AI use policy for your company: a free Word template and a 5-question generator

Your employees already use ChatGPT, Claude, Copilot or Gemini, with or without your approval. An AI use policy puts the rules in writing: which tools, which accounts, which data, and what gets reviewed before it goes out. This page gives you a free Word template in ten articles, a generator that adapts the text to your company in five questions, and the legal texts behind each clause, checked on October 10, 2026.

The template is written for small and midsize businesses in France and Belgium. It reflects the amendment to the EU AI regulation published in the Official Journal on July 24, 2026.

Jump to: the Word template or the 5-question generator.

The role of an AI policy in a small business

The CNIL, France’s data protection authority, recommends it in so many words in its Q&A on generative AI of July 18, 2024: govern the use of these tools “through internal policies or charters that clearly define authorized and prohibited uses” (our translation). It adds that, depending on how the tool is deployed, you should prohibit entering certain confidential or personal data.

The EU AI Act points the same way. Its Article 4 asks companies that use an AI system to take measures to build the AI literacy of their staff. A written policy, explained in a short training session, is the simplest basis for those measures.

In a small company, the policy mostly answers practical questions. Can the sales rep paste a quote into ChatGPT? Can the assistant have a doctor’s note summarized? Who checks a translation before it goes to a client?

Without a written rule, everyone decides alone, often with a personal account.

The limits of the policy

The policy governs behavior. It leaves several other tasks open: the processing agreement with each AI provider that handles personal data on your behalf (GDPR Article 28), the impact assessment when processing carries a high risk (Article 35), updating your record of processing activities, and the rules specific to regulated professions. Our pages on AI for lawyers and AI in a medical practice cover those cases.

This template is a starting point. It does not replace advice from a lawyer or an employment law adviser, especially if you want to discipline someone for a breach.

The legal framework as of October 10, 2026

Four sources are enough to justify every clause: the EU regulation on AI (Regulation (EU) 2024/1689, known as the AI Act), the GDPR, the CNIL’s recommendations and the employment law of your country.

The AI literacy obligation, rewritten in July 2026

Article 4 of the AI Act has applied since February 2, 2025, to any company that uses an AI system in a professional setting. The regulation calls it a “deployer.” Regulation (EU) 2026/1744 of July 8, 2026, published in the Official Journal on July 24 and in force since July 27, 2026, replaced that text.

The current version says that providers and deployers of AI systems take measures to promote the development of AI literacy among their staff and the other people who operate and use AI systems on their behalf. It specifies that this obligation does not require providers or deployers to guarantee a specific level of AI literacy for any individual. The former requirement of a “sufficient level” is gone. The obligation to take measures remains.

The European Commission’s FAQ, updated on July 27, 2026, answers three questions small businesses ask. A company whose employees use ChatGPT to write ad copy or to translate is covered: they should be told about the risks specific to these tools, such as hallucinations.

No certificate is required: the company can keep an internal record of the training sessions and instructions given. No governance structure is imposed either, whether an AI officer or a committee.

Enforcement of Article 4 has been in the hands of the national market surveillance authorities since August 2, 2026. The “other people” covered by the text include your contractors and subcontractors who use AI on your behalf: the template includes them in its scope.

The other AI Act dates for a small business

Three other provisions directly affect a small company.

Article 5, in force since February 2, 2025, bans the use of AI systems to infer a person’s emotions in the workplace, except for medical or safety reasons. Analyzing a sales rep’s voice or an employee’s face to deduce their emotions falls under this ban.

Article 50(4) has applied since August 2, 2026, a date the July 2026 regulation did not move. An AI-generated image, sound or video that resembles real people, places or events and could pass for authentic must be labeled as such. AI-generated text published to inform the public on matters of public interest must be labeled too, unless it has gone through human review and a person takes editorial responsibility for it.

Systems that screen job applications, evaluate employees or decide on promotions are in principle classified as high risk (Annex III, point 4). Under the July 2026 regulation, the related obligations apply from December 2, 2027. An employer who installs one will have to inform employee representatives and the affected employees beforehand (Article 26(7)).

GDPR and CNIL rules that belong in every policy

The GDPR dates from 2016 and does not mention AI. Four of its articles still come up in any policy.

Article 28 requires a contract with each processor that handles personal data on your behalf. Article 32 requires security measures suited to the risk. Article 22 gives everyone the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects them. Article 33 sets a 72-hour deadline, where feasible, to notify a data breach to the authority.

The CNIL’s Q&A (in French) adds very concrete instructions. For non-confidential uses, a consumer service is an option if it is used with dedicated work email addresses, never personal ones, and with reuse of your data by the provider turned off where possible. Users should never share information covered by a secret, such as trade secrets, in a consumer service. The CNIL also suggests offering “template prompts” for defined tasks, training users and running regular checks.

