AI policy for businesses: what it should include, with a template

An AI policy is a company's guidelines for how employees may use AI at work. It should answer which tools are approved, which data may be used in them, who is responsible for what and when a person must review the result. A good AI policy is short and written so everyone understands it. This guide covers what the policy should include, gives you a template to start from and shows how to roll it out so it is followed.

Short answer

• Purpose and scope: why the policy exists and who it applies to.
• Approved tools: which AI tools may be used, and how new ones are approved.
• Data: which information may be used in which tools.
• Responsibility and review: who is responsible for the result, and when a person must review it.
• Training, incidents and follow-up: how employees learn, what happens when something goes wrong and how often the policy is reviewed.

Why do companies need an AI policy?

In most companies, employees already use AI tools, often on their own initiative and with personal accounts. That is basically positive, but without guidelines three risks appear:

• Data ends up in the wrong place. Customer details, contracts or financial information are pasted into tools where the company doesn't know how the data is handled.
• No one takes responsibility for the result. AI can be wrong, and without a rule about review, incorrect information can reach customers or decisions.
• Everyone does it differently. Some don't dare use AI at all, others use it for everything. The value becomes uneven and the risks hard to oversee.

There are also regulations to consider. GDPR applies to personal data regardless of the tool, and the EU AI Act requires, among other things, that staff who use AI systems have sufficient knowledge of them. An AI policy is a simple way to show how the company handles this.

What should an AI policy include?

1. Purpose and scope. Why the policy exists, who it applies to (employees, consultants) and what kind of AI it covers.
2. Approved tools. A list of the AI tools that may be used at work, preferably with company accounts, and how employees can suggest new ones.
3. Data classification. Which information may be used in which tools. See the classification below.
4. Permitted and prohibited use. Examples of what AI is welcome to be used for, and what it may not be used for.
5. Human review. When a person must check the result before it is used, for example before something is sent to a customer or forms the basis for a decision.
6. Transparency. When it should be clear that AI has been used, for example in texts to customers or in AI agents that answer tickets.
7. Responsibility. Who owns the policy, who approves new tools and who employees can ask.
8. Training. How employees learn to use AI correctly and understand the policy.
9. Incidents and follow-up. What employees do if something goes wrong, and how often the policy is reviewed.

Classify your data into levels

The hardest question for most companies is which information may be used where. A simple classification into three levels is often enough:

Template: AI policy

Use the template as a starting point and adapt it to your business. Keep it short.

1. Purpose and scope. We want our employees to use AI to work smarter, in a way that protects our customers, our data and our reputation. The policy applies to all employees and consultants who work for us.

2. Approved tools. At work, we only use the AI tools on our list of approved tools, with company accounts. If you want to use a new tool, ask [owner].

3. Data. We follow our classification into public, internal and sensitive information. Sensitive information, such as personal data, contracts and finance, is never used in AI tools that are not specifically approved for it.

4. Permitted use. AI is welcome to be used for drafting, summarizing, analyzing, translating and generating ideas. AI may not be used to make decisions about people, such as hiring or credit assessments, without human review.

5. Review. You are always responsible for what you use. Check facts, figures and sources before anything is sent to a customer, published or used as the basis for a decision.

6. Transparency. When a customer interacts with an AI solution, such as an AI agent that answers tickets, this should be made clear.

7. Responsibility. [Name and role] owns the policy, approves new tools and answers questions.

8. Training. All new employees go through the policy and a short introduction to the approved tools. We review news and lessons learned regularly.

9. Incidents and follow-up. If sensitive information has ended up in the wrong tool, or AI has led to an error that reached a customer, notify [owner] immediately. The policy is reviewed at least every six months.

The template is guidance, not legal advice. If you work with particularly sensitive data or use AI for decisions that affect people, you should have the policy reviewed by a lawyer.

How to roll out the policy so it is followed

• Start by finding out what is used today. Ask employees which AI tools they already use and for what. The policy will be better, and more accepted, if it starts from reality.
• Offer a good alternative. A policy that only prohibits leads people to use AI on the sly. Offer approved tools with company accounts.
• Go through it together. A short walkthrough with examples from your own day-to-day work does more than a document on the intranet.
• Follow up. The tools change quickly. Review the list and the policy at least every six months.

When do you need help?

Many companies can write a first AI policy on their own using the template. Outside help adds the most value when AI will be used with sensitive data, built into your systems or into AI agents that act on their own. Then the policy ties into permissions, logging and human checkpoints in the solutions themselves. An AI consultant can help you develop guidelines and governance as part of a current-state assessment. Also read How to get started with AI in your business.

Frequently asked questions

What is an AI policy?

An AI policy is a company's guidelines for how employees may use AI at work: which tools are approved, which data may be used, who is responsible and when a person must review the result.

Does our company need an AI policy?

If employees use AI tools at work, which most do, an AI policy is a simple way to protect customer data and company information and make sure everyone uses AI the same way. It doesn't need to be long.

What should an AI policy include?

Purpose and scope, approved tools, data classification, permitted and prohibited use, human review, transparency, responsibility, training, and incidents and follow-up.

May employees use ChatGPT and other AI tools at work?

That is for the company to decide in its AI policy. Many allow approved tools with company accounts and set rules for which information may be used in them, rather than banning AI entirely.

How does the EU AI Act affect our AI policy?

The act requires, among other things, that staff who use AI systems have sufficient knowledge of them, and some uses, such as AI in recruitment, have stricter requirements. An AI policy with training and clear responsibility is a good way to meet the basic requirements. For higher-risk uses, you should consult a lawyer.

How often should the AI policy be updated?

At least every six months, and whenever you introduce new tools or start using AI in new ways, for example in AI agents that act in your systems.

Next steps

Start by asking employees which AI tools they use today and for what. Then start from the template, adapt it and go through it together. If you want help with guidelines and governance, you can book a free mapping session.