In a recent audit, the company's AI policy banned giving customer data to AI. Yet the logs of the tool the company provided showed one team summarising its customer meeting notes in it every week. Elsewhere, the policy had been written to govern consumer ChatGPT, before the company rolled out its own tool, and nobody had revisited it. In another audit, most of the people we interviewed did not know what the policy said, or even that it existed.
A company AI policy is the document that tells employees which AI tools they may use, with what data and under what conditions. It often supplements the IT acceptable use policy. It is only worth something if someone checks that it is applied.
What should an AI policy include?
An AI policy says what is allowed, what is not, and how that gets checked. The sections that come up in the policies we read:
- the authorised AI tools, and for which uses;
- the data never to give them: customer data, personal data, trade secrets, depending on the tool's contract;
- human review of what the AI produces, especially anything that leaves the company;
- the rule on personal accounts and subscriptions;
- the planned training, and for whom;
- how usage logs are read: what is looked at, by whom, at what level of aggregation;
- who to ask.
You will find these sections in most templates. Policies differ in what their rules start from, and in whether anyone checks that they hold.
Before writing or rewriting your AI policy, look at real usage
A written rule that people know about is still rare. According to Coface's barometer published on October 5, 2026 (900 decision-makers), 17 % of companies have defined, formalised and communicated an AI usage policy to their employees. On the employee side, KPMG's Observatory from June 2026 (1,000 private-sector employees) finds 10 % of respondents reporting an AI policy or an AI ethics committee at their company. The same survey finds that 61 % of employees who use AI go through consumer tools, and 19 % through internal tools.
A policy that only covers the tool you provide therefore leaves out a good share of the employees who use AI. It works better when it follows what teams actually do:
- Start from the usage logs of the tools you provide (Microsoft 365 Copilot, ChatGPT Enterprise, Claude…). They show which uses are running, in which teams, with which types of content.
- Group those uses by task. Rules are decided task by task, not tool by tool.
- Ask in interviews what the logs do not show: personal tools, the data people do not dare give the tool, what they lack to do their work well. A questionnaire on its own only returns what each person is willing to declare.
- Write the rules from what you have seen, and tell the teams how they will be checked.
To place the policy within the whole tool estate, see our guide to AI in the enterprise.
Why does AI use slow down while the policy is being written?
Because nobody knows what is allowed. In October 2026, the IT manager of a social housing provider explained to us that, as long as their policy was not finalised, adoption stayed very hesitant: some of his teams said they were not interested, others were a little afraid of the tool. The most cautious wait. The others go ahead without asking, with their own tools.
A short version, published early, unblocks the ones who wait: the authorised tools, the data never to share, who to ask. It does not cover everything, and the full version still has to be finished with legal, the data protection officer (DPO) and security, but in the meantime it says what matters.
What happens when the policy prohibits AI use?
Usage carries on elsewhere. A few cases we have been told about since July 2026:
- on a building site of a large construction group, the IT department sends emails asking people to stop and forbidding them to install AI on their computers; the teams use it on their phones;
- in a consulting firm, the youngest salespeople use ChatGPT even though it is banned;
- in a group subsidiary, licences bought personally go through expense claims, under a category created for them.
The ban takes usage out of the IT department's sight, and the data with it. This is how shadow AI works: when the tool provided does not cover the need, or when it is banned, teams turn to their personal accounts.
Why have policies from the early days of ChatGPT aged?
They were written when generative AI came in through consumer accounts, with no enterprise contract, and they banned what was risky at the time. Two rules from that period come up often:
- no company data in AI;
- no analysis of AI usage logs, not even to improve internal tools.
Since then, many companies have provided a tool under contract, and the policy has not kept up. The first rule reduces the tool provided to rewording emails, and pushes the uses that work on company documents outside the rules: that is what happened with the team that summarised its customer meeting notes. The second makes it impossible to know whether the policy is applied, or which uses deserve to be extended.
Changing them takes time. A policy that places obligations on employees in principle follows the procedure for the company's internal rules (règlement intérieur), with the opinion of the CSE, France's works council (see the section on legal standing). So many stay as they are, and the gap with usage grows.
How do you check that an AI policy is applied?
An AI policy is checked rule by rule, by comparing each rule with what teams actually do: the logs of the tools provided for what goes through them, interviews for the rest. The results are read by team, to fix the rules that do not fit the work, not to find out who broke them.
| What the policy says | What you check in usage | Where you read it |
|---|---|---|
| Authorised tools | Which teams really use the tool provided, for which tasks, and which have dropped it | The logs of the tool provided |
| Prohibited data | The use cases where this type of data appears (customers, HR, finance), team by team | The content of the conversations, analysed and grouped by use case |
| Human review | The uses that produce a document sent outside the company, and how it is reviewed | Interviews |
| Personal accounts | What the company's logs do not see | Interviews, purchases (reimbursed licences) |
| Training | Usage before and after, team by team | The logs |
This reading needs three things. First, the policy has to allow it: if yours forbids analysing usage logs, that is the first rule to revisit. Second, a framework agreed with the DPO and the CSE before you start, since reading these logs, and the content of the conversations for the data row, is itself processing of personal data. Third, employees told in advance what is looked at. The results are grouped by team: who broke which rule is not part of the reading.
Is an AI policy mandatory?
No, as far as we know: no legal text requires a document called an "AI policy". The AI Act does, however, require companies that deploy AI systems to take measures for their staff's AI literacy, and the CNIL recommends an internal charter or policy.
The texts in detail:
- Article 4 of the AI Act, applicable since February 2, 2025, was amended in July 2026. In its current version, providers and deployers "take measures to support the development of AI literacy of their staff" and are not required to guarantee a given level for each person;
- in its questions and answers, the European Commission states that no mandatory training and no particular governance structure is imposed, and that an internal record of training and initiatives is enough to keep track of it;
- the CNIL recommends governing the use of generative AI "through internal policies or charters, clearly defining the authorised and prohibited uses."
Idun Group does not give legal advice: have your policy reviewed by your lawyer.
What is the legal standing of an AI policy?
When it places general and permanent obligations on employees, particularly on discipline, the French Labour Code (Code du travail) treats it as an addition to the internal rules, in companies that have them (article L1321-5). Internal rules become mandatory at fifty employees.
The policy then follows their procedure (article L1321-4): the opinion of the CSE, publication, submission to the labour inspectorate, and entry into force one month later. That is also what makes every change slower than you would like.
When should you revise the AI policy?
- When the company deploys a tool under contract: rules written for consumer ChatGPT no longer fit it.
- When usage changes: a use growing in one team, a rule nobody follows any more. Usage logs show it well before feedback from the field does.
- When licences come up for renewal, and you decide who keeps which tool. See an active licence is not a used licence.
- When a client or a prime contractor asks how you govern AI. An industrial subcontractor told us it was receiving more and more of these questionnaires, and was holding back on AI use because it did not know how to govern it. Faced with a questionnaire, the policy says what is planned, and measured usage says what is happening.
Our audit of real AI usage does this reading rule by rule, from existing logs and interviews with the teams.