In Belgium, the GDPR authority is the Data Protection Authority. The template cites the CNIL or the Data Protection Authority depending on your country.

Making the policy enforceable in France

A policy pinned to the wall does not necessarily bind your employees. In France, Article L1321-5 of the Labor Code treats memos and any document that sets general and permanent obligations on discipline, health or safety as an addition to the company’s internal rules (règlement intérieur). An AI policy whose breach can lead to a sanction concerns discipline and falls into this category.

Internal rules are mandatory in companies with at least 50 employees (Article L1311-2). The procedure in Article L1321-4, as updated on May 28, 2026, has three steps: an opinion from the social and economic committee (CSE), publication to employees with the text and the CSE opinion sent to the labor inspectorate, then entry into force no earlier than one month after these formalities. This version no longer mentions filing. Article R1321-2, which provides for filing with the clerk of the labor court (conseil de prud’hommes), is still in the code, though, and the Service-public fact sheet (in French) updated on May 28, 2026, still lists that filing among the formalities: do it.

In those same companies, the CSE is consulted on the introduction of new technologies (Article L2312-8). Whatever the size, Article L1222-4 forbids collecting information about an employee through a device they were not told about beforehand: if you plan to monitor the use of AI tools, say so in the policy.

Below 50 employees, internal rules are optional. The same Article L1321-5 still states that these documents remain “in any event” subject to the same rules as internal rules, and the Service-public fact sheet applies those rules to memos whatever the headcount.

To be able to sanction a breach, follow the same procedure: CSE opinion if there is one, notice to the labor inspectorate, filing with the clerk, publication to employees, entry into force one month later. A signed acknowledgment of receipt proves the employee received the policy, but it does not guarantee that the policy can be enforced against them. The template offers both versions of Article 10.

In Belgium, the work rules

In Belgium, every private-sector employer must have work rules (règlement de travail, Law of April 8, 1965). Penalties and the breaches they punish are among its mandatory contents, according to the FPS Employment (in French). For a breach of the policy to lead to a penalty, it must therefore appear in the work rules.

The change goes through the works council if there is one. Otherwise, the employer posts the draft and workers have 15 days to write their comments in a register. A copy is filed with the Social Law Inspectorate (Contrôle des lois sociales) within eight days of entry into force, online if you prefer.

The AI policy template to download

The template runs to ten articles and about 1,500 words. The passages in square brackets are for you to fill in or choose according to your situation.

Download the AI use policy template (Word, .docx). The file opens in Word, LibreOffice, Pages or Google Docs. Version of October 10, 2026.

ARTIFICIAL INTELLIGENCE USE POLICY
[Company name]
Version [1.0] of [date]. AI lead: [name, job title, email address].
maccus.fr template, version of October 10, 2026. This template is a starting point to adapt to your company; it does not replace legal advice.

Article 1. Purpose and scope
This policy sets the rules for using artificial intelligence (AI) tools at [Company name]. It applies to anyone who uses an AI tool on behalf of the company: managers, employees, interns, temporary workers, and the contractors and freelancers who work with our information.
In the company, these tools are used for: [writing and editing texts, translation, document summaries, replies to clients, code, visuals]. Any other use requires the approval of the AI lead.
It covers tools that generate text, images, sound or video, assistants built into the company's software (email, word processor, spreadsheet, management software), browser extensions with AI features, and connectors that give an AI tool access to our files, our email or our calendar.

Article 2. Approved tools and accounts
Only the tools listed below may be used with company information. For each one, the list states the plan subscribed to and the highest data level allowed (see Article 3).
- [Tool 1]: [free / business] plan, account provided by the company, data up to level [1 or 2].
- [Tool 2]: [free / business] plan, account provided by the company, data up to level [1 or 2].
You use these tools with an account opened under your work email address. Using a personal account for a work task is prohibited. When a tool offers to reuse your conversations to improve or train its models, that option is turned off, following the procedure provided by the AI lead.
Installing any new tool, extension or connector (access to email, calendar, shared files, management software) requires the prior written approval of the AI lead.

