph
Requesting new tools	How to get a tool approved	A few steps
Incidents	What to do if something goes wrong	A few steps
Training and review	Who is trained, when the policy is updated	A few sentences

Section by section: a practical template

1. Purpose and scope

“This policy explains how employees and contractors of [Company] may use AI tools, including chat assistants, writing tools, code assistants and image generators, in their work. It applies to all company devices and to any use of AI for company work on personal devices.”

2. Approved tools

List the tools people may use and on which accounts, for example a company workspace rather than personal free accounts. The distinction matters: company accounts can come with agreements on data handling and training that personal accounts do not.

When choosing tools, check at least: whether your inputs are used to train models, where data is stored, whether you can delete chats and files, and what the terms say about confidentiality. Our AI privacy checklist with 12 questions for any AI vendor is a ready-made starting point.

3. Data rules

This is the heart of the policy. See the next section for a classification you can adopt.

4. Allowed uses

Give concrete examples so people know what “good use” looks like:

• Drafting and editing emails, reports and presentations from your own notes.
• Summarising public documents and articles.
• Brainstorming ideas, headlines and outlines.
• Explaining concepts, formulas and code.
• Translating internal, non-confidential text, with a native speaker check for anything external.
• Writing and reviewing code in approved tools, following normal code review.

5. Prohibited uses

• Entering restricted data (see below) into any AI tool.
• Making final decisions about people, such as hiring, firing, credit or discipline, based on AI output alone.
• Presenting AI-generated content as verified fact without checking it.
• Generating content that impersonates real people, or deceptive or discriminatory material.
• Using unapproved tools or personal accounts for company data.
• Trying to bypass a tool’s safety features.

6. Human review and accountability

“The person who uses AI output is responsible for it as if they had written it themselves. Facts, figures, names, legal statements and code must be checked before use. Customer-facing and published material follows the normal approval process.” AI can state false things confidently; staff should know how to spot that, as explained in our guide to AI hallucinations.

7. Transparency

Decide when AI involvement must be disclosed. A common approach: disclose when a customer interacts directly with an AI system, when AI-generated images or media could be mistaken for real, and whenever a client contract requires it. Internal drafts do not usually need a label.

8. Intellectual property

Remind people not to paste third-party confidential material, such as a client’s code or a partner’s unpublished document, unless the agreement allows it. Note that rights in AI-generated content can be unclear, so work that must be exclusively owned should involve substantial human authorship.

9. Requesting a new tool

Make it easy: a short form or email to a named person, with the tool’s name, purpose and the data it would touch. A quick answer prevents people from quietly using unapproved tools.

10. Incidents

“If you entered restricted data into an AI tool by mistake, or AI output caused an error that reached a customer, tell [contact] the same day. Early reporting is not punished; hiding incidents is.”

Classifying data so the rules are clear

People follow rules they can apply in five seconds. A three-level classification usually works better than a long list of exceptions.

• Public: already published or intended for publication, such as website text, press releases and public reports. Allowed in any approved tool.
• Internal: ordinary business information that is not sensitive, such as meeting notes without personal details, internal how-tos and draft marketing copy. Allowed in approved company tools only.
• Restricted: personal data about customers or employees, health or financial details, passwords and keys, unannounced financial results, client confidential material, trade secrets. Not allowed in AI tools, unless a specific tool has been approved for that data with the right agreements in place.

Add a short list of examples for each level from your own business. Our guide to what never to paste into a chatbot is useful material for the restricted category.

Anonymise instead of forbidding

Much restricted material becomes usable once identifying details are removed. “Summarise this complaint” works just as well with the customer’s name and address replaced by placeholders. Teach this habit; it unlocks a lot of safe use.

Rolling out the policy

A policy nobody reads protects nobody. Plan the rollout as carefully as the text.

1. Draft with the people who use AI. Ask a few heavy users and a few sceptics what they actually do. Rules based on real use get followed.
2. Keep it short. Two or three pages, with a one-page summary of the data rules.
3. Provide approved tools at the same time. A policy that says “do not use free tools” without offering an alternative just drives use underground.
4. Run a short training session. Thirty to sixty minutes: the data rules, a live demo of good use, examples of mistakes, how to request tools.
5. Ask for acknowledgement. A simple confirmation that each person has read it.
6. Publish examples. Share good prompts and workflows internally, so the policy feels like enablement rather than restriction.

