86% of large French companies approved a responsible AI use policy in 2026 (source: KPMG). SMBs, for their part, mostly have none — even as the European AI Act comes into force for “high-risk” HR uses on 2 August 2026, with penalties of up to €35 million. An AI policy is neither a token HR document nor a legal exercise. It is the operational text that frames what your teams can do, what they cannot, and how. Here is how to write it in two useful pages, with the copyable template.

1. Why an AI policy is no longer optional in 2026

Four sets of regulation overlap, and all of them are cumulative: complying with the AI Act does not exempt you from the GDPR, and neither replaces the Labour Code or collective agreements. Your AI policy is the single document that translates all of these constraints into practical rules for your staff.

Cumulative legal framework applicable to any AI policy in France in 2026: European AI Act (€35M or 7% of worldwide turnover), GDPR (€20M or 4% of turnover), Labour Code art. L.2312-8 (mandatory works council consultation), collective agreements.
Four cumulative texts — a single policy to coordinate them

Sources: European Commission, CNIL, Éditions Tissot, Edenred CSE 2026.

The AI Act (EU Regulation 2024/1689) classifies AI uses by level of risk. HR applications (recruitment, appraisal, supervision) are classed as “high risk” and require human oversight, traceability, risk management and transparency from 2 August 2026. Penalties can reach 7% of worldwide turnover.

The GDPR does not go away: it applies in parallel as soon as an AI processes personal data. HR uses and employee monitoring will most often require a DPIA (Data Protection Impact Assessment). In 2024 and 2025 the CNIL published several specific recommendations on AI at work.

The Labour Code requires you to consult the works council (CSE) before introducing any new technology that changes working conditions (article L.2312-8). Failing to consult beforehand constitutes the offence of obstruction (délit d'entrave), which can lead to damages.

Collective agreements (Syntec, metalworking, banking) are starting to include AI-specific clauses: OPCO training, the right to algorithmic disconnection, annual negotiation on the tools deployed. To be checked for each sector.

2. The three goals of a policy that works

A good AI policy is not a stack of legal notices. It pursues three operational goals.

Clarify. An employee who opens the policy must, in under ten minutes, know what they can do and what they should avoid. If not, the policy fails. HR directors who hand over a 40-page document full of compliance generalities solve no problem.

Protect. The company, its data, its clients, its employees. The policy is the document you will produce in the event of a CNIL inspection, an audit or an incident. It demonstrates the compliance effort and limits your liability.

Make people accountable. The employee who signs the policy is committed. This does not replace training, but it sets a contractual framework that everyone has read and accepted.

3. The seven standard sections

The seven standard sections of an AI policy: intent, scope and definitions, authorised tools, areas of use, generated content and accountability, training, sanctions and review.
The minimal skeleton — two pages, no jargon

Framework consolidated from the CIGREF, Numeum, Lattice, Secureframe and Writer.com templates and from policies published by Deloitte, Salesforce, WIRED and Best Buy.

Section 1 — Intent

Five lines at most. Why this policy exists, what the company believes about AI. It is the only part that may be “philosophical”. For example: “AI is a tool that relieves our teams of repetitive tasks. It does not replace human decision-making. It must not enter our relationships with clients, partners and employees on decisions that commit us. This policy translates these principles into practical rules.”

Section 2 — Scope and definitions

What the company means by “AI”: conversational assistants (Claude, ChatGPT, Perplexity), image and video generators (Midjourney, Nano Banana Pro, Veo), code copilots (GitHub Copilot, Cursor, Claude Code), AI-native business tools (Notion AI, Superhuman). Who the policy applies to: all employees, interns, apprentices and external contractors with access to the company's systems.

Section 3 — Authorised tools

A whitelist of approved AIs, with for each: name, recommended use, limits (do not paste X into it), contractual terms (data-no-training confirmed). Example: “Claude Team Enterprise (paid subscription) with data not used for training. Authorised for drafting, summarisation, document analysis. Prohibited: entering clients' personal data.” Provide a simple process for requesting that a new tool be added, addressed to the AI lead.

Section 4 — Areas of use

This is the most operational part. A two-way matrix: the type of data and the type of use. Each cell gives the verdict: authorised, authorised with validation, prohibited.

AI use decision matrix: data type (public, internal non-sensitive, client non-named, personal, strategic) versus task type (drafting/summarising, brainstorming/monitoring, decisions/client outputs), with codes authorised in green, validation in orange, prohibited in red.
The matrix that fits on one page

Adapt the rows and columns to your sector. Rule: when in doubt, consult the AI lead.

Section 5 — Generated content, labelling, accountability

The AI Act requires the labelling of any synthetic content distributed publicly. To be translated into the policy: which deliverables carry the “AI-generated content” label, who validates before external distribution, who bears final responsibility. Principle: the employee who signs the deliverable is accountable for it, not the tool.

