Writing an AI usage policy for your company (with template)

Key Takeaways: Since the EU AI Act, an AI usage policy is no longer a nice-to-have: the law requires organisations to ensure AI literacy, and a usage policy is the practical way to meet that obligation and demonstrate it. But most policy documents fail for one reason: they are too long and too legalistic, so nobody reads them. A workable AI usage policy fits on one or two pages, is written in plain language, and gives concrete examples of what is and is not allowed. This article shows what belongs in it, gives a ready-to-use template, and explains how to keep it alive.

Why you need this

There are two reasons, and both count. The first is legal: the EU AI Act requires organisations to ensure that employees use AI responsibly and competently, the so-called AI literacy obligation. A usage policy makes concrete how you meet that obligation and is your evidence that you have it covered. You can read more about the broader obligations in the EU AI Act compliance checklist.

The second reason is practical risk management. Without clear agreements, customer data and trade secrets end up in tools you have no control over, see using ChatGPT safely at work. A policy prevents this, not by banning, but by making clear what the safe route is.

What belongs in a workable policy

A good AI usage policy answers five questions, briefly and concretely.

1. Which tools are we allowed to use? Name the approved tools (for example: the business version of ChatGPT or Microsoft Copilot) and make clear that unknown or free consumer tools are not for company data.

2. Which data is and is not allowed? This is the core of the policy. Concretely: no personal data, trade secrets or source code in tools without data protection agreements. Give examples, examples are remembered, rules are not.

3. Who is responsible? Assign a single point of contact for AI questions and approvals. Without an owner, nothing changes.

4. How do we handle AI output? Set out the duty to verify: AI output is a draft, not a finished product. The employee remains responsible for what they send or publish. This prevents mistakes caused by blind trust.

5. Where can you go with questions? Make it easy and clear where employees can ask for help or permission, so they do not start improvising on their own.

A ready-to-use template

Use this structure as a starting point, fill it in with your own tools and situation, and keep it to one or two pages:

1. Purpose: why this policy exists (responsible and safe AI use).
2. Approved tools: the approved list, with a short reason.
3. What is allowed: examples of safe use (brainstorming, summarising, rewriting without sensitive data).
4. What is not allowed: examples of what is forbidden (customer data, trade secrets, source code in unsafe tools).
5. Duty to verify: you remain responsible for AI output.
6. Point of contact: who, and how to reach them.
7. Review: when the policy will be revised.

The biggest pitfall: a document nobody reads

The best policy is the one people actually follow. The biggest mistake is a long, legalistic document that disappears into a drawer, with that you comply on paper but not in practice, and that is exactly where things go wrong. Keep it short, write in plain language, use examples, and pair it with a short explanation or training. That training often qualifies for the SLIM subsidy, which lets you demonstrably get your team's AI literacy in order, see AI literacy and SLIM.

Keep it alive

AI tools and regulations change quickly. A policy you write once and forget will be out of date within a year. Agree on a fixed review moment (for example every six months), assign a single owner, and update it whenever you introduce new tools or the legislation changes. A living one-page policy is worth more than a perfect document gathering dust.

Stratalytic helps you get it sorted

We create AI policies that work in practice, not just on paper:

• Tailored: a short, concrete policy aligned with your tools and sector.
• Compliance: aligned with the EU AI Act and GDPR.
• Training: a short explanation for your team so the policy is actually followed.
• Subsidy: SLIM for your employees' AI literacy, handled as part of the work.

Schedule a 30-min intro call and we will set up a workable AI policy together.

Frequently asked questions

Is an AI usage policy mandatory? The EU AI Act requires AI literacy; a usage policy is the practical way to meet that obligation and demonstrate it. On top of that, it is sensible risk management.

What should it contain at a minimum? Approved tools, which data is and is not allowed, who is responsible, the duty to verify AI output, and where employees can go for help. Short and concrete.

How long should it be? As short as possible, one or two pages in plain language with examples. Long documents do not get read and therefore do not get followed.

How do I keep it up to date? A fixed review moment (for example every six months), a single owner, and updates whenever you introduce new tools or the legislation changes.