How to write your company's first AI policy

Your company's first AI policy should fit on one page and answer five questions: which AI tools people may use, what information never goes into them, which decisions a person must make, what you tell customers, and who owns the policy. Write it from the AI your people already use, not the AI you wish they used. Give the policy one owner and every rule a date. Then test it on real situations before you publish it.

TL;DR

• One page, five questions: tools, data, decisions, disclosure, ownership.
• Start with an inventory of the AI already in use, including AI features inside tools you already pay for.
• Sort your data into three tiers. The tier decides which tools may touch it.
• Test it: ten real situations from five teams, five people answering, the same answer every time.

Why write an AI policy now?

Because your people are already using AI, and the only question is whether anyone wrote down the rules. In Microsoft and LinkedIn's 2024 Work Trend Index, 75% of knowledge workers said they use AI at work, and 78% of those users brought their own AI tools (31,000 people in 31 countries, published May 8, 2024). In ISACA's 2026 AI Pulse Poll of more than 3,400 digital trust professionals, 38% said their organization has a formal, comprehensive AI policy, and a quarter said it has no active policy (published May 5, 2026).

Because the rules now reach ordinary companies. If AI talks to people in the EU, it has had to tell them it's AI since Aug 2, 2026, unless that's obvious. That duty falls on the AI's provider, so check your vendor. California's AB 1609, signed Sep 28, 2026 and in effect from Jan 1, 2027, covers businesses with more than $500 million in gross annual revenue. They may not present a chatbot as a person, must disclose it when a reasonable person is likely to be misled, and must try in good faith to connect a customer to a person within 15 minutes of a request. Colorado's replacement AI law takes effect Jan 1, 2027. (What these rules ask of support teams.)

And because the company answers for what its AI says. On Feb 14, 2024, British Columbia's Civil Resolution Tribunal held Air Canada responsible for wrong refund information its website chatbot gave a customer (Moffatt v. Air Canada, 2024 BCCRT 149). The airline argued the chatbot was responsible for its own words. The tribunal didn't accept that.

What is a company AI policy?

A company AI policy is a short set of written rules that says which AI tools employees may use, what information may go into them, which decisions a person must make, and who is accountable for the rules.

It isn't an AI strategy, which says where AI should help the business. It isn't a statement of principles, which says what the company values. A policy is what an employee checks before pasting a contract into a chatbot. If it can't answer that question in under a minute, it's a principles statement with a policy's name.

It also isn't the last word. Teams that use AI on customer-facing work add their own, narrower rules under it. (Here's how a support team does it.)

What goes into a first AI policy?

Seven parts. Each one fits in a few lines.

1. Scope. Who the policy covers (employees, contractors, temps) and what counts as AI: any tool that writes, summarizes, translates, generates images or code, or makes a recommendation. That includes AI features switched on inside software you already use, like your help desk, your CRM or your office suite.

2. Approved tools. The AI tools the company has approved, by name, and the highest tier of data each one may receive.

3. Data tiers. What never goes into any AI tool, what goes only into approved tools, and what can go anywhere.

4. Decisions a person makes. The decisions AI may inform but never make alone. Money, jobs, accounts and legal commitments are the usual start.

5. Disclosure. When you tell customers they're dealing with AI, and when AI-made content gets labeled.

6. Incidents. What counts as an AI incident, who to tell, and how fast.

7. Owner and review. One named owner, the date each rule was set, and when the policy is reviewed next.

Fig. 4. A one-page AI policy, with team rules underneath. An example, not a recommendation for your company.

How do you write it, step by step?

1. List the AI already in use. Ask every team lead what their people use, and how. Check expense reports and single sign-on logs for AI subscriptions. Then check the tools you already pay for: vendors are switching AI features on by default. Salesforce, for example, said it would turn on the Agentforce platform for every org with Agentforce access, with new orgs enabled by default (Salesforce Help). You can't write a rule for a tool nobody knows is there.

