AI policy in business: why and how to write it

AI policy in business: why and how to write it

A company AI policy is the document that sets out which AI tools your teams may use, with which data and under what oversight. You write one for three reasons: to protect data, to keep control over quality, and to be able to prove a framework exists if there is an inspection or an incident. Allow four to six weeks, including consultation of the works council (CSE) in France.

Many SMEs approach the topic from the wrong end: they download a template, customise it in an afternoon and send it round by email. Three months later, nobody has read it and nothing has changed. The text itself matters less than how it was built: who was consulted, which decisions were made, and in what legal form it was issued. This article focuses on that process. If you want a ready-to-adapt text, our free AI policy template provides one in full. For the bigger picture, see our guide to AI in business for SMEs.

Why write an AI policy now

Because your employees already use AI, and without written rules, everyone follows their own. According to the INSEE ICT survey (Insee Première no. 2120, published in 2026), 18% of French companies with 10 or more employees reported using at least one AI technology in 2025, up from 10% a year earlier. That figure only covers usage declared by the company. It does not count the sales rep rewording follow-up emails in a free assistant, or the HR assistant pasting an interview summary into one.

That is where the real risk lies for an SME. Not in a science-fiction scenario, but in very ordinary situations:

• customer or employee data entered into a tool whose terms allow the content to be reused;
• a quote, contract or customer reply sent with a factual error generated by the tool (a hallucination) that nobody checked;
• marketing content published without knowing who owns the rights;
• a customer asking whether their exchanges were processed by AI, and a company unable to answer.

On the regulatory side, three sets of rules overlap. The GDPR applies as soon as personal data goes into a tool. Regulation (EU) 2024/1689, the AI Act, imposes transparency obligations in certain cases (Article 50) and, in Article 4, provides for staff training efforts. And French labour law governs how you can impose rules on employees. We cover how the first two fit together in our article AI Act vs GDPR.

A recent development: Regulation (EU) 2026/1744, known as the "AI Omnibus", entered into force on 27 July 2026. According to the European Commission, it simplifies the AI literacy requirement that applied to companies and gives the Commission and Member States a stronger role in promoting it. That does not remove the case for an AI policy. Without a written document, you can neither sanction a dangerous practice nor show a customer or an insurer that you have put a framework in place.

Policy, charter or internal regulations: which format to choose

The name of the document matters little; what counts is the procedure followed to make it binding on employees. An AI policy containing prohibitions backed by sanctions is, legally, a disciplinary rule. French labour law reserves such rules for the internal regulations (règlement intérieur) and the service notes that supplement them.

The official Service-Public page on internal regulations sets out three useful points:

• they are mandatory from 50 employees, reached over 12 consecutive months;
• the CSE must be consulted, otherwise the regulations cannot be enforced against employees;
• service notes containing general and permanent disciplinary obligations follow the same procedure, whatever the size of the company.

The full procedure includes filing with the labour court registry, making the text available to staff, sending two copies to the labour inspectorate together with the CSE's opinion, and an entry into force at least one month after these formalities.

This table summarises the general framework under French law. Edge cases (multiple sites, a specific collective agreement) warrant advice from an employment lawyer before the document is issued.

A common trap: a purely "educational" policy sent by email is useful for guiding teams. But it will not allow you to sanction someone who copied the customer file into an unauthorised tool. If you want some rules to be binding, plan the procedure from the start, not after the first incident.

Finally, if you have a CSE in a company with at least 50 employees, Article L2312-8 of the French Labour Code requires it to be consulted on the introduction of new technologies. Rolling out AI tools across a department may fall within that scope, regardless of the policy itself.

Who should take part in drafting

An AI policy written by a single person is almost always unworkable: it misses either real-world usage or legal constraints. In an SME, the working group is four or five people:

• a member of senior management, who makes the calls and owns the document;
• the AI lead, if there is one, or whoever knows the tools best (we explain the role in our article on appointing an AI officer);
• the person responsible for GDPR, internal or external DPO, for anything involving personal data;
• the IT manager or provider, to check the rules are technically workable (business accounts, blocking, logging);
• two active users from different departments, so the text matches actual tasks.

The CSE is not part of the working group, but it pays to inform it early. Presenting the approach at a meeting before submitting the text avoids it discovering a finished document and seeing it as a surveillance tool.

The six-week method

An AI policy is built in four stages: inventory, decisions, drafting and testing, then consultation and rollout. Here is the timeline we see in SMEs of 20 to 150 employees.

Weeks 1 and 2: the inventory. An anonymous questionnaire to the whole team (tools used, frequency, types of data entered), three or four interviews with the most active users, and a list of subscriptions already paid for, including through expense claims. This overlaps with an AI audit; if you have already done one, start from its findings. Our article on the AI audit for SMEs details the method.

Week 3: the decisions. The working group settles the seven questions set out in the next section. This is the most important step, and the one most often rushed.

Week 4: drafting and testing. Draft from a template, then test the text against real cases (see below). Aim for four pages at most, with concrete examples of permitted and prohibited uses.

Weeks 5 and 6: consultation and rollout. CSE consultation if you have one, filing and publication formalities if the text contains disciplinary rules, then a presentation to teams. If the internal regulations procedure applies, add the one-month delay before entry into force.

