Company AI Policy: How to Write One and Make It Stick

A company AI policy is the internal document that sets out who may use artificial intelligence, for what purposes, with what data and under whose responsibility. It turns an abstract topic into rules people can apply every day, and gives the company a consistent reference for training, controls and answers to customers and authorities. An effective policy is short, concrete and linked to the rest of governance.

What is an AI policy for, and what is it not?

The policy answers a simple question employees ask: can I use this tool for this task? Without a written answer, everyone decides for themselves, and individual decisions produce risk (confidential data entered into unapproved services) or paralysis (nobody uses AI for fear of getting it wrong).

A policy is not a blanket ban, nor a legal document to be filed away. It is a guidance tool: it says what is encouraged, what requires caution and what is excluded. It works if it is understandable to non-lawyers, and if it is updated along with the tools and use cases the company adopts.

Nor does it replace regulatory compliance. The GDPR, the EU AI Act and NIS2 set obligations that the policy helps organize, but interpretation for your case remains the job of the DPO and legal counsel: what is written here is informational and is not legal advice.

What is the structure of an AI policy? Six sections

An essential structure has six parts.

1. Scope and definitions

Clarify who it applies to (employees, contractors, suppliers working on the company's behalf), to which tools (generative assistants, AI features built into other software, models developed in-house) and what "AI" means for the purposes of the document. A few clear definitions avoid ambiguity: approved tool, confidential data, use case.

2. Allowed, approval-required and prohibited uses

This is the part people consult most often. Organize it in three bands:

• Allowed. Low-risk uses with approved tools, for example rephrasing text without confidential data or summarizing public documents.
• Subject to approval. Uses that involve personal data, decisions about people, customers or externally facing content. State who approves and how to request it.
• Prohibited. Excluded uses: practices banned by article 5 of the EU AI Act (applicable since 2 February 2025), entering confidential data into unapproved tools, using AI to bypass other company policies.

Concrete examples are worth more than formulas. Write "do not enter customer names and contracts into unapproved tools", not "avoid inappropriate processing".

3. Data handling

Specify which categories of data may enter which tools, distinguishing between company-approved tools and public or personal services. A simple classification (public, internal, confidential, personal) with one rule for each is enough. Refer to the GDPR principles in operational terms: lawfulness and minimization (article 5), legal basis (article 6), privacy notices (articles 13 and 14), processors (article 28), transfers outside the EU (Chapter V) and, for high-risk processing, impact assessment (article 35). For more detail, see GDPR and generative AI at work.

4. Responsibilities

Assign roles by function name:

• who approves tools and use cases (for example an AI committee or the Chief AI Officer);
• who answers for each use case in their department;
• who oversees security and data protection (CISO, DPO);
• who reports and handles incidents.

Also say what to do for anyone with a doubt or who discovers a non-compliant use: whom to write to, within what time, without fear of retaliation. A simple channel known to everyone is worth more than a detailed procedure nobody remembers.

5. Training

The policy is useless if it is not known. Provide initial and periodic training, proportionate to the role. Article 4 of the EU AI Act requires providers and deployers to take measures to ensure a sufficient level of AI literacy among their staff, and has applied since 2 February 2025. The topic is covered in AI literacy and article 4 of the AI Act.

6. Monitoring, review and consequences

Describe how compliance with the policy is verified, with what data and at what level of detail. If monitoring may touch workers' activity, the limits of article 4 of the Italian Workers' Statute (Law no. 300 of 20 May 1970) must be respected: involve HR and employment law advisers early. Set a review date (at least annual) and the person responsible for the update.

How do you roll out the policy so it is read and applied?

Publishing a PDF is not enough. A few measures help.

1. Involve departments in drafting. A policy written without those who work with AI will be unrealistic. Collect concrete cases from IT, legal, HR and operational functions.
2. Produce a short version. One page with the essential rules and the most frequent examples, to sit alongside the full text.
3. Link the policy to the tools. A list of approved tools, easy to find, stops people falling back on unauthorized services.
4. Communicate from the top. A message from management makes clear that the policy is a priority and not a formality.
5. Train, do not just inform. Short sessions with real scenarios work better than documents to read.
6. Measure knowledge. Check periodically, even with short questionnaires, whether the rules have been understood.
7. Collect exceptions. Recurring waiver requests show where the policy is unrealistic and should be corrected at the first review.

What are the common mistakes in writing an AI policy?

These mistakes recur in most organizations, even those that invested in drafting the document.

• Too generic. Noble principles without examples guide no one.
• Too restrictive. A total ban pushes use underground onto personal accounts, with greater risks. We discuss this in shadow AI risks and how to manage it.
• Disconnected from the use case register. Without an AI use case register you do not know what the policy is supposed to govern.
• No owner. A rule without an owner is neither updated nor enforced.
• Written once. Tools and rules change, and the policy must be reviewed.
• Legal language. If people do not understand it, they do not apply it.
• No channel for doubts. If asking is complicated, people decide on their own, and often decide badly.

Company AI policy checklist

1. Clear scope and definitions, with tools and recipients.
2. Allowed, approval-required and prohibited uses, with examples.
3. Data classification and rules for each class.
4. Up-to-date list of approved tools.
5. Roles and responsibilities assigned, with a reporting channel.
6. Training plan by role, with a defined schedule.
7. Monitoring methods consistent with the limits on worker control.
8. Process for requesting and approving new use cases.
9. Review date and person responsible for updates.
10. Short version for all employees.

Where Delphis fits

Delphis is a vendor-independent platform that connects spend, adoption, impact and regulatory obligations. For governance, it manages AI policies and training alongside the use case register, and maps GDPR, NIS2 and EU AI Act obligations, flagging gaps. Data on people stays aggregated by role or department, and the regulatory mapping is not legal advice. For more information, see the Compliance page.

Sources

• GDPR, Regulation (EU) 2016/679
• AI Act, Regulation (EU) 2024/1689