2. Sort your information into three tiers.

• Never in any AI tool: payment card numbers, passwords and credentials, government ID numbers, and anything your contracts or regulators forbid sharing.
• Approved tools only: customer data, employee data, contracts, financials, unreleased product plans, source code.
• Any tool: public information, and your own drafts that contain none of the above.

Fig. 5. Three data tiers. Your contracts and industry may move items into a stricter tier.

3. Approve tools against the tiers. Before a tool gets customer data, get three answers in writing from the vendor: whether it trains on your data, how long it keeps what you send, and how fast it tells you if something goes wrong. A tool approved for public information only is still approved. Say so, so people stop guessing.

4. Name the decisions a person keeps. Start with the ones that move money, change someone's job, close or change an account, or commit the company legally. For each, write who decides. "A manager approves" is a rule. "Use judgment" isn't.

5. Decide what customers are told. If AI talks to your customers, write down where it says so and how a customer reaches a person. Some places now require both. (The rules for customer support are here.)

6. Name an owner, and let teams add rules under it. One person owns the policy and answers for whether it's current. Each team that uses AI on customer work writes narrower rules underneath, and those rules can be stricter, never looser. In a support queue, that means a decision for each ticket type. (How to make those decisions.)

7. Put it where the work happens, train people, then test it. A rule people meet only in a PDF is a rule they'll guess at. Link it from the tools, walk each team through it, keep a record of who's been trained, and run the test below before you announce it.

Is there a template?

Yes. It covers the seven parts, plus training and a place for team rules. Copy it, then replace everything in brackets.

AI POLICY · [COMPANY NAME]
Owner: [name, role] · Set: [Month day, year] · Next review: [Month day, year]

WHO THIS COVERS
Everyone who works for or with [Company], including contractors. "AI tool" means any software that writes, summarizes, translates, generates images or code, or recommends a decision, including AI features inside tools we already use.

APPROVED TOOLS
[Tool]: approved for tier [2 or 3] data.
[Tool]: approved for tier [2 or 3] data.
Any tool not on this list: tier 3 only. To request a tool, ask [role].

TIER 1 · NEVER PUT INTO ANY AI TOOL
Payment card numbers. Passwords and credentials. Government ID numbers. [Anything your contracts or regulators forbid.]

TIER 2 · APPROVED TOOLS ONLY
Customer data. Employee data. Contracts. Financials. Source code. [Anything else you treat as confidential.]

TIER 3 · ANY TOOL
Public information, and drafts with nothing from tier 1 or 2.

A PERSON DECIDES
[Decision]: decided by [role]. AI may [draft, summarize, recommend].
[Decision]: decided by [role]. AI may [draft, summarize, recommend].

WHAT CUSTOMERS ARE TOLD
When AI talks to a customer, it says it's AI and offers a way to reach a person. [Where and how.]

IF SOMETHING GOES WRONG
Tell [role or channel] within [time] if customer data went into an unapproved tool, or if AI sent a customer something wrong.

TRAINING
Everyone reads this page and completes [training] before using an approved tool with tier 2 data. [Role] keeps the record.

TEAM RULES
Teams may add stricter rules for their own work. [Team]: [link].

REVIEW
Every [period], and whenever we add a tool, a law changes, or a rule keeps getting overridden.

How do you know the policy works?

Run the ten-situation test.

1. Write down ten real situations from at least five teams. "Can I paste this customer email into [tool] to draft a reply?" "Can I use AI to screen résumés?" "Can I upload this contract to summarize it?"

2. Give them to five people from those teams. They may read the policy, but they may not ask anyone.

3. Compare their answers with the owner's.

Pass: all five match the owner on all ten. Anything less, find the line that caused the disagreement and rewrite it. Then run the test again.

Which frameworks and laws should you know about?

You don't need a framework to write page one. You'll want one when a customer, an auditor or procurement asks how you manage AI risk.

