An AI policy template is a ready-to-use document that sets rules for how your team can use AI tools at work. It covers which tools are approved, what data can never go into them, and what happens if someone breaks the rules. Fill it in once, and it becomes your company’s AI usage policy.
Most companies need this more urgently than they realize.
A 2026 SHRM survey found that 76% of employees use personally sourced AI tools for work, while only 21% say their employer has given them clear guidance for their role. Worker access to AI tools grew by half in a single year, according to Deloitte’s State of AI in the Enterprise report.
An AI usage policy closes the gap between how much AI your team already uses and the little guidance most companies provide. In this guide, I’ll cover what to include in an AI policy, what you can skip if you’re a smaller company, and a free template you can copy today.
An AI policy template is a prewritten document that you adapt for your company instead of starting from a blank page. Once you fill in your specific tools, rules, and owner, it becomes your actual AI usage policy, the document employees read and follow.
The naming here gets confusing, so it’s worth clearing up. Some companies refer to the finished document as an AI usage policy. Others call it an AI acceptable use policy, a corporate AI policy, or a generative AI policy template, since generative tools like Claude and ChatGPT are usually the target of these rules. These are different names for close to the same thing: a written answer to the question, what am I allowed to do with AI at this company?
Whichever name you use, the document tells employees which AI tools they can use at work, what they can and cannot do with those tools, and what happens if they break the rules.
Without one, every employee makes their own judgment call. Some will be cautious. Others will paste a client contract into a public chatbot to save ten minutes. A policy replaces guesswork with a shared standard.
Here’s what that looks like in practice. One person on your team might refuse to use AI tools at all, worried about making mistakes. Someone else on the same team might already be using three different tools daily, including one nobody else has heard of. Neither person is doing anything malicious. They’re just filling a gap with their own best guess, and those guesses rarely match. A policy is what makes the standard the same for both of them.
You don’t need a legal department to justify writing this policy. You need the same three things any small company already looks after: your data, your reputation, and your team’s time.
The data risk is real and already happening. A 2026 survey by Wakefield Research for PagerDuty found that 43% of office professionals had entered work correspondence into public AI tools outside their company’s own systems, and close to a third had shared customer or financial data with those tools. None of this required bad intent. It happened because nobody told them not to.
The guidance gap is just as real. In the same study, more than half of employees said their employer provides no AI tools at all or only free public versions, leaving people to find and use tools on their own.
Without a policy, that gap gets filled by whatever each person decides individually, which rarely lines up team to team. A single company AI policy, even a short one, closes that gap for everyone at once.
There’s a compliance angle too, even for companies without a legal team. A growing number of US states now have laws covering AI use in employment decisions. SHRM’s research found that most HR professionals working in those states didn’t know the laws existed.
You don’t need to become an expert in AI regulation. You do need a document that shows you took a first, reasonable step.
There’s also a leadership gap worth naming directly. The same SHRM research found that legal and compliance functions lead AI governance at most companies, while HR is rarely involved directly.
At a growing company, you likely don’t have a separate legal team handling this at all, which means the job defaults to whoever’s willing to own it, usually a founder or an ops lead. That’s not a downside. It just means this policy is a leadership decision, not something to wait on someone else to write.
A good policy doesn’t need to be long. It needs to cover six things clearly.
| Section | What It Covers | Why It Matters |
| Purpose and Scope | Who the policy applies to and which tools it covers | Sets expectations before anything else |
| Approved Tools | Which AI tools are okay to use, and for what | Removes guesswork, tool by tool |
| Data Handling | What company or customer data can never go into an AI tool | Protects the information people don’t think to protect |
| Acceptable Use | What tasks AI can help with, and which ones need a human check first | Prevents AI from making decisions it shouldn’t |
| Consequences | What happens if someone ignores the policy | Makes the policy real, not just a suggestion |
| Review Schedule | How often the policy gets revisited | Keeps the document from going stale as tools change |
Six sections cover almost everything a growing company actually needs. If a section doesn’t change how someone behaves day to day, it probably doesn’t belong in your policy.
This is an AI policy for companies without a legal department, not a framework designed for enterprise compliance teams.
Some AI policy guides for large companies recommend involving legal, compliance, audit, and ethics teams, as well as external regulators and community representatives, before publishing anything. If your company doesn’t have a legal department, that advice isn’t useful. It’s a reason to never finish the policy at all.
A growing company doesn’t need a governance committee to write an AI usage policy. It needs one person to own the document, a short list of approved tools, and a few plain rules about data. You can add more structure later if you actually need it. Most companies at this size never do.
If you’re worried about missing something important, a short list beats a long framework. Every rule in your policy should answer a question an employee could actually ask this week. If it doesn’t, cut it.
Writing a policy is the easy part. Here’s where most companies lose the plot.
Copy the template below and adjust it for your company. Replace anything in brackets with your own details.
A quick note before you fill it in. Don’t leave the Approved Tools section vague. Naming specific tools, even just two or three to start, is what makes the rest of the policy enforceable. A policy that says use AI responsibly without naming a single approved tool gives your team nothing to actually follow.
