An AI policy fits on one or two pages: which AI tools are approved, what data never goes into them, which uses are allowed or banned, the duty to check the output, training, and the person to ask. How it becomes binding on employees depends on your country’s employment law: in France, it is usually annexed to the company’s internal work rules, which requires the staff committee’s opinion, notice to the labour inspectorate and a one-month wait. A template to copy is below.
The texts cited were checked on 23 October 2026 on code.travail.gouv.fr, EUR-Lex and cnil.fr. Quotes from French sources are translated. This article explains the rules; it doesn’t replace advice from a lawyer, your data protection officer (DPO) or your data protection authority.
Is an AI policy mandatory?
No law requires an “AI policy” as such. Three reasons still push you to write one.
The CNIL recommends it. France’s data protection authority advises companies to “govern the use of a generative AI system through internal policies or charters” that “clearly” set out “authorised uses and prohibited uses” (CNIL questions and answers, in French, 18 July 2024).
The EU AI Act requires training, in every EU country. The European regulation on AI (Regulation 2024/1689) applies to “deployers”, meaning any person or organisation using an AI system under its authority, except for personal non-professional use. Since 2 February 2025, its Article 4 has required them to act on their staff’s “AI literacy”. The omnibus regulation of 8 July 2026 (Regulation 2026/1744, in force since 27 July 2026) softened the wording: companies “shall take measures to support the development of AI literacy of their staff”, and this obligation “does not require” them “to guarantee any specific level of AI literacy of any individual”. The obligation remains; a policy plus a short training session is the simplest way to meet it.
The company answers for how its staff use AI. “It is the user organisation that will incur legal liability in the event of misuse of AI by its staff,” the CNIL points out. The GDPR rules that apply are covered in AI and GDPR.
What the policy must settle
Six questions, and a clear answer to each:
- Which tools? A named list. Anything not on it isn’t approved for work.
- With which account? The CNIL advises against accounts created with a personal email address, and recommends switching off, where possible, the provider’s reuse of your data.
- Which data, never? Personal data about customers or colleagues, health data, contracts, unpublished figures, passwords and access codes.
- Which uses? What is allowed, what needs care, what is banned.
- Who checks? The person who sends it. An AI sometimes makes up a figure or a reference.
- Who to ask? A named contact person, and a review date.
For the list of tools, what matters is what happens to the text: a contract with the provider (a data processing agreement, or DPA), training on your data switched off, a known processing location. ChatGPT’s plans are compared from this angle in ChatGPT for business. A local AI, which runs on the computer itself, settles the question of sending data out: Keypop offers one for free (see local AI).
The AI policy template to copy
Replace what is in square brackets, and have it checked by your lawyer or DPO before you circulate it.
Artificial intelligence acceptable use policy — [Company name]
1. Purpose and scope. This policy sets the rules for using generative artificial intelligence (AI) tools at work. It applies to all employees, interns, temporary staff and contractors who use these tools on behalf of [Company name], on a company computer or on personal equipment.
2. Approved tools. Only the following tools may be used for work: [list: tool name, plan, intended use]. They are used with the work account provided by the company. Creating an account with a personal email address for work use is not allowed. Requests to add a tool go to [contact person].
3. Data you never enter. Except in the tools marked “internal data allowed” in the list above, you must not type, paste or upload into an AI tool:
- personal data about customers, candidates or colleagues (name, address, case number, personal situation);
- health data, and any special category data under the GDPR;
- contracts, documents marked confidential, unpublished figures;
- passwords, access codes, non-public source code.
If in doubt, replace names with a role (“the customer”, “the candidate”) or don’t use the tool.
4. Uses.
- Allowed: proofreading, rephrasing, translating, summarising or structuring a text that contains no banned data; preparing an outline or a first draft.
- With care: summarising an internal document, preparing an email to a customer, only in a tool marked “internal data allowed”.
- Banned: making or preparing a decision about a person (hiring, appraisal, disciplinary action) based on an AI; producing a document that commits the company without checking it; presenting generated content as a verified source.
5. Checking and responsibility. Every user reads and checks what they produce with an AI before using or sending it. They remain its author and are responsible for it. Figures, names, dates and references are checked against their source.
6. Transparency. [Optional] Content largely produced by an AI and shared outside the company says so when [company rule].
7. Training. Before using an AI tool, every user completes the training provided by the company on how these tools work, their limits and their risks. It is updated [once a year].
8. Contact person and incidents. [Name, role, email] answers questions about this policy. Any accidental entry of banned data is reported to them without delay, and to the [DPO / IT manager].
9. Disciplinary action. Failure to comply with this policy may lead to disciplinary action under [the company’s disciplinary rules].
10. Entry into force and review. This policy, [annexed to the company’s work rules], comes into force on [date]. It is reviewed at least once a year.
Making it binding: the procedure in France
A policy that sits as a PDF on the intranet binds no one. How you make it binding depends on your country’s employment law; ask an employment lawyer where you are. If your company is in France, the CNIL recommends giving an IT charter “binding force”, for example by annexing it to the règlement intérieur, the company’s internal work rules (CNIL, setting a framework for users, in French, 14 March 2024). The French labour code (Code du travail) sets out how, in pages that are in French:
- The règlement intérieur is mandatory from 50 employees, twelve months after the threshold is reached (L1311-2). It sets, among other things, the general and permanent rules on discipline (L1321-1).
- A staff memo or a charter that lays down general and permanent obligations in these areas counts as an addition to the règlement intérieur, and follows the same rules (L1321-5).
- The procedure: the text is “submitted for the opinion of the comité social et économique” (the CSE, the elected staff committee), it states its date of entry into force, which must be “one month after the publicity formalities have been completed”, and it is sent to the labour inspector together with the CSE’s opinion (L1321-4).
- The CSE is also consulted on “the introduction of new technologies” (L2312-8) and, before the decision, on any means of monitoring employees’ activity (L2312-38), for example if the tool keeps a history per person.
- Employees are informed: no information about them may be collected by a system that hasn’t been brought to their attention beforehand (L1222-4).
- The rules must stay proportionate: the règlement intérieur cannot restrict employees’ rights and freedoms beyond what the task justifies (L1321-3). Banning customer files from a consumer AI tool is justified; banning all AI, including at home, much less so.
Below 50 employees, the règlement intérieur isn’t mandatory in France: the policy is still useful as a set of ground rules, circulated and signed. Whether you can take disciplinary action on that basis is a question for your lawyer.
Training your teams, the second half
The policy says what to do; training explains why. The CNIL recommends “familiarising end users with how these systems work and their limits”, or even “mandatory prior training” (CNIL questions and answers). For a small company, an hour is often enough: how an AI tool handles the text you give it, why it gets things wrong, which data not to paste, how to switch off training (step by step in free AI).
In France, the CNIL, France Num and the CPME (a small business federation) publish four free guides for very small and small businesses (in French), including one on precautions for use, which work well as training material.
The pitfalls
- Banning all AI. Staff are likely to use it anyway, with their personal accounts. The CNIL warns against ignoring these undeclared uses (“shadow IT”), which often point to an unmet need.
- A policy with no list of tools. “Use AI with caution” tells nobody anything.
- Forgetting HR uses. The AI Act bans AI systems that infer a person’s emotions in the workplace, except for medical or safety reasons (Article 5), and classes screening job applications or assessing staff among high-risk uses.
- Never reviewing it. Providers’ plans and the law change: put a review date in the policy, and someone in charge of it.
More guidance on data at work: the confidentiality resources.
