AI usage policy for companies: how to write one and avoid shadow AI

An AI usage policy for companies is a short document that sets out which artificial intelligence tools employees may use, with what data and under what rules. Its aim is twofold: to let the team make the most of AI and to prevent company information from ending up in tools that nobody controls. That second risk has a name, shadow AI, and it is today one of the most common security gaps in mid-sized companies. This guide explains what it is, how to write the policy and what points it should include.

What shadow AI is and why it matters

Shadow AI is the use of artificial intelligence tools by employees without the company knowing, approving or controlling it. For example, a salesperson who pastes the content of a contract into a public assistant to have it summarised, or an administrative employee who uploads a spreadsheet of customer data to have it analysed. There is almost never any bad intent: the person is looking to work faster with a tool they find useful.

The problem is what happens next. The data leaves the company’s systems with no contract with the provider, with no knowledge of where it is stored or whether it is reused to train models, and with no record of who shared what. Besides the leak of confidential information, GDPR breaches can arise if personal data is involved.

• Information leaks: contracts, prices, customer data or financial information sent to external tools.
• Regulatory non-compliance: processing of personal data without a legal basis, without a processing agreement and without informing the individuals concerned.
• Decisions based on wrong answers: AI can invent data with apparent confidence and nobody checks it.
• Lack of traceability: if something goes wrong, there is no way of knowing who used which tool or with what data.
• Scattered costs: individual subscriptions that the company neither sees nor negotiates.

Why banning does not work

Many companies react with a blanket ban. It usually fails for a simple reason: if the tool helps and the company offers no alternative, the employee will carry on using it, now off the radar and from a personal device. The most effective policy combines clear rules with approved tools that cover the team’s real needs. The more useful the official option is, the less incentive there is to bypass it.

How to write the policy step by step

1. 1Take an inventory: ask the teams which AI tools they already use and what for. It is the quickest way to see the real extent of shadow AI.
2. 2Classify the data: define what is public, what is internal, what is confidential and what is personal data, with examples from your own company.
3. 3Decide which tools are approved and what type of data each one may be used with.
4. 4Write short, specific rules in language any employee can understand.
5. 5Assign owners: who approves new tools, who answers questions and who is notified of an incident.
6. 6Train the team with real examples of what may and may not be done.
7. 7Review the policy every few months, because tools and risks change quickly.

Points an AI usage policy should include

You can use this list as a content template and adapt it to your company. It does not replace legal advice, but it covers what is usually needed:

1. 1Purpose and scope: who it applies to (employees, contractors, suppliers) and to which tools, including those used from personal devices.
2. 2Definitions: what is considered generative artificial intelligence, an AI agent and an approved tool.
3. 3Approved tools: an up-to-date list, with the permitted version or plan and the use for which each one is approved.
4. 4Prohibited data: information that is never entered into external tools, such as customers’ personal data, contracts, non-public financial information, passwords or confidential source code.
5. 5Permitted data: what can be used and under what conditions, for example public texts or anonymised information.
6. 6Human oversight: AI-generated content is always reviewed before being sent to a customer or used as the basis for a decision.
7. 7Transparency: when customers or third parties must be told that AI is involved, and how generated content is labelled.
8. 8Intellectual property: rules on the use of generated text, images or code and on respecting materials protected by third-party rights.
9. 9Automated decisions: which decisions cannot be delegated to AI, especially those affecting people, such as recruitment or performance reviews.
10. 10Process for approving new tools: how a request is made, who evaluates it and what security and contract criteria are required.
11. 11Incident management: what to do if information is shared by mistake, whom to notify and within what time.
12. 12Training: content and frequency of staff training.
13. 13Consequences of non-compliance and a route for raising questions.
14. 14Owner and review date of the document.

Compliance: GDPR and the EU AI Act

When AI touches personal data, the GDPR applies: you need a legal basis, information for the individuals concerned and data processing agreements with providers. The EU AI Act adds obligations depending on the risk level of the system. One of them, ensuring that staff who use AI systems have a sufficient level of training, has applied since 2 February 2025 and is a good reason for training to form part of the policy.

If your company is going to deploy AI agents connected to its systems, the internal policy is only one part. Technical controls, such as minimum permissions, rules for sensitive actions and a record of every action, are explained in detail in our guide on security. This guide does not replace legal advice: the policy should be reviewed by your legal adviser or your data protection officer.

How to detect and reduce shadow AI

• Ask without judging: a short, anonymous survey usually reveals more than a technical audit.
• Review with the IT department which applications and extensions are used from company devices.
• Offer an approved alternative for the most frequent uses: drafting, summarising, translating, analysing documents.
• Prioritise the cases involving sensitive data and resolve them first with tools that have a contract and hosting in the European Union.
• Make the channel for proposing new tools visible, with a quick response.
• Measure the use of the approved tools: if nobody uses them, the policy is not working.

From policy to agent: providing a safe alternative

Once the policy brings order to informal use, the next step is to give the team better tools than the public ones. An AI agent connected to the company’s systems, with minimum permissions and data hosted in the European Union, handles many of the tasks employees were trying to do on their own, and does so with a record and with control. It is the reason why the usage policy and the implementation of agents are best planned together.

Frequently asked questions

Is it mandatory to have an AI usage policy?

There is no general obligation to have a document of that name. However, the GDPR requires personal data to be protected and the EU AI Act requires training for staff who use these systems. A policy is the simplest way to meet both requirements and to demonstrate it.

How long should the policy be?

As short as it can be for it to be read and applied. A document of two to four pages, with clear examples, works better than a long, legalistic text that nobody consults.

Who should be in charge of it?

It is best led by management, with support from IT, from legal or data protection advisers and from the heads of the areas that use AI most. A policy imposed by a single department tends to be complied with less well.

Does it also apply to the AI agents the company deploys?

The policy covers use by people. Agents also require their own technical controls: minimum permissions, rules for sensitive actions, logging and human oversight.