Skip to content
Optim-AI

AI governance

A workplace AI usage policy: annotated template

Up to date as of 10 October 2026. An AI usage policy is a short internal document. It states which tools to use, which data must never be entered into them, who reviews the outputs and whom to ask a question. The CNIL, the French data protection authority, recommends this type of policy, setting out authorised and prohibited uses. The template below is not a model to copy: adapt each section to your tools, your data and your headcount. Have the final text reviewed by an employment lawyer before you circulate it.

Why

Why a policy

Your teams are probably already using AI tools. Banning them solves nothing: use goes underground, and is therefore no longer under control.

Since 27 July 2026, Article 4 of the EU AI Act has required companies that use these tools to take measures so that their teams understand them, with no guaranteed level and no certificate. An explained policy is one of these measures.

Finally, the company remains responsible. The CNIL points out that the organisation using the tool is generally liable for misuse by its staff.

The template

The template, section by section

  1. 1. Purpose, scope and definitions

    What goes in it
    Who the policy applies to: employees, temporary staff, contractors working for you. Which tools it covers.
    Sample wording
    This policy applies to anyone who uses, on behalf of the company, a tool capable of producing text, images, code or an analysis from a prompt.
    Pitfall to avoid
    Forgetting contractors. The EU regulation also covers people who use these tools on your behalf.

  2. 2. Authorised and prohibited tools

    What goes in it
    The list of authorised tools by name, with the type of account: business or consumer. The rule for any tool not on the list.
    Sample wording
    Only the tools listed in the appendix are authorised, with the account provided by the company. For any other tool, send your request to the policy contact before using it.
    Pitfall to avoid
    Putting the list in the body of the text. Tools change quickly: put it in an appendix.

  3. 3. Data never to be entered into a tool

    What goes in it
    The excluded categories, with a concrete example for each: personal data of customers or employees, health data, trade secrets, documents covered by a confidentiality undertaking.
    Sample wording
    Only enter into a tool information that you are authorised to share. If in doubt, remove names and figures, or ask the policy contact.
    Pitfall to avoid
    An abstract rule (“sensitive data”). Give examples from your line of work: a customer contract, a payslip.

  4. 4. Restricted or prohibited uses

    What goes in it
    The uses that require prior approval, and those that are excluded. For example: any decision concerning a person, such as screening job applications or assessing an employee.
    Sample wording
    No AI tool makes a decision on its own concerning an employee, a candidate or a customer.
    Pitfall to avoid
    Ignoring these cases. Screening job applications is classified as high-risk by the EU regulation, with stricter obligations from 2 December 2027.

  5. 5. Human review and responsibility

    What goes in it
    Who reviews what, depending on what is at stake. The rule that does not change: the author of a document remains responsible for it, whatever tool was used.
    Sample wording
    Any content produced with the help of a tool and intended for external use is reviewed by a person who takes responsibility for it.
    Pitfall to avoid
    Requiring everything to be reviewed. The rule becomes unworkable. Classify uses by what is at stake.

  6. 6. Ownership and confidentiality of content

    What goes in it
    The terms of the chosen providers: is your data used to train their models? Where are the exchanges stored?
    Sample wording
    Content produced in the course of work belongs to the company on the same terms as any other work document.
    Pitfall to avoid
    Promising a protection that the provider's contract does not provide. The legal regime for rights in AI-generated content is not settled.

  7. 7. Transparency towards customers

    What goes in it
    What you tell customers about your use of AI. The cases where their consent is needed, for example before processing their documents.
    Sample wording
    Before processing a document supplied by a customer with an AI tool, check that the contract allows it.
    Pitfall to avoid
    Forgetting your existing commitments: some contracts already prohibit disclosure to a third party. Since 2 August 2026, the EU regulation also requires you to disclose manipulated content (“deepfakes”) that you distribute.

  8. 8. Policy contact and question process

    What goes in it
    The name of the policy contact, how to reach them, how quickly they reply. How to report an error or an incident without fear of sanction.
    Sample wording
    Any question about a tool or a use goes to [name of the policy contact], who replies within [timeframe]. Reporting an error is never sanctioned.
    Pitfall to avoid
    Naming a committee. A named person answers. A committee passes the question on.

