If you're wondering whether your employees use AI tools, the answer is almost certainly yes. The real question is whether they do so within rules the organisation knows about and approves, or without any oversight. An AI usage policy is the first and cheapest step to remove that uncertainty.
A good policy doesn't scare employees away from AI. On the contrary, by making clear what is allowed, it encourages safe use.
The sections of the policy
1. Purpose and scope
State why the policy exists (productivity and risk management) and who it covers: all employees, interns, consultants and suppliers working on the organisation's behalf.
2. Approved tools
List the AI tools that may be used and which versions (e.g. enterprise accounts). Define an approval process for tools not on the list. Banning tools without offering a safe alternative only increases shadow AI.
3. Data classification: which data, which tool?
This is the heart of the policy. A simple table makes decisions easy for employees:
| Data type | Examples | General tools | Approved enterprise tools |
|---|---|---|---|
| Public | Website content, published reports | ✅ Allowed | ✅ Allowed |
| Internal | Internal procedures, meeting notes | ❌ Not allowed | ✅ Allowed |
| Confidential | Contracts, prices, strategy, source code | ❌ Not allowed | ⚠️ Approved use cases only |
| Personal data | Customer and employee information | ❌ Not allowed | ⚠️ Legal approval required |
| Special category data | Health, biometric data | ❌ Not allowed | ❌ Not allowed (without special approval) |
4. Prohibited uses
List explicitly prohibited uses, for example:
- Making automated decisions about people with AI (hiring, credit, disciplinary action)
- Giving AI output to customers or the public without verification
- Creating content that impersonates others (deepfakes)
- Granting unapproved AI tools access to corporate systems
5. Verifying output and accountability
The person who uses AI output is responsible for it. Figures, sources, legal references and names must always be checked.
6. Transparency
State that people interacting directly with AI systems (e.g. chat assistants) must be told they are dealing with AI. The EU AI Act's transparency obligations apply from August 2026, which makes this section especially important for organisations serving the EU.
7. Approving new tools and use cases
Define how new tools or use cases are approved: who applies, who reviews (IT, information security, legal), and which criteria apply (where data is processed, model-training terms, access control).
8. Training
Make a short safe-use training mandatory so the policy doesn't stay on paper.
9. Incident reporting
Explain what to do and whom to notify if personal or confidential data is shared by mistake. Personal data breaches can trigger time-bound notification obligations under data protection law, so fast reporting is critical.
10. Review
AI tools and regulation change fast. Review the policy at least every six months.
Common mistakes
- Long, legalistic language: nobody reads a 20-page policy. Keep the main policy to 2–3 pages; details can go in annexes.
- Only a list of bans: a policy that doesn't say what's allowed either drives people away from AI or gets ignored.
- Banning without providing tools: without a safe enterprise tool, employees turn to personal accounts.
- Policy without training: emailing a policy doesn't mean it's understood.
A policy is the first step of governance
The usage policy is the starting point of broader AI governance. The usual next steps are to inventory the AI systems in use, classify them by risk and define additional controls for high-risk systems.
Through our AI Governance & Compliance service we build your usage policy, inventory and risk classification together. To make sure employees actually adopt the policy, we recommend our Using Generative AI Safely programme.
Sources