Company AI Policy Template: Draft Yours in an Afternoon

By James Finley. Published Nov 2, 2026.

A workable company AI policy covers eight parts: who and what it applies to, which tools are approved, what's off limits, how to handle confidential data, how people review AI output, when to disclose AI use, how you roll it out, and who keeps it current. You can draft all eight in an afternoon with the template below.

This guide is for owners and office managers of teams of about 5 to 50 people with no legal team. This isn't legal advice. If you handle regulated data or have strict client contracts, ask a lawyer to review your draft.

Why does a small team need an AI policy?

Your team is probably using AI already. Microsoft's 2024 Work Trend Index, a survey of 31,000 people in 31 countries, found that 78% of AI users bring their own AI tools to work.

Without a written policy, each person decides alone what's safe to paste in. A short policy gives everyone the same answer.

Who and what should the policy cover?

Everyone who works for you: employees, contractors, interns and temps. It should also cover any AI tool used for work, including a personal account used on a work task.

That last point matters. A client email drafted in someone's free personal account still falls under the policy.

How do you build an approved tools list?

Name the exact tools and plans, not categories. "AI chatbots" tells people nothing. "[Tool name], business plan" does.

For each tool, write down four things:

Who approved it, and when.
What data it may touch.
Whether the vendor trains its models on your inputs on your plan. Don't guess. Check each vendor's privacy terms for your plan.
Any conditions, such as getting consent before recording a meeting.

Any new tool, browser extension or plugin needs written approval before anyone uses it for work.

APPROVED AI TOOLS (example)

1. [Paid chat assistant], business plan
   Approved by: [Owner name], [date]
   Data allowed: internal drafts, public information
   Trains on our inputs? [Check vendor's privacy terms for our plan]

2. [Meeting transcription tool]
   Approved by: [Owner name], [date]
   Data allowed: internal meetings, only when every attendee agrees to be recorded
   Trains on our inputs? [Check vendor's privacy terms for our plan]

3. [Image generator]
   Approved by: [Owner name], [date]
   Data allowed: marketing images only. No client logos, client data or photos of real people.
   Trains on our inputs? [Check vendor's privacy terms for our plan]

What should be off limits?

Three rules cover the biggest risks:

No client or personal data in unapproved tools. This includes names, contact details, health details and account numbers.
No AI-only decisions about people. AI may help draft a job post. A person makes every hiring, pay, discipline and performance decision.
No unreviewed AI text in contracts or compliance documents. A qualified person reads every line before it's used.

How should the policy handle confidential data?

Sort your data into levels first. Three levels suit most small teams: Public (your website, published prices), Internal (meeting notes, drafts, processes) and Confidential (client records, employee files, financials, passwords).

Then tie each level to the tools allowed to hold it. Add two rules: when in doubt, treat it as confidential and ask, and client contracts come first.

CONFIDENTIAL DATA
Confidential data may only go into tools listed as approved for confidential data. If you're not sure how to classify something, treat it as confidential and ask [Policy owner] before using any AI tool. If a client contract or NDA sets stricter rules about AI or data, the contract wins.

What does "reviewed" mean?

Spell it out, because "I looked at it" means different things to different people. Reviewed means you:

Read all of it, not just the start.
Checked every fact, name and number against a trusted source.
Confirmed every citation, link and quote is real and says what the AI claims.

Anything that leaves the company, like a client email or social post, also needs a named human approver.

REVIEW AND ACCOUNTABILITY
The person who uses AI output is responsible for it. Before AI-assisted work goes to a client, regulator or the public, [Approver role] must review and approve it. "The AI wrote it" is never an excuse for an error.

When should you disclose AI use?

Inside the company, keep a simple log of AI-assisted work that matters: what it was, which tool, and who reviewed it. Outside the company, disclose AI use whenever a client contract, a regulator or a platform's rules require it. Write down your default for everything else.

How do you roll the policy out?

Brief. Spend 15 minutes at a team meeting on what changes and why.
Practice. Have everyone do one real task in an approved tool, including the review check.
Acknowledge. Ask everyone to confirm in writing that they've read it. Add it to new-hire paperwork.

