You downloaded an AI acceptable use policy template, edited it on a Sunday night, and sent it round with "please read and sign". Three weeks later, half the team still pastes internal documents into a personal ChatGPT account. Nobody disobeyed. Nobody read it.
The short answer: an AI acceptable use policy says, on one page, which tools people may use, what never goes into them, who reviews what the AI produces and who to ask when in doubt. Each rule comes with its reason. Without the reason, people work around the rule the first time they are in a hurry.
Why downloaded policies change nothing
Search "AI acceptable use policy template" and you get templates, free or paid, often ten pages long. They share one flaw. They list rules without saying why the rules exist.
My view is blunt: a rule without its reason gets bypassed. If you write "no client data in unapproved tools" without explaining that you control neither what happens to pasted text nor who can see it, your busy sales lead does the maths the other way: an hour saved, no risk in sight.
Then there is length. A document nobody can quote from memory governs nothing. One page.
What fits on one page
Five blocks, each rule with a one-line reason next to it.
- Approved tools, with the company account. The ones that are not approved, named. "Unapproved tools are forbidden" means nothing to someone who does not know which ones are approved.
- What never goes in, with examples from your own business: a client list, a payslip, revenue figures not yet published, a contract under negotiation.
- Review. The AI drafts, a person signs off, and nothing leaves the company without that review.
- Tools that record or transcribe meetings. This comes up fast, because one attendee can start a recorder without telling the others. Decide who may use them and how people are told.
- Who to ask. A named AI lead, with a first name rather than a shared inbox.
Everything else (vision, ethics) can live somewhere else. The policy is there so people know what to do on Monday morning in front of the tool.
What we see in our bootcamps this autumn
In a leadership bootcamp we are running right now, the policy came up in three sessions between 14 October and 5 November 2026. What follows is what I see in the field, with no names and no detail that would identify a company.
- The approach starts with a confidential survey of what teams already do with AI. The policy is then written for the uses the survey brings back.
- The policy is co-created rather than handed down, and employee representatives come in early rather than at the end.
- It goes through a legal review before it goes out.
- It comes with approved tools provided by the company, and a named AI lead. Banning personal accounts without offering a tool in their place just moves the usage to personal phones.
The canton of Geneva published a free model AI charter for companies on 8 December 2025, in French, shipped with a staff questionnaire on AI use. Swiss law is not your law, but the order of the steps is right: ask first, write second.
When the policy becomes a legal document
I am not a lawyer, and employment law changes from one country to the next. Have yours reviewed before anyone signs.
One example, because we work under it. In France, read on 10 November 2026 on the official Labour Code site: notes and documents that set general and permanent obligations count as additions to the company's internal rules, and follow the same procedure (article L1321-5). That procedure requires the works council's opinion before the rules apply, and the text goes to the labour inspector (article L1321-4).
So you have two honest options. A guidance policy that explains and recommends, with no sanctions. Or a binding policy that can support a disciplinary sanction, which then goes through the formal route. The trouble starts in between: a document that threatens sanctions without having been through that route.
A policy is not training
Article 4 of the EU AI Act, rewritten by Regulation (EU) 2026/1744 of 8 July 2026, asks companies to take measures to support AI literacy among their staff and the people using AI on their behalf. A signed policy shows a rule. It does not show that people know how to work with the tool. We cover what that means in practice in AI literacy training under the EU AI Act.
That is why we train leaders first. A policy pushed by IT gets bypassed, one carried by the leadership team gets applied. To compare formats for your leadership team, see AI training for executives.
Your move this week
Before writing a single line, send your team one anonymous question: "Which AI tools do you use for work, and what for?" Give it a week. You will write your policy from the answers, and you will know which tools to provide before you ban any.
We do not run our programmes in English yet. If you lead in English, join the waitlist and you will hear first when English places open.
Join the waitlist →