AI Usage Policy Template: 9 Clauses and the Step Everyone Skips

Most AI policies are written to be filed, not followed. A working AI usage policy template needs nine plain language clauses covering approved tools, forbidden data, a verification duty, disclosure, and records, and you can adapt the full skeleton below in under eight hours. The template is the easy half, though. From 2 August 2026, national authorities also start supervising the EU AI Act duty to make staff AI literate, and a document sitting on the intranet does not achieve that. Training does, and this article shows how to ship both in one week.

What should an AI usage policy template include?

An AI usage policy template should include nine short clauses that tell employees which tools they may use, what data must never leave the company, who checks AI output, when AI use must be disclosed, and how the company keeps records. Copy the skeleton below, replace the bracketed owner with a real name, and delete anything that does not apply to your business.

1. Approved tools. We use only the AI tools on the approved list maintained by [owner]. Any other tool requires written approval before first use.
2. Work accounts only. Use your company account on approved tools, never a personal account, so usage stays visible and the right data settings apply.
3. Forbidden data. Never enter customer or employee personal data, financial records, passwords or credentials, confidential source code, or trade secrets into an AI tool unless that tool is explicitly approved for that category of data.
4. Verification duty. You own everything you ship. Check every AI generated fact, figure, citation, calculation, and line of code before it reaches a colleague, customer, or system.
5. Disclosure. Tell your manager, and the client where a contract requires it, when AI produced a substantial part of a deliverable.
6. High stakes decisions. An AI tool never makes or effectively decides hiring, firing, credit, medical, or legal outcomes. A qualified person decides and can explain why.
7. Incident reporting. Report suspected data leaks or harmful AI outputs to [owner] within 24 hours. Reporting an honest mistake is never punished.
8. Training. Every employee completes the company's AI training within 30 days of joining, confirms they have read this policy, and repeats training when the policy changes materially.
9. Review. [Owner] reviews this policy every six months and whenever we adopt a new AI tool or enter a new market.

That is the whole document. One page beats twelve, because an AI policy for employees only works if people can recall its rules at the exact moment they are about to paste something into a chat window.

Why does an AI acceptable use policy fail without training?

An AI acceptable use policy fails without training because it tells people what to do but not how to do it, and most violations happen through ignorance rather than defiance. Clause 3 above assumes an employee can recognize personal data buried in a messy spreadsheet before uploading it. Clause 4 assumes they know how to verify a confident sounding answer that happens to be wrong. Neither skill is obvious to someone who has never been shown, which is why signed policy acknowledgments so often coexist with daily breaches.

There is a second failure mode: strict rules with no skills push usage underground. When employees are told what they must not do but never taught what they can do well, many quietly switch to personal accounts on private phones, recreating the exact shadow AI problem at work the policy was written to prevent.

The reverse is just as true. Training without a policy has no teeth: there is no approved tools list to point to, no agreed rule to enforce, and no single document to show a client or regulator who asks how AI use is governed. Policy and training are two halves of one control, and each is close to worthless alone.

Does the EU AI Act require an AI usage policy and training?

The EU AI Act does not mandate a written AI usage policy, but Article 4 of Regulation (EU) 2024/1689 has required companies whose staff use AI tools such as ChatGPT to take measures ensuring sufficient AI literacy since 2 February 2025, with no exemption for small businesses. National authorities begin supervising and enforcing that duty on 2 August 2026, a few weeks after this article was published, and no company had been fined under Article 4 as of July 2026.

Two nuances matter. First, the 2026 Digital Omnibus softened Article 4 into an obligation of effort, meaning companies must take appropriate measures to support AI literacy rather than guarantee a result, but the duty itself remains fully in force. Second, the European Commission's guidance says instructions for use alone are not sufficient and points to training as the expected practical measure. No certificate is legally required, and internal training records suffice, though certificates are a convenient way to evidence what was done. Penalties for Article 4 breaches are set by each Member State and must be proportionate, so ignore anyone attaching headline AI Act fine numbers to AI literacy. For the full picture, see our guide to Article 4 and the AI literacy requirement.

The practical reading in 2026: a one page policy plus documented training is the simplest proportionate answer a normal company can give.

How do you roll out an AI policy and training in one week?

You can roll out an AI usage policy and company wide AI training in five working days by treating them as one launch rather than two projects. On day one, adapt the nine clause template above, name the owner, and write the approved tools list. On day two, get management and, if you have it, legal sign off. On day three, send one email per employee containing the policy and the training invite together, so the rules and the skills arrive as a single package. On days four and five, people complete the training at their own pace, and the owner chases stragglers and files the completion records.

The training piece is lighter than most teams expect. Learnery is a browser based AI training platform that certifies employees in around eight hours for 39 euros per seat as a one time payment, with no subscription, no installation, and content that adapts to your industry and each person's role. Volume pricing makes the math easy: a 25 person company pays 39 euros per seat minus the 20 percent discount above 10 seats, so 31.20 euros per person and 780 euros total for a documented, certified rollout. Our playbook on rolling out AI training company wide covers invites, reminders, and completion tracking in detail, and you can create an account and send the first invites the same day.

How do you keep workplace AI rules from going stale?

Workplace AI rules stay current when one named owner reviews the policy every six months, updates the approved tools list whenever a new tool is adopted, and puts every new hire through training within 30 days. The review itself is quick: check whether the tools list still matches reality, whether any incident reports suggest a missing clause, and whether the training record is complete.

Records are the part auditors and clients actually ask about. Keep the signed policy acknowledgments next to the training evidence in one folder. Learnery's admin dashboard tracks completions and issues each finisher a certificate with a verifiable code anyone can check online, which turns the awkward question of proof into a link. If you still need to justify the budget internally, the free ROI calculator turns saved minutes per employee into a euro figure in about two minutes. A policy plus trained people plus records: that is the whole system, and it fits in one week and one page.