Who owns the policy, and when do you update it?

Name one owner. Review the policy every 6 months, and sooner when any of these happen:

You add a new AI tool.
A vendor changes its terms or data settings.
An AI error reaches a client.
A regulator that covers your business publishes new guidance.

Keep a change log at the bottom.

Do any laws or frameworks apply?

It depends on where you operate and whose data you handle.

EU AI Act. Article 4, the AI literacy rule for providers and deployers of AI systems, has applied since February 2, 2025. A 2026 amendment now asks them to take measures to support their staff's AI literacy. It applies only to organizations the Act covers, so ask a lawyer whether that includes you.
UK. If you handle personal data of people in the UK, the ICO's guidance on AI and data protection covers what it calls "best practice for data protection-compliant AI."
NIST AI Risk Management Framework. A voluntary US framework for managing AI risk, if you want to go deeper.

How does it differ for 5 people versus 50?

About 5 people: one page. The owner approves tools, a shared document is the log, and acknowledgment can be a reply email.

About 50 people: name a contact in each team, use a request form for new tools, and track acknowledgments in your HR system.

Agencies: client contracts drive the rules. List each client's AI terms next to your approved tools.

HR teams: candidate and employee data is confidential by default. Keep a person in every screening step, and ask a lawyer about local rules on AI in hiring.

Where's a template you can copy?

Replace each [PLACEHOLDER] and delete what doesn't fit.

[COMPANY NAME] AI POLICY
Owner: [POLICY OWNER]   Effective: [DATE]   Next review: [DATE + 6 MONTHS]

1. SCOPE
This policy applies to all employees, contractors, interns and temporary staff. It covers any AI tool used for company work, including personal accounts used on work tasks.

2. APPROVED TOOLS
Only tools on the approved list may be used for work. The list names each tool, who approved it, what data it may hold, and whether the vendor trains on our inputs. New tools and plugins need written approval from [POLICY OWNER].

3. PROHIBITED USES
- Putting client or personal data into a tool not approved for it.
- Using AI to make hiring, pay, discipline or performance decisions without a person deciding.
- Using AI text in contracts or compliance documents without review by [QUALIFIED REVIEWER].

4. CONFIDENTIAL DATA
We classify data as Public, Internal or Confidential. Confidential data may only go into tools approved for it. If you're unsure, treat it as confidential and ask [POLICY OWNER]. Client contracts and NDAs override this policy when they are stricter.

5. REVIEW AND ACCOUNTABILITY
Reviewed means you read all of it, checked every fact, name and number against a trusted source, and confirmed every citation is real. Work going outside the company needs approval from [APPROVER ROLE]. The person who uses AI output is accountable for it.

6. DISCLOSURE
Log significant AI-assisted work in [LOG LOCATION]. Disclose AI use to clients, regulators or platforms when a contract or rule requires it. Our default for other work: [DEFAULT].

7. TRAINING AND ACKNOWLEDGMENT
Everyone completes a briefing and a hands-on session before using AI for work, and confirms in writing that they've read this policy.

8. OWNERSHIP AND UPDATES
[POLICY OWNER] reviews this policy every 6 months and after a new tool, a vendor terms change, an AI error that reaches a client, or new regulator guidance.

Questions or mistakes: tell [POLICY OWNER] right away.

CHANGE LOG
[DATE] - [CHANGE] - [WHO]

Do you need a lawyer?

Not for a first draft. A lawyer's review is worth it if you handle health, financial or other regulated data, work under strict client contracts, or operate in the EU.

Is an AI usage policy different from an AI policy?

Mostly not. Some companies keep a short usage policy for staff and a longer governance document for leaders. For a team under 50, one document is enough.

How long should it be?

One to two pages. Long enough to cover the eight parts, short enough that people read it.

Should it name specific tools?

Yes. Categories leave people guessing, and guessing is how client data ends up in the wrong place.

Where can you go from here?

Our Write Your Company's AI Policy course walks through each part with practice. It has a free preview lesson, with no account needed. For your staff, AI Privacy, Safety, and Responsible Use covers what's safe to share and how to check AI output.