How to Create an AI Policy for Your Company: An Eight-Step Guide
A good AI policy is short, practical and launched alongside the tools and training people need. Here is how to create one that employees actually follow.
Short answer
To create an AI policy for your company, form a cross-functional working group, survey how employees already use AI, assess risks and opportunities, decide which tools are approved for which data, draft the policy in plain language with role-relevant examples, consult employee representatives and obtain legal and data protection review, launch it with training and approved tools at the same time, and monitor and update it at least every six months.
Key takeaways
- Find out how people already use AI before writing rules.
- Launch approved tools alongside the policy, or people will keep using unapproved ones.
- Plain language and real examples drive compliance.
- Treat the policy as a living document.
The eight steps
Step 1: Form a working group
Bring together HR, legal, IT security, data protection and representatives of key business functions.
Step 2: Understand current use
Survey employees anonymously about which AI tools they use and for what, including unapproved tools.
Step 3: Assess risks and opportunities
Identify high-value use cases and the main data, accuracy, bias and legal risks in your context.
Step 4: Decide approved tools
Select and configure tools with appropriate security and data protection terms for defined data categories.
Step 5: Draft the policy
Use a template, tailor examples to your roles and keep language plain and practical.
Step 6: Consult and review
Consult employee representatives where required, and obtain legal and data protection review.
Step 7: Launch with training
Publish the policy with a short summary, FAQs and training, and make approved tools available at the same time.
Step 8: Monitor and update
Track questions, incidents and usage, and review the policy at least every six months.
Common mistakes
- Prohibition without alternatives: banning AI without approved tools drives hidden use.
- Legal language only: employees need practical examples, not just clauses.
- Ignoring AI used on employees: the policy should cover AI in HR decisions too.
- No training: a policy without training rarely changes behaviour.
- Set and forget: outdated policies lose credibility quickly.
A launch communication checklist
- A one-page summary of the key rules.
- A list of approved tools and how to access them.
- FAQs covering the most common questions.
- Training dates and links.
- A contact for questions and a route to report concerns.
- A message from leadership explaining why the policy enables rather than restricts.
Start from the AI acceptable use policy template.
This is general information and a starting template, not legal advice. Adapt it to your organisation, jurisdictions, works council or union agreements and sector rules, and have it reviewed by qualified counsel.
Related guides
- AI Policy for Employees: Why You Need One and What It Should Cover
Why an employee AI policy is essential, what it covers and who owns it.
- Generative AI Acceptable Use Policy Template for Employees
A copy-ready 15-section AI acceptable use policy template to adapt for your organisation.
- What to Include in a Workplace AI Policy: A Section-by-Section Checklist
Twelve sections, the questions each must answer, and commonly missed items.
- AI Adoption in the Workplace: Why It Stalls and How to Make It Stick
Why AI adoption stalls, the conditions for success, a phased roadmap and how to measure it.
Frequently asked questions
How do you write an AI policy for a company?
Form a cross-functional group, survey current AI use, assess risks and opportunities, decide approved tools, draft in plain language, consult and review, launch with training and tools, and review regularly.
How long does it take to create an AI policy?
A focused effort can typically produce and launch a policy within about two months, depending on consultation and review requirements.
Should employees be involved in creating the AI policy?
Yes. Surveying current use and consulting employees or their representatives makes the policy more practical and improves compliance, and consultation may be legally required in some countries.
What is the biggest mistake in AI policies?
Banning AI without providing approved alternatives, which pushes use into unapproved tools and increases data risk.