Company AI policy: template and rules to set in 2026

Quick answer. A company AI policy is an internal document that governs the use of artificial intelligence tools: scope, approved tools, data that must never be entered, human review and training. In 2026 it ties in with the GDPR and Regulation (EU) 2024/1689, and is built in six straightforward steps.

Your teams already use generative AI, whether you decided it or not. A salesperson pastes a client list into an assistant to draft an email, an accountant asks for a summary from a general ledger, a director has a contract reviewed. Each one saves time, and each one potentially exposes sensitive data in a consumer tool. The AI policy exists precisely to turn this spontaneous use into a controlled practice, without slowing the productivity gains.

We see the same sequence recur in our files: AI arrives from the bottom up, tool after tool, before any rule is written. The policy often comes only after a first incident, a client record entered in the wrong place or an inaccurate piece of content sent outside. This article sets out a six-step policy template and the watch points we flag to our clients.

The stakes are not theoretical. Three frameworks overlap and concern every company, whatever its size.

Regulation (EU) 2024/1689, the Artificial Intelligence Act, entered into force on 1 August 2024 and applies in stages. The prohibited AI practices in its Article 5 and the AI literacy obligation have applied since 2 February 2025. The obligations for general-purpose AI models have applied since 2 August 2025. The rules for the high-risk systems listed in Annex III apply from 2 August 2026. Penalties can reach EUR 35 million or 7 % of worldwide annual turnover.

The GDPR, Regulation (EU) 2016/679, requires the data minimisation principle: only data that is strictly necessary may be processed (Art. 5, 1, c). Pseudonymised data remains personal data, unlike anonymised data. For processing likely to result in a high risk, a data protection impact assessment is required (Art. 35).

Professional secrecy applies in addition for some professions. As a chartered accountant, we are bound by secrecy under Order No. 45-2138 of 19 September 1945 and the code of conduct: our clients' data cannot move freely to a third-party tool. The same logic applies to any business handling confidential data.

Our view. The AI policy is not just another compliance exercise. It is the fastest tool to cut a concrete and immediate risk, the leak of data through a free tool, while laying the groundwork for teams to build skills. A short, applied policy is worth more than a long, forgotten one.

Here is the outline we recommend. Each step produces a section of the policy.

Step 1: map AI uses#

Start by listing the tools actually used, team by team. Writing, translation, data analysis, customer support, code, accounting. Note who uses them, on which files and with which account, personal or professional.

This inventory almost always reveals uses management was unaware of. Without this starting snapshot, the policy governs theoretical uses while the real risks sit in tools adopted on the margins.

Step 2: rank uses by risk level#

Rank each use according to the data processed and the impact of an error. Regulation (EU) 2024/1689 separates the prohibited practices in Article 5, the high-risk systems in Annex III and ordinary uses.

This grid avoids two symmetrical mistakes: banning everything, which pushes teams to work around the rule, or allowing everything, which exposes the company. Control effort then focuses on sensitive processing.

Step 3: define allowed and prohibited data#

This is the section consulted most day to day. It must be short and concrete. The table below illustrates the sorting principle.

The guiding principle is simple: personal or confidential data must never be entered into a consumer tool. The minimisation required by the GDPR translates here into a clear operational instruction.

Step 4: set human review and traceability#

An AI output can be plausible and wrong. The policy requires human review before any external use of generated content, and a record of approved tools.

Specify who validates, what must be checked and how use is documented. Traceability protects the company if generated content is challenged or if use becomes the subject of an audit.

Step 5: appoint an AI lead and train teams#

Appoint a lead who decides on the adoption of new tools and answers day-to-day questions. Regulation (EU) 2024/1689 has imposed an AI literacy obligation since 2 February 2025: users must understand the limits of the tools they handle.

Short training, built on the real uses mapped in step 1, does more for compliance than a document signed but never read.

Step 6: roll out the policy and review it#

Communicate the policy, have it acknowledged and set a review date. The ecosystem moves fast and the timetable of Regulation (EU) 2024/1689 runs to 2 August 2026 for high-risk systems.

A frozen policy becomes inaccurate within months. A periodic review, at least yearly, keeps it useful and credible.

The policy fits on a few pages. Here are the headings we consider essential.

• The scope: who is concerned, which tools, which uses are covered.
• The list of approved tools and the procedure to propose a new one.
• The data prohibited from entry, plainly worded.
• The requirement of human review before external use.
• The traceability and documentation rules.
• The name and role of the AI lead.
• A reminder of GDPR and Regulation (EU) 2024/1689 obligations.
• The update date and the review frequency.

Trade-off. Should consumer tools be banned or governed? An outright ban is tempting but encourages workarounds: teams use the tool on a personal account, beyond any control. Governance, with a list of prohibited data and a professional version of the tool where one exists, is more realistic for most SMEs. A strict ban is justified for the most sensitive data, such as data covered by professional secrecy.

The policy rarely fails on substance. It fails on application.

The underestimated risk. The main danger is not the official tool chosen by management, but the free tool quietly adopted by a busy colleague. That is the door through which client data leaves. A policy that only covers approved tools and ignores informal use misses the essential point.

A second pitfall concerns pseudonymisation. Replacing a name with a code is not enough to take data out of the GDPR: pseudonymised data remains personal data. Only anonymisation, which is irreversible, takes the information out of scope. Many directors believe they are protected by masking names; they are not.

The third pitfall is confusing the policy with the technical reality. Writing that entering personal data is prohibited does not configure the tool. The policy must come with technical choices: a professional version that does not reuse data for training, named accounts, logging.

2026 watch points. The timetable of Regulation (EU) 2024/1689 is advancing: AI literacy and prohibited practices since February 2025, general-purpose models since August 2025, high-risk systems from 2 August 2026. If the company develops or integrates a system covered by Annex III, the August 2026 deadline must appear in the action plan. The CNIL also publishes recommendations on the use of AI and data protection that are worth reading before any structuring decision.

In transformation files, the most common scenario looks like this. A services SME finds, during an internal review, that half its teams already use a free AI assistant, each on a personal account, on working documents that sometimes include client details. No rule exists. Management hesitates between cutting everything off, which would alienate teams attached to the time saved, and letting it run, which keeps the risk in place.

The policy settles this dilemma. The inventory makes the use objective, the risk ranking separates what can continue from what must stop, the prohibited-data list gives a clear instruction, and the lead becomes the contact point that prevents a return to personal accounts. The whole thing fits into a scoping meeting and a short document. The point is not primarily legal: it is to secure a practice that is already in place.

To connect the policy to your finance function, our digital transformation of the finance function integrates these rules into accounting tools, for example when you deploy the Pennylane tool. If AI touches your bookkeeping, our analysis of AI applied to accounting and the guide AI in accounting: ROI, risks and the AI Act go deeper on the accounting side. For concrete examples, see the generative AI use cases in SMEs. Younger companies will find a suitable framework in our support for tech startups, and you can discuss it with our chartered accountancy firm in Paris 8.