For a micro-business without a CSE, the timeline shrinks to two or three weeks. The company's AI maturity also plays a part: the more scattered the usage, the longer the inventory takes.

Seven decisions to make before you write

Writing is not the hard part; deciding is. Each question below needs a clear answer, approved by management, before the first line of the document.

1. Which tools are authorised? Name them, with the plan (free, Pro, Team, Enterprise). A rule such as "tools approved by IT" tells an employee nothing.
2. Personal or business accounts? Most SMEs end up banning personal accounts for work use. That means paying for licences: a real budget decision, which we cost out in our article on how much AI costs an SME.
3. Which data can go into which tool? Three levels are usually enough: public, internal, confidential or personal. Each authorised tool gets a maximum level.
4. Who checks what? Any content sent outside (customer, supplier, public authority) must be reviewed by someone who takes responsibility for it. Specify this by document type.
5. When should customers be told? A chatbot on your website, an email written by an automated agent, a generated image: decide what is disclosed and how. Our article on the AI information notice helps frame this.
6. Who requests a new tool, and from whom? Without a simple request process, teams work around the policy. A response within eight working days is a good target.
7. What happens in an incident? A data leak, an error sent to a customer: who to alert, how fast, and who assesses whether the CNIL must be notified under the GDPR.

These decisions depend on your context. An accounting firm will not answer question 3 the way a communications agency does. That is why a template, however good, cannot replace this step.

Test the text against ten real situations

Before publishing the policy, run it against ten situations drawn from your inventory and check it gives a clear answer to each. Online templates never include this step, and it is what separates a document people read from one they ignore.

Examples of situations to test:

• "I want to translate a customer contract into English with an AI assistant."
• "I want to summarise the notes from an annual review."
• "I want to generate an image for a LinkedIn post."
• "A customer sends me a spreadsheet of 3,000 contacts to clean up."
• "I want to install a browser extension that summarises emails."

For each situation, three members of the working group read the policy and answer separately: allowed, prohibited, or allowed with conditions. If the answers differ, the rule is badly written. Rephrase and try again. In practice, a first draft rarely passes more than six situations out of ten.

Rolling out the policy and keeping it alive

An AI policy that is neither explained nor reviewed goes out of date within six months, given how fast the tools change. Three actions make the difference at rollout:

• a one-hour presentation per team, focused on everyday situations rather than reading the text;
• a one-page summary to keep at hand, listing authorised tools and the three data levels;
• a single address or channel for questions and incident reports.

Training is part of the rollout. A policy that bans entering personal data is useless if employees cannot recognise personal data in a spreadsheet. Our article on AI Act Article 4 covers expectations around staff training, to be read in light of the July 2026 AI Omnibus.

Then plan a review every six months, or whenever a major new tool arrives. Keep a short log of requests received and incidents: it is your best evidence that the policy is applied. The usage indicators you track to measure AI ROI in your SME can feed into this review.

Keep in mind that the policy sits within a wider approach. It corresponds to the "rules framework" step described in our article on AI adoption in SMEs: it comes after the inventory and before the pilot, not instead of either.

Frequently asked questions

Is an AI policy mandatory?

No law requires a document called an "AI policy". However, the GDPR requires processing of personal data to be documented, the AI Act imposes transparency obligations in certain cases, and French labour law requires a specific procedure for any disciplinary rule. An AI policy is the simplest way to meet all three in a single document.

What is the difference between an AI policy and an AI charter?

In practice, both terms often refer to the same document. Some companies use "policy" for the strategic document approved by management and "charter" for the set of rules aimed at employees, appended to the internal regulations. What matters is the procedure followed, not the title.

Do you need to consult the works council (CSE)?

Yes if the document contains general and permanent disciplinary obligations and you have a CSE: without consultation, these rules cannot be enforced against employees. In companies with at least 50 employees, rolling out AI tools may also require consultation on the introduction of new technologies.

How long does it take to write an AI policy?

Four to six weeks in an SME with a CSE, two to three weeks in a micro-business. Add one month before entry into force if the internal regulations procedure applies.

Can you sanction an employee who breaks the AI policy?

Only if the policy went through the internal regulations procedure (CSE consultation, filing, publication, sending to the labour inspectorate) and the sanction is provided for in the internal regulations. A policy simply sent by email guides practice but cannot ground a disciplinary sanction.

Should free AI tools be banned?

Not necessarily for every use. Many SMEs allow free tools for public data (rewording a text already published, brainstorming) and ban them as soon as internal or personal data is involved. The rule must be easy to apply without reading the terms of use of every tool.

Who should own the AI policy in an SME?

Senior management approves and signs it. Day-to-day follow-up falls to the AI lead, who answers questions, handles requests for new tools and prepares the six-monthly review.

How GrowthPerf helps

GrowthPerf is a Qualiopi-certified training provider that helps SMEs and nonprofits put a framework around their use of AI. We run the decision workshop (the seven questions above), help test the text against your real situations and train teams at rollout. Our AI for business training includes a module on usage rules, and our operational AI training puts the policy into practice on each department's tasks. We do not replace your lawyer on the employment law side: we prepare the substance, they secure the form.

For the full picture, see our complete guide to AI in business for SMEs. And to start from a base text, get our free AI policy template, then book a 30-minute call with us to adapt it to your context.