Section 6 — Training

A mandatory training plan: 1 onboarding module on arrival + 1 quarterly 45-minute session on recent concrete cases (Samsung, Vercel, etc.). The works council is consulted on the plan. The training budget is specified (OPCO or in-house).

Section 7 — Sanctions and review

Who does what in the event of a breach. A graduated typology: reminder, formal warning, disciplinary procedure for repeated faults. Six-monthly review of the policy by management and the works council. Version and date clearly indicated.

4. The copyable template

Terms of use This template is a working basis, not a ready-to-sign document. You must adapt it to your sector, your actual tools and your collective agreement. Works council consultation is essential before distribution.

ARTIFICIAL INTELLIGENCE USE POLICY

Version 1.0 — applicable from [DATE] — six-monthly review

1. Intent

[COMPANY NAME] uses AI as a productivity tool. It does not replace human decision-making and does not enter into binding relationships with clients, partners and employees. This policy translates that principle into practical rules.

2. Scope

This policy applies to every employee, intern, apprentice and external contractor with access to the systems of [COMPANY NAME]. Any tool based on generative models (LLM, image, video, voice) or agentic models (adaptive automation) is classed as AI.

3. Authorised tools

Only the following tools are authorised: • Claude Team Enterprise (data-no-training) • ChatGPT Enterprise (data-no-training) • Microsoft Copilot Enterprise • [specific tools] Any new tool must be approved by [AI LEAD] before professional use.

4. Areas of use (see attached matrix)

• Authorised: public content, internal non-sensitive content, brainstorming • With manager validation: client outputs, non-named data • Prohibited: personal data, patented IP, individual HR decisions

5. Labelling and accountability

Any external deliverable partly or wholly generated by AI must be validated by its human author before distribution. Marketing publications generated by AI carry the label “AI-assisted content”. Responsibility for each deliverable lies with the person who signs it.

6. Training

An AI onboarding module is given to every new joiner. Quarterly 45-minute sessions cover recent real cases and changes to the policy. The plan is presented to the works council.

7. Sanctions and review

Any breach gives rise to a written reminder. Repetition may trigger a disciplinary procedure. The policy is reviewed every six months by management and the works council. [NEXT REVIEW DATE]

Signatures

[NAME] — Director / Chair / Manager [NAME] — Works council representative (or, failing that: works council informed on the date of...)

5. The five classic mistakes to avoid

Mistake 1 — The 40-page legal policy. Nobody reads it, nobody applies it. Two pages at most. The technical annexes (list of tools, matrix, contacts) can be updated without changing the policy itself.

Mistake 2 — The blanket ban. “AI is prohibited except by exceptional authorisation” produces Shadow AI, not compliance. Prefer a framed authorisation, which also acts as an incentive to use the official tools.

Mistake 3 — Forgetting the works council. Prior consultation is mandatory. Many policies are circulated by management without going through the works council: they are technically unlawful and open to challenge. The cost of an obstruction offence far exceeds that of a works council meeting.

Mistake 4 — No point of contact. A policy without a designated contact is a dead policy. Appoint an internal AI lead (or an external provider) who can be reached for disputed cases.

Mistake 5 — The frozen policy. Tools change every three months, models evolve, regulation becomes more precise. A six-monthly review is not a luxury, it is the condition of operational validity.

6. Recommended adoption process

  1. Initial drafting by management (2 half-days with the template above)
  2. Consultation of the legal lead or internal data protection officer (checking whether a DPIA is required)
  3. Presentation to the works council with a compliant review period (at least 1 month before signature)
  4. Feedback and adjustments
  5. Signature by management + works council and distribution by email signed by the head of the company
  6. Immediate onboarding: a 45-minute presentation to the teams
  7. Archiving of the acknowledgement of receipt (electronic signature or register)

Realistic total duration: 6 to 10 weeks between first draft and actual distribution. That is normal. It is also what makes a policy last.

7. What your policy should allow your teams to do

A well-made policy is not restrictive, it is liberating. It unblocks use by clarifying the scope. When your employees know precisely what is authorised, they use the tool without hesitation and without guilt. They spend more time on value, less on managing individual risk.

A concrete measure: in companies that put an operational policy in place in 2025, the ratio of official tools to Shadow AI rose on average from 35% to 82% in six months (see our article on Shadow AI).

Conclusion

An AI policy is not a compliance document meant to protect the company's lawyers. It is a productivity tool that turns vague, risky use into a clear and productive framework. SMBs that are still putting off the drafting are preparing to pay twice: once in regulatory risk, once in uncontrolled Shadow AI.

The seven-section template fits on two pages and covers 80% of the situations of a French SMB in 2026. You can draft it in two half-days, have it validated by the works council in a month, and have your policy operational before the summer. The condition: start now, not after the first incident.