  9. 9. Training and awareness

    What goes in it
    What the company puts in place so that everyone understands the tools: how they work, their limits, the rules in the policy.
    Sample wording
    Every user attends a presentation of the authorised tools and of this policy before first use.
    Pitfall to avoid
    Talking about “mandatory training”. The EU regulation asks for measures, not a certificate. Keep a written record of what has been done.

  10. 10. Review of the policy

    What goes in it
    Who reviews the policy, how often, and on what occasions: a new tool, an incident, a change in the law.
    Sample wording
    The policy is reviewed every year by the policy contact and management. The appendix of tools is updated with every change.
    Pitfall to avoid
    Amending the body of the policy without going back through the procedure that made it enforceable.

Procedure

Making the policy enforceable

A policy circulated by email informs. On its own, it does not allow you to sanction a breach.

Inform employees, in all cases. Whatever the headcount, no information concerning an employee personally may be collected by a system they have not been told about beforehand (Article L1222-4 of the French Labour Code). If you monitor the use of tools, say so in the policy.

Consult the CSE. In companies with at least 50 employees, the works council (comité social et économique, CSE) is informed and consulted on the introduction of new technologies (Article L2312-8). Consult it before AI tools are deployed, not afterwards. Below this threshold, employees must still be informed beforehand.

Attach the policy to the internal regulations. Internal regulations (règlement intérieur) are mandatory from 50 employees (Article L1311-2). A document containing general and permanent obligations may be treated as an addition to the internal regulations, and follow the same procedure (Article L1321-5). That procedure is as follows (Article L1321-4):

  • the opinion of the CSE;
  • communication to the labour inspector, together with that opinion;
  • entry into force at least one month after the rules have been made known to employees.

Since the law of 26 May 2026, filing with the registry of the employment tribunal (conseil de prud'hommes) is no longer a condition for entry into force.

Have this choice and the final text validated by an employment lawyer.

Support

What Optim-AI does

In the audit. The countermeasures plan includes AI usage rules, written to be read and ready to be attached to the company's internal regulations. They start from the uses identified during the audit. The attachment procedure remains yours.

In a separate AI awareness engagement. A two-hour session for your management committee, using your real cases. We provide a written report, the materials presented and a short assessment questionnaire before and after the session. It is one of the possible measures under Article 4 of the EU regulation, not the only one.

Frequently asked questions

Questions from business leaders

Is an AI usage policy mandatory?
No text requires a policy under that name. Since 27 July 2026, however, the EU AI Act has required companies that use these tools to take measures so that their teams understand them. The CNIL recommends an internal policy. An explained, dated policy meets both expectations.
Do you need to consult the CSE before circulating the policy?
In a company with at least 50 employees, the works council (CSE) is informed and consulted on the introduction of new technologies (Article L2312-8 of the French Labour Code). If the policy is attached to the internal regulations, its opinion is also required before entry into force (Article L1321-4). Below 50 employees, these two consultations do not apply in this form. In all cases, no information concerning an employee may be collected by a system that has not been brought to their attention beforehand (Article L1222-4).
Can you sanction an employee who does not follow the policy?
Only if the rules have been made enforceable. In practice, they must be attached to the internal regulations following the applicable procedure. A policy that has simply been circulated does not, on its own, justify a sanction. Have this point checked by a lawyer.
What should an AI policy cover first?
Three sections are enough to start: the list of authorised tools, the data that is never entered, and the name of a policy contact who answers questions. A short policy that is applied protects better than a complete text that nobody reads.

Sources

The texts consulted

Page up to date as of 10 October 2026. It does not replace the advice of an employment lawyer.

AI audit for SMEs and mid-sized companiesIdentify actual uses before writing the rules.The EU AI Act for an SMEWhat the EU regulation requires, date by date.Shadow AIIdentify and govern undeclared uses.Executive committee AI awarenessA two-hour session, using your real cases.Risks and controlThe five risks and the four governance rules.The methodHow usage rules fit into the countermeasures plan.

Next step

Write your usage rules from your actual uses

The first conversation lasts thirty minutes, with no commitment.

Book 30 minutesTake the AI maturity test