AI policy for companies: how to write one that works

An AI policy (a charte IA in French companies) is the internal document that tells your employees which AI tools to use, which data to put into them and which rules apply to agents. It is not mandatory, but the CNIL recommends one. To make it useful, start from real usage, aim for two pages and decide upfront whether it belongs in your internal rules. You will find a complete sample policy below, to adapt.

This article presents a method and is not legal advice. Have your policy reviewed by an employment lawyer, especially if it provides for sanctions. It describes French law.

Is an AI policy mandatory?

No, no text requires a document called an "AI policy". Three sources still make it very useful:

• The CNIL (Commission nationale de l'informatique et des libertés, the French data protection authority) recommends governing the use of generative AI through internal policies or charters that clearly define permitted and prohibited uses. It gives two examples of prohibitions: providing personal data to the system, or delegating decision-making to it (CNIL Q&A, 18 July 2024, in French).
• The EU AI Act (Regulation (EU) 2024/1689), in its Article 4, asks companies that use AI systems to take measures to develop their staff's AI literacy. Regulation (EU) 2026/1744, in force since 27 July 2026, reworded it: the obligation now concerns the means put in place, without requiring a specific level of competence to be guaranteed. In practice, you are expected to take action, such as training and setting rules. A policy combined with training is part of that.
• The GDPR, the European regulation on personal data, requires you to keep control of the personal data processed by your tools. The policy is where you say which data can go into which tool.

The policy is part of the "governance and compliance" step of our method, just before consulting the works council (CSE, comité social et économique, the body that represents employees).

Why isn't an AI-generated policy enough?

Even when AI is connected to the company's tools, it does not decide for you what is confidential, what belongs in the internal rules or what agents are allowed to do. Among the policies we review, many come from ChatGPT or from a template found online, and they share the same flaws:

• They stay vague about data. "Do not share confidential information" doesn't say whether a quote, a product plan or a supplier file is confidential.
• They borrow disciplinary vocabulary. "Sanctions", "breach", "obligation to": these words can turn the policy into an addition to the internal rules, with a procedure nobody has started (see the next section).
• They are too long. Beyond two or three pages, the policy becomes hard to consult when opening the tool.
• They ignore agents, the AI assistants that can act in your software (send an email, edit a customer record). Nothing on who may create them, share them or connect them to your tools.

A template is still a good starting point. The Canton of Geneva publishes a free one, with a questionnaire to map current usage (Canton of Geneva AI policy template, in French), and you will find our sample below. The work that matters is adapting it to what actually happens in your company.

Good-practice policy or internal rules: which should you choose?

An AI policy without sanctions is a good-practice policy: it can be circulated without following the internal rules procedure. As soon as it sets general and permanent disciplinary obligations, it becomes an addition to the internal rules (règlement intérieur, the document that sets the company's rules and disciplinary sanctions) and follows their procedure. So choose the status before you write.

The French Labour Code says so: service notes or any other document containing general and permanent obligations in the matters covered by the internal rules, including discipline, are additions to those rules (article L. 1321-5, article L. 1321-1, in French). They follow the same procedure: the CSE's opinion, filing with the labour inspectorate, and entry into force no earlier than one month after the filing and publicity formalities (article L. 1321-4, in French). Internal rules are mandatory from 50 employees (article L. 1311-2, in French).

Our position: start with a short good-practice policy, and keep the internal rules for the few prohibitions that justify it (health data, trade secrets, decisions about people). Have this choice validated by your lawyer.

Do you need to consult the CSE on an AI policy?

Yes in two cases, in a company of 50 employees or more. First, if the policy sets general and permanent disciplinary obligations: as an addition to the internal rules, it requires the CSE's opinion. Second, if it accompanies the introduction of AI tools that change working conditions, a consultation case set by article L. 2312-8 of the Labour Code (in French). This second case also applies to a good-practice policy.

In the case decided by the Paris Court of Appeal on 21 May 2026 (judgment no. 25/13234), the employer had authorised ChatGPT under a policy and deployed an internal assistant. The court held that it had introduced a new technology, which required consulting the CSE (Paris Court of Appeal judgment, in French). Plan to include your policy in the file presented to the CSE, covered in our article Works council (CSE) and AI: your obligations before deploying.

How do you write your AI policy, step by step?

Writing an AI policy takes seven steps: mapping usage, classifying data, listing approved tools, setting rules for agents, choosing the status and preparing the CSE, writing a short text reviewed by users, then circulating it with training. Each step has an owner:

1. Map real usage (the IT director, with managers). A short questionnaire to teams, completed by what IT can see: connections to AI tools, subscriptions claimed as expenses. The policy starts from what exists, without looking for someone to blame. This is the topic of shadow AI, the use of AI tools not approved by the company.
2. Classify your data into four levels (the data protection officer, or DPO, with legal). For example: public, internal, confidential, and personal or sensitive data. For each level, give three examples from your business.
3. List the approved tools and what each one is for (IT director). For each tool: authorised accounts, accepted data levels, connections to internal software. For a consumer service, the CNIL asks to avoid creating accounts with personal email addresses (CNIL Q&A, in French).
4. Set the rules for agents (IT director). Who may create them, share them, connect them to business software. A rule we have applied since an incident during a pilot (the trial phase): no write access to the ERP (management software) or CRM (customer relationship software) without prior approval.
5. Choose the policy's status and prepare the CSE (legal, HR director). Good-practice policy or addition to the internal rules, and a consultation schedule if needed.
6. Write it short and have three users review it (IT director, with business champions, volunteer users who carry usage in their team). If a salesperson or an accountant doesn't know, after reading it, what they are allowed to do the next day, rewrite it.
7. Circulate it with training and appoint someone to keep it up to date (HR for circulation, IT for updates). Review the policy with each new tool or feature, without waiting for the annual review.