Purpose and Scope
This policy explains how employees at [Company Name] can use AI tools for work. It applies to all employees, contractors, and anyone using AI tools on the company’s behalf.
Approved Tools
The following AI tools are approved for work use: [list your tools, for example Claude or ChatGPT]. Employees should not use AI tools outside this list for work tasks without checking with [name or role, for example your manager or IT lead] first.
Data Handling
Do not enter the following into any AI tool: customer personal information, financial records, unreleased product details, employee personal data, or anything covered by a signed confidentiality agreement. When in doubt, leave it out.
Acceptable Use
AI tools can help with drafting, summarizing, research, and repetitive tasks. AI-generated content should be reviewed by a person before it’s sent to a customer, published publicly, or used in a hiring or performance decision. AI should support judgment, not replace it, for anything that affects a real person’s outcome.
Consequences
Employees who use AI tools outside this policy, especially around data handling, may face [describe your company’s actual process, for example a conversation with their manager or a formal warning, depending on severity].
Review Schedule
This policy will be reviewed every [three or six months, pick what’s realistic], or sooner if the company adopts a major new AI tool.
Owner: [Name and role]
Last updated: [Date]
A policy only works if people actually read it and remember it exists. Here’s how to make that more likely.
A written policy is a start. The harder part is keeping it true to what’s actually happening across your team and having a real way to enforce the sections that matter most. This is where Thrivea’s AI Workforce module connects directly to the template above.
The Approved Tools section of your policy is only as good as your ability to know what’s actually approved. Thrivea’s AI Administration capability lets a company connect its AI providers, such as Anthropic or OpenAI accounts, at the company level and manage which specific tools are approved.
Instead of the approved tools list living as a static paragraph that goes out of date the moment someone adopts something new, it becomes something you can actually see and update.
The Acceptable Use section usually depends on different teams having access to different tools. A developer might need an advanced coding assistant. Someone in marketing needs content and research tools. Someone in finance might need neither.
Thrivea’s AI Access Management lets you assign tools directly by role or team, so the policy’s rules about who can use what are backed by actual permissions, not just a sentence employees are expected to remember.
The Data Handling and Consequences sections cover risks you often cannot see until they become problems. Thrivea’s AI Usage and Cost Control provides visibility into spending and usage by employee and by tool.
This also surfaces the kind of unmanaged, unapproved tool use that a policy alone cannot catch. If a tool your policy never approved is quietly costing money or handling data, this is where it shows up.
None of this replaces the policy itself. The document still matters, and your team still needs to read it. What changes is that the policy stops being the only thing standing between your rules and what people actually do.
Thrivea’s free AI Tool Inventory is the natural starting point because it answers the most basic question underneath all of this: What AI tools does your company actually use right now?
Most AI policies get written once and forgotten. The problem usually isn’t the writing. It’s that nobody owns what happens after, and the list of approved tools it references keeps moving while the document stays still.
A useful habit is to treat the policy and your actual tool list as the same living thing, not two separate efforts. When someone asks to adopt a new AI tool, that’s the moment to update both the approved list and, if needed, the policy language itself. Companies that treat these as one habit instead of two rarely end up with a policy that’s embarrassingly out of date a year later.
Your team is already using AI. The only real question is whether they’re doing it with a shared, written standard or making it up individually as they go.
Copy the template above, cut anything that doesn’t apply to your company, and send it to your team this week. That’s a more useful policy than a long one nobody reads.
What’s the difference between an AI usage policy and an AI acceptable use policy?
Not much in practice. Both describe the same kind of document: written rules for how employees can use AI at work. Some companies use one term, some use the other. A few call it a generative AI policy instead. Pick whichever name fits how your team already talks about it.
Does a small company really need an AI policy?
Yes. The risk isn’t company size. It’s whether your team is already using AI without any shared rules, which is true for almost every company right now, regardless of headcount.
Who should own AI usage policy?
Usually a founder, an operations lead, or whoever already owns tools and IT decisions at a growing company. It doesn’t need to be a committee. It needs to be one person who’s responsible for it.
How often should we update it?
Every three to six months is reasonable for most growing companies, or immediately after adopting a major new AI tool. If your policy still lists tools your team stopped using a year ago, that’s a sign it’s overdue.
Can we just use a template from somewhere else?
You can start from one. Just make sure it’s actually short enough that people will read it, and specific enough to your company that it answers real questions your team has this month, not generic advice written for a much bigger organization.
Are there AI policy examples I can look at first?
The template in this guide is built to work as a sample AI policy on its own. Fill in the brackets with your company’s details, and it’s ready to send to your team. You don’t need to review several AI policy examples first. Most of the differences between companies come down to which tools are approved and what data rules apply, both of which the template already prompts you to fill in.
HR workflow automation uses software to move multi-step HR processes, such as approvals, forms, task handoffs, and employee data updates, through the ...
AI governance sounds like something built for Fortune 500 companies with compliance departments and legal teams. If you're running a company with 30, ...
Quiet quitting did not start with lazy workers. It started with people who quietly stopped trying, and most companies never saw it coming. The term...
