How to Write a Corporate AI Policy

Your employees are already using AI. The question is whether they are doing it with guidance or not.

According to an ISACA survey, only around 10% of organizations had a formal generative AI policy in place, even as Deloitte's enterprise research showed worker access to AI tools jumping by roughly half in a single year. The gap between how fast people are adopting AI and how slowly organizations are governing it is wide, and it is getting wider. A 2025 survey by the University of Melbourne found that 48% of employees had uploaded sensitive information to public generative AI tools, and 44% had knowingly violated corporate AI policies that existed.

The problem is not that employees have bad intentions. It is that most of them have no clear guidance on what is and is not acceptable. A corporate AI policy template fixes that. It tells people what tools they can use, what data they can share, and who is responsible when something goes wrong. This guide walks through what your policy needs to cover and how to approach writing it.

Why the Window for Getting This Right Is Narrowing

The case for having a policy used to rest mainly on risk management. That case now has a regulatory dimension as well.

The EU AI Act is phasing in on a schedule worth knowing. A significant enforcement milestone landed on August 2, 2026, when the bulk of the Act's obligations became enforceable, including transparency requirements for AI-generated content. The full obligations for high-risk systems follow later, with a deadline set for December 2027. For any organization operating in or selling into Europe, those deadlines are relevant.

Beyond regulation, cyber insurers have started asking during underwriting whether an organization has a documented AI governance posture. IBM's data breach research has identified a measurable cost premium attached to incidents involving ungoverned AI use. And Verizon's 2026 Data Breach Investigations Report named shadow AI, the use of unsanctioned tools by employees, as a documented risk category.

The cost of not having a policy is no longer theoretical. It shows up in breach costs, insurance terms, and regulatory exposure.

For executives navigating AI adoption, The AI Report's Leaders Launch program offers a curated library of implementation resources, tools, and guides built for business leaders.
See what's inside. 

What Your Policy Needs to Cover

A corporate AI policy does not need to be long. It needs to be clear. The sections below represent the core of what most organizations need as a foundation for their internal AI guidelines.

Approved and prohibited tools. Start with a specific list of which AI tools employees are allowed to use for work, and which are not. This removes the ambiguity that leads to shadow AI. Employees who cannot find an approved tool will find their own one. Your policy should also include a process for requesting approval of new tools so that list stays current as the landscape evolves.

Data classification and handling rules. This is where most of the risk lives. Employees need unambiguous guidance on what data can and cannot go into an AI tool. A practical approach is to define data into categories and set clear rules for each. As a general baseline, customer personally identifiable information, source code, confidential financial data, and information covered by NDAs should not be entered into any public-facing LLM. The employee AI guidelines you write should make that line unmistakably clear.

Output review and human oversight. AI outputs need to be treated as drafts, not finished work. Your policy should specify that employees are responsible for reviewing and verifying any AI-generated content before it is sent externally, published, or used in a decision. This is particularly important for customer-facing content, legal or compliance documents, and anything that touches financial figures. A 2025 EisnerAmper survey found that 68% of employees regularly encounter errors in AI outputs, which underlines why verification is a process step, not optional good practice.

Accountability and governance. Someone in the organization needs to own AI governance. This does not have to be a dedicated role in smaller companies, but it does need to be a named responsibility. Your policy should state who approves new tools, who handles policy exceptions, and what happens when a violation occurs. Clear accountability prevents the situation where everyone assumes someone else is handling it.

Disclosure. Some organizations, particularly in regulated industries or professional services, need a position on when AI use should be disclosed to clients or stakeholders. Your policy should address this directly rather than leaving it to individual judgment.

How to Write It Without Overcomplicating It

A policy that no one reads because it is forty pages long is not a policy. Here is a practical approach to getting it done.

Start by auditing what is already happening. Talk to IT and department heads to map which AI tools are currently in use across the organization. You cannot govern what you cannot see, and the audit will surface the gaps your policy needs to address.

Write for the employee who is not in legal or compliance. The goal is a document that any person in any department can read and understand what they are allowed to do. Use plain language, use examples, and be specific about the most common scenarios your teams will actually encounter.

Pilot it with one team before rolling out company-wide. A single department can pressure-test whether the guidelines are clear and workable before you commit them to the whole organization. The feedback will save you revision cycles later.

Plan to update it. The AI landscape changes fast enough that a policy written today will need revisiting. Build in a review schedule and assign someone to own it.

The governance challenge looks very different at scale, but the underlying logic holds regardless of company size. In a recent episode of The AI Report podcast, Scott Likens, Global Chief AI Engineer at PwC, described how the firm approached giving more than 350,000 employees access to AI tools securely. Rather than simply rolling out a commercial product, PwC built its own internal infrastructure that routes employee AI activity through a controlled layer, allowing access to multiple models while keeping data private and guardrails in place. That foundation, he noted, was what made broad adoption possible. For most organizations the infrastructure will look different, but the principle is the same: employees need a sanctioned, safe path to use AI, or they will find their own. 

Watch the full conversation with Scott Likens on The AI Why podcast. 

Getting Started

Navigating AI policy and governance is one of the challenges that comes with leading an organization through AI adoption. The AI Report's Leaders Launch program gives business leaders access to a curated library of AI implementation resources, tools, and guides to help you move forward with confidence. 

Access the Leaders Launch Program

‍