What should an AI policy contain? (template outline)

An AI policy contains eight sections: its purpose, approved tools, data allowed per tool, prohibitions, human review, rules for agents, the point of contact and the version date. Aim for two pages. Here is the outline, with sample wording for each section:

1. Purpose and scope. "This policy applies to all employees and contractors who use an AI tool on behalf of the company."
2. Approved tools. "The approved tools are [tool A] for [use] and [tool B] for [use], accessible with your work account only."
3. Data. "Public and internal data may be used in [tool A]. Customers' personal data is not entered into it."
4. Prohibitions. "It is prohibited to delegate a decision about a person to AI (recruitment, appraisal) or to publish generated content without review."
5. Human review. "You remain responsible for what you produce with AI: check figures, sources and names before sharing."
6. Agents. "Any agent connected to company software is approved by IT before being shared."
7. Point of contact. "Your questions: [AI lead, the person in charge of answering AI questions], office hours on [day]."
8. Version. "Version of [date], maintained by [name]."

What does a complete AI policy look like? A sample

Here is a sample good-practice AI policy, without sanctions, for a fictitious company that has deployed two tools. It fits on two pages. Adapt the tools, data examples and contacts to your company, and have it reviewed by your lawyer before circulating it.

AI usage policy — [Company]

1. Purpose. This policy helps every employee use AI at work while protecting the data of the company, our customers and our colleagues. It applies to all employees, interns and contractors who use an AI tool on behalf of [Company].

2. Approved tools. We provide: Microsoft 365 Copilot, for writing, meeting notes and emails; [agent platform], for business agents connected to our data. Use them only with your work account. For any other tool, ask IT first.

3. Data. Our data is classified into four levels:

• Public (website, brochures): all approved tools.
• Internal (meeting notes, procedures, project documents): all approved tools.
• Confidential (quotes, contracts, purchase prices, product plans): only in the dedicated spaces of [agent platform].
• Personal or sensitive (payroll, HR files, health data, customers' personal data): never in an AI tool, except an agent approved by IT and the DPO.

4. What we ask you not to do. Use a personal account (ChatGPT, Claude, Gemini…) for company work; delegate a decision about a person to AI (recruitment, appraisal, sanction); publish or send a customer generated content without reviewing it.

5. Human review. You remain responsible for what you produce with AI. Check figures, sources, names and tone before sharing anything.

6. Agents. You may build agents for your own use. Before sharing an agent with your team, have it approved by your manager. An agent that writes to company software (ERP, CRM) must be approved by IT.

7. Your questions. Your AI lead: [name]. Office hours every [day], from [time] to [time], and the [channel name] channel in Teams.

8. Version. Version of [date], maintained by [name, role]. It changes with each new tool.

This sample is deliberately short and without sanctions: it can be circulated without the internal rules procedure. If it accompanies the rollout of new tools, remember to consult the CSE.

Who does what, and how much time should you plan?

Writing the policy takes a few workshops. What lengthens the schedule is the procedure: if the policy goes into the internal rules, allow for the CSE's opinion, given as a rule within one month (article R. 2312-6, in French), then one month after the formalities before it comes into force. Build these periods into the project from the scoping phase.

Which mistakes do we see in the field?

The three situations below come from pilots and deployments run by Idoption.

Prohibiting without offering another tool

During a pilot at a food-industry manufacturer, an advanced user was testing their prompts with their personal Claude account. A ban would have changed nothing. We showed them that the same models were available in the approved platform.

Takeaway: each prohibition in the policy works better when it names the tool to use instead.

Forgetting agents

During another pilot, an agent sent an unsolicited email to a customer. The rule on write access to the ERP and CRM came from that incident.

Takeaway: a policy limited to conversations with an assistant misses the fastest-growing uses.

Underestimating adoption

In another deployment, employees created several hundred agents within a few weeks. Rules for sharing, editing and approval had to be added.

Takeaway: write these rules as soon as the first agents are created.

When should you adapt this method?

• Fewer than 50 employees. Internal rules are not mandatory: a one-page policy and a team subscription are often enough.
• Data subject to strong sovereignty requirements (regulated sectors, public-sector clients). The policy follows the choice of hosting and models. For personal or sensitive data, the CNIL considers it "generally more appropriate and more secure" to favour on-premise deployment, on your own servers (CNIL Q&A, in French).
• A group with several subsidiaries. A common group policy, local versions, and a legal analysis per entity for the CSE.

And after the policy?

A policy takes effect when teams have approved tools and know how to use them. Next come the CSE consultation, training and deployment, described in our method and illustrated by our client cases. Your teams stay in control.

To write your policy from your real usage and prepare the CSE file at the same time, contact us.

Sources: CNIL, Q&A on using a generative AI system · French Labour Code (Code du travail numérique), articles L. 1311-2, L. 1321-1, L. 1321-4, L. 1321-5, L. 2312-8, R. 2312-6 · Paris Court of Appeal judgment of 21 May 2026 · Regulation (EU) 2026/1744 · Canton of Geneva AI policy template (accessed 25 October 2026). Sources are in French except the EU regulation.