• NIST AI Risk Management Framework (AI RMF 1.0). Published Jan 26, 2023, and voluntary. It sorts the work into four functions: Govern, Map, Measure and Manage. A first policy is mostly Govern: who's accountable, what's allowed, how it's reviewed. NIST says the framework is being revised, and no new version has been published yet (NIST).
• NIST's Generative AI Profile (NIST AI 600-1). Published Jul 26, 2024. It applies the framework to generative AI. The Texas Responsible Artificial Intelligence Governance Act (HB 149, in effect since Jan 1, 2026) shields a defendant in an attorney general action that found the violation through an internal review while substantially complying with this profile or another recognized AI risk framework (HB 149, NIST).
• ISO/IEC 42001:2023. Published Dec 18, 2023. A certifiable standard for running an AI management system. It's worth the work when customers start asking for a certificate, not before (ISO).

The laws most likely to shape a first policy, as of Nov 1, 2026:

• The EU AI Act, if your AI talks to people in the EU or your staff work there. Since Aug 2, 2026, AI systems that interact with people must be designed to tell them it's AI unless that's obvious (Article 50). That duty sits with the system's provider, so a company using a vendor's bot relies on the vendor (Article 50). Article 4 requires providers and deployers to take measures that support their staff's AI literacy. As amended by Regulation (EU) 2026/1744, in force since Jul 27, 2026, it doesn't require any set level (Article 4).
• Colorado SB 26-189, from Jan 1, 2027. It replaced the state's 2024 AI Act. A business that uses covered automated decision-making technology in consequential decisions must give notice, describe the technology's role in plain language within 30 days of an adverse outcome, offer human review where commercially reasonable, and keep records for three years (Colorado General Assembly).
• Utah, since May 7, 2025. A business using generative AI with consumers must disclose it when a consumer clearly asks, and regulated professions must disclose it up front in high-risk interactions (Utah Code §13-77-103).

If AI talks to your customers, the disclosure and "talk to a person" rules are here.

Where this doesn't apply

• This isn't legal advice. If you're in healthcare, financial services, insurance or lending, have counsel read the policy before you publish it.
• It's for companies that use AI, not companies that build it. If you train or sell models, you need more: testing, documentation and release rules.
• Hiring and firing need their own rules. New York City's Local Law 144, enforced since Jul 5, 2023, requires a bias audit and candidate notice for automated hiring tools. In Illinois, AI that discriminates in employment decisions has been a civil rights violation since Jan 1, 2026. California's SB 947 bars relying only on an automated system to discipline or fire someone, from Jul 1, 2027. Ask counsel before AI touches a hiring or discipline decision.
• A policy doesn't enforce itself. It tells people the rules. Checks, logs and reviews are what make them hold.

Frequently asked questions

Does a small company need an AI policy?

Yes, if anyone at the company uses AI tools for work, and they almost certainly do. A small company's policy can be shorter, but it still needs the five answers: which tools, what data, which decisions a person makes, what customers are told, and who owns it. One page written in an afternoon beats a perfect policy nobody finishes.

Should we ban ChatGPT and other public AI tools?

A ban without an approved alternative mostly moves the use out of sight. A better first rule names the tools you've approved for confidential data and says what's allowed in everything else, usually public information only. Then the honest answer to "can I use this?" exists, and people can follow it.

Who should own the company AI policy?

One named person, usually in operations, IT or legal, who answers for whether the rules are current. Teams that use AI on customer work own their own rules under it. The owner's job isn't to approve every use. It's to keep the policy true: tools added, rules dated, reviews done.

How long should an AI policy be?

One page for the company-wide rules. If it runs longer, move team-specific detail into team rules that sit underneath. The test is speed: an employee should find the answer to "can I put this into that tool?" in under a minute.

How often should an AI policy be reviewed?

On a set schedule, and whenever something it depends on changes: a new tool, a new AI feature switched on by a vendor, a new law, or a rule people keep overriding. Overrides are the best signal. A rule broken every week is a rule that needs rewriting.

Related: How to write an AI usage policy support agents will actually follow · Do you have to tell customers they're talking to AI? · What should AI handle in customer support?

---

Copious helps support and CX leaders decide what AI should handle in their queue and what their people should keep, one ticket type at a time. We take no money from AI vendors.