Article 3. The three data levels
Level 1, allowed in all the tools in Article 2: information that is public or meant to be (texts already published, online product sheets, public documentation) and texts you write without personal data or confidential information.
Level 2, allowed only in the tools marked "level 2" in Article 2, meaning tools covered by a business plan and a data processing agreement: internal documents that are not sensitive and personal data limited to what the task strictly needs, for example a client's name and work address to prepare a reply. Before submitting a document, you remove everything the task does not need.
Level 3, prohibited in every AI tool, unless the AI lead gives written authorization for a specific tool and task:
- health data, including doctor's notes for sick leave and medical certificates;
- personnel data: payroll, evaluations, disciplinary measures, job applications;
- identification numbers: social security number in France, national register number in Belgium, ID document numbers;
- bank details and card numbers;
- passwords, access codes and technical keys;
- trade secrets: non-public prices, margins, complete client files, strategy, proprietary source code;
- documents covered by professional secrecy or by a confidentiality agreement signed with a client or partner;
- [other category specific to your business].
Replacing a name with an initial does not make a document anonymous: if the person can still be recognized from the context, the document still belongs to level 2 or level 3.

Article 4. Human review and accountability
Any content produced with the help of AI is reread, checked and approved by a person before any use outside the company: sending to a client, publication, quote, contract, reply to a public authority. In particular, you check figures, dates, names, quotations and legal references, which can be wrong while looking plausible.
The person who approves content is responsible for it as if they had written it alone.
No decision that produces legal effects for a person or significantly affects them (hiring, disciplinary measure, refusal of service, individual commercial terms) is made solely on the basis of a result provided by AI.
[If your teams reply to clients with the help of AI] No reply written with AI is sent to a client without being reread by the person who signs it.

Article 5. Transparency and labels
An image, sound or video generated or altered by AI that realistically resembles existing people, places or events carries a label stating that it was generated or altered by AI.
A text generated by AI and published to inform the public on matters of public interest carries the same label, unless it has been reread and approved by a person who takes editorial responsibility for it.
When a client or partner asks whether a document was prepared with AI, you answer accurately. If a contract with a client restricts or prohibits the use of AI, that contract takes precedence.

Article 6. Prohibited uses
AI tools may not be used to:
- infer the emotions of a colleague or candidate by analyzing their voice, face or writing;
- monitor or evaluate a person who has not been informed beforehand;
- screen job applications or evaluate performance without the written approval of management and the AI lead;
- produce fake reviews, fake testimonials, or a realistic image of a person without their consent;
- submit documents the company holds no rights to, or reuse unchanged any output that reproduces an existing work;
- get around this policy: personal account, unapproved tool, copying data to a service not listed in Article 2.

Article 7. Training
Each user attends awareness training [before their first use / when they join], then [once a year]. It covers how the approved tools work and their limits, the rules of this policy and the risks specific to their job. The company keeps a record of the sessions attended (date, participants, content).

Article 8. AI lead and incidents
The AI lead, [name, job title], answers questions, approves new tools and keeps the list in Article 2 up to date.
You report to them without delay any level 3 data entered by mistake, any incorrect content that has left the company and any abnormal behavior of a tool. If personal data has been exposed, the AI lead informs [management / the data protection officer], who assesses whether it is a data breach to notify to the data protection authority (the CNIL in France, the Data Protection Authority in Belgium), where feasible within 72 hours.

Article 9. Monitoring and review
The list of approved tools is reviewed [every six months]; the whole policy is reviewed at least [once a year] and at each significant change of tool or regulation.
Any monitoring of the use of AI tools is proportionate to its purpose and brought to your attention before it is put in place.

Article 10. Status of the policy and acknowledgment of receipt
[France, company with at least 50 employees] This policy is an addition to the internal rules (règlement intérieur). It was submitted for the opinion of the social and economic committee on [date], sent to the labor inspectorate on [date], filed with the clerk of the labor court (conseil de prud'hommes) on [date], and comes into force on [date, at least one month after the publication formalities].
[France, fewer than 50 employees, informational policy] This policy is handed to each user, who acknowledges receipt.
[France, fewer than 50 employees, policy that can serve as grounds for discipline] This policy was submitted for the opinion of the social and economic committee on [date] (if there is one), sent to the labor inspectorate on [date], filed with the clerk of the labor court on [date], and comes into force on [date, at least one month after the publication formalities].
[Belgium] Breaches of this policy that can lead to a penalty are listed in the work rules (règlement de travail), amended following the procedure set by the Law of April 8, 1965.
Acknowledgment of receipt. Name: [ ]. Job title: [ ]. Date: [ ]. Signature: [ ].
"I have read this policy and agree to comply with it."

The template explained, article by article

Each clause answers a specific risk. Here is why they are worded this way and what you can change without weakening the text.

Approved tools and accounts

Article 2 sets a closed list: a tool that is not on the list is prohibited. For each tool, note the plan you pay for and the data level allowed. The work-account rule comes straight from the CNIL, which asks companies to avoid accounts opened with a personal address. If you install a local AI on a company machine, add it to this list too, with the data level it may receive.