AI literacy training content

Cover at least: what AI assistants are good and bad at, why they can be confidently wrong, how the knowledge cutoff affects answers, what data rules apply, how to check output, and when to escalate. For risk management vocabulary, the NIST AI Risk Management Framework is a widely used reference that larger organisations often align with.

Common mistakes in AI policies

• Total bans. They rarely work. People use AI on their phones instead, with no oversight at all.
• Legal language only. If staff cannot understand the rules, they cannot follow them.
• No list of approved tools. “Use AI responsibly” without saying which tools are approved leaves everyone guessing.
• Ignoring contractors. Freelancers and agencies handle your data too; the policy and contracts should cover them.
• Write once, never review. AI tools and rules change fast. Review at least every six months.
• No owner. Name one person or role responsible for the policy, questions and tool approvals.

Reviewing and updating the policy

Put a review date on the document. At each review, ask:

• Which tools are people actually using, approved or not?
• Were there incidents or near misses, and what do they teach?
• Have laws, regulator guidance or client contract requirements changed?
• Have approved tools changed their terms, storage locations or training settings?
• Which rules are people finding impractical, and why?

An assistant can help here too: give it the current policy and the review notes and ask for a marked-up revision, then have the policy owner and, where needed, a legal adviser approve the changes.

Where Ask Mio fits in your approved tools

When you choose tools to approve, Ask Mio is designed with company policies in mind:

• Chats and files are not used to train models.
• Data is stored on servers in the EU (Germany), and users can export or delete their chats and files at any time.
• Memory is visible and under the user’s control, so nothing is remembered silently.
• The Business plan (29 € a month) includes team seats, shared projects and API access, so a team can work under one account with shared instructions instead of scattered personal accounts.

A shared project can also carry your AI use rules as instructions, so the assistant reminds users, for example, to anonymise customer data. That is a helpful nudge, not a substitute for the policy and training.

Frequently Asked Questions

What is an AI use policy?

An AI use policy is an internal document that sets out which AI tools employees may use, for which tasks, with which data, and who is responsible for checking results. It usually covers approved tools, data classification, allowed and prohibited uses, human review, disclosure, intellectual property, incident reporting and training. Good policies are short and use plain language.

Does a small business need an AI use policy?

Yes, even a one-page version helps. Small teams handle customer data and confidential documents just like large ones, and staff are likely using AI already. A short list of approved tools, clear data rules and a named person for questions prevents the most common and costly mistakes.

Should we ban tools like free chatbots at work?

A total ban usually pushes use onto personal phones, where you have no control at all. It works better to approve specific tools, ideally on company accounts with clear data handling terms, and to forbid putting internal or restricted data into unapproved or personal accounts.

Does the EU AI Act require an AI use policy?

The AI Act does not literally require a document with that name, but it does require organisations deploying AI systems to take measures to ensure sufficient AI literacy among their staff. A written policy combined with basic training is a practical way to meet that expectation. Check sector-specific obligations with a legal adviser.

How often should the policy be updated?

Review it at least every six months, and immediately after an incident, a change in law, or a significant change in an approved tool’s terms. AI tools add features and change data handling frequently, so a policy that is a year old may already describe tools and risks that no longer match reality.

What data should never go into an AI tool?

Passwords, keys and access tokens, personal data about customers or employees, health and financial details, client confidential material and unannounced financial or deal information should stay out, unless a specific tool is approved for that data under suitable agreements. Anonymising text first often makes a task safe.

The Bottom Line

A good AI use policy is short, practical and paired with approved tools and a little training. Define which tools are allowed, classify data into public, internal and restricted, make people responsible for checking output, and review the rules twice a year. That lets your team use AI productively without leaking data or publishing mistakes. If you are choosing a tool to approve, look at Ask Mio’s EU hosting, no-training policy and team features on the Ask Mio pricing page.