The connector clause targets access far wider than a single chat. An assistant connected to your mailbox or your Drive reads everything in it, including your clients’ attachments. Our guide to Gmail, Drive and calendar connectors shows what a connector really sees. For other software (CRM, accounting, online store), our directory of MCP connectors for small businesses gives the access level of each connector.

Also think about the AI built into software you already approved. A system administrator reports on an online forum that their filtering tools see AI websites but not the AI features added to a team messaging app that was already installed. Those features are set in the software’s admin console and in your contract with the vendor.

The three data levels

A long list of prohibited data types is hard to read and even harder to remember. The template sorts information into three levels.

Level 1 covers what is public or written without personal data. Level 2 covers internal documents and personal data kept to the strict minimum, allowed only in a tool covered by a business plan and a contract. Level 3 stays prohibited everywhere, unless there is a written exception.

The last sentence of Article 3 corrects a common mistake. Replacing “Ms. Dupont” with “Ms. D.” in a file that mentions her address and her employer is pseudonymization: the person remains identifiable and the document is still subject to the GDPR.

Human review, decisions and labels

Article 4 takes two ideas from the CNIL: AI output can be wrong while looking plausible, and good practice is never to reuse it as is. It sets a simple accountability rule: the person who approves a text answers for it as if they had written it. On an online forum, someone who works at a nonprofit says they adopted this rule to put an end to the “the AI got it wrong” excuse.

The sentence on decisions that affect a person translates GDPR Article 22 into office language. Article 5 of the template carries over Article 50(4) of the AI Act: a mandatory label for realistic images or videos, and for informational texts published without editorial review. If you publish on social media, our article on AI slop on LinkedIn explains what changes for posts written with AI.

The list of prohibited uses

The first prohibition in Article 6 takes the AI Act’s ban on emotion recognition at work, in force since February 2, 2025, and makes it broader. The second restates Article L1222-4 of the French Labor Code. The others target practices that the providers’ usage policies also restrict, such as fake reviews. Our article on Claude’s usage policy details the Anthropic rules that change on November 12, 2026.

Training, AI lead and reviews

Article 7 provides for awareness training and a record of sessions, and the European Commission confirms that no certification is required. For a small team, a short session built on examples from its own trade is more useful than a long generic slide deck.

The AI lead in Article 8 can be the owner, the office manager or the person who already handles IT. The CNIL advises naming a point of contact to report problems. Reviewing the tool list every six months, in Article 9, keeps pace with new offers and changing terms.

The generator: your policy in 5 questions

The generator takes the template’s clauses and adapts them to your answers. Depending on your country, it cites the social security number or the national register number, the CNIL or the Data Protection Authority, and picks the right version of Article 10. Health data and personnel files always stay at level 3. If you only use free accounts, it prohibits level 2. If you check recruitment, it adds the clause on high-risk systems.

Read the generated text in full before you circulate it. The remaining square brackets flag what the generator cannot guess: the consultation dates and the signature.

Getting the team to adopt the policy

A policy adopted without explanation ends up in a shared folder nobody opens. Start by listing the tools already in use: ask everyone, without blame, what they use and for which tasks. If you are on Google Workspace, the admin console lists the third-party apps that have accessed your users' data, under Security, Access and data control, API controls, according to Google's help center.

Then present the policy in a one-hour meeting, with three examples from your own business: an allowed request, a request to rephrase after removing data, and a prohibited request. Hand out two or three template prompts for the most frequent tasks, as the CNIL suggests. If you are preparing to set up an agent connected to your tools, the guide on preparing your company for an AI agent walks through the access inventory step by step.

If some employees pay for a personal subscription that the policy now prohibits, give them time to move their useful conversations and cancel. On an online forum, an IT manager recommends a 30- to 60-day window so the policy does not feel like a punishment.

Write down the date of the session and the participants in the training record. After the first few months, ask users what works and what gets in the way, as the CNIL advises, then update the tool list.

Frequently asked questions

Does a three-person company need an AI policy?

Article 4 of the AI Act applies whatever the size of the company, as soon as it uses an AI system. A one-page policy is enough for a very small team: approved tools, prohibited data, review before sending. The generator produces a fuller text that you can shorten.

Do you have to appoint an AI officer?

No. The European Commission states that no governance structure is required to comply with Article 4. A lead named in the policy is still useful to answer questions and approve new tools.

Is the policy enough to comply with the GDPR?

The policy covers user behavior. The GDPR also requires a contract with each provider that processes personal data for you, an entry in your record of processing activities and, where the risk is high, an impact assessment. If client or employee data goes through an AI tool, deal with these three points in parallel.

Handing tasks to an assistant

Once the rules are written, you still have to choose which tasks to give an assistant and which access to grant it. If you are considering an assistant on Telegram, with connections to your tools decided case by case, tell us about your business.