Free AI policy template generator: Your company's AI usage policy, written from your website

Your teams already use AI to draft emails, summarize meetings and write posts. Most of them do it with no written rules. An AI policy template gives you a starting point, and the generator on this page adapts it to your business.

The risks are concrete. Someone pastes customer data into a public tool. A text goes live with no human review. A protected article or image gets reused as is, with no check on the rights.

A policy sets the rules and keeps the use. Your team knows what it can do, with which data, and who signs off. People then use AI with more confidence, because they know where the limits are.

What an AI policy is

AI policy, AI acceptable use policy, AI governance policy: the words

An AI policy is a written document that sets how your staff use AI at work. An AI acceptable use policy lists what employees may and may not do with AI tools. An AI governance policy goes wider: it says who decides, who controls and how often the company reviews its AI use.

A generative AI policy or AI usage policy targets tools that write text, create images or produce code. In practice, most companies merge all of them into 1 company AI policy. That keeps things simple for the team.

Why your company needs a generative AI policy

• You protect your data. Your team knows which information never goes into a tool.
• You protect your brand. A person reviews every text before it goes live.
• You meet your obligations more easily. The policy supports AI literacy and transparency.
• You give your team a clear frame. People stop guessing and ask the AI lead instead.

What the law says in 2026

If your company operates in the EU or serves people there, the EU AI Act may apply to you. Since February 2, 2025, it asks companies that use AI to take measures so their staff are AI literate (Article 4). A 2026 amendment softened the wording: companies must support AI literacy with appropriate measures, such as training, without having to guarantee a set level for each person.

Since August 2, 2026, its transparency rules apply (Article 50). You must disclose AI-generated or manipulated images, audio or video that resemble real people, places or events and could pass as authentic. These are called deepfakes. Clearly artistic or satirical work follows a lighter rule. You must also disclose AI-generated text published to inform the public on matters of public interest, unless it was reviewed or edited and a person, or the company, holds editorial responsibility for it.

Privacy laws still apply to the personal data people type into an AI tool. In Europe, that means the GDPR. In the US, state laws may apply depending on your size and activity, such as the CCPA in California. US rules also depend on the use, for example hiring decisions, so check them with your counsel.

No law requires an AI policy as such. A policy helps you meet these rules. This reminder is not legal advice: have your policy reviewed by your counsel or privacy lead.

The AI policy template: 10 sections

The generator also adds a summary of the policy in 5 rules, to share with the team in a message or on an intranet page. Your AI policy sets the rules of use, and your brand voice sets how everything you publish sounds, with or without AI.

Data: green, amber, red

A full example for a fictional company: Quillstead

Quillstead is a fictional B2B software company with 60 employees, 5 of them in marketing. Here is how its policy reads.

• Allowed uses: draft a first version of a blog article from a product brief; turn the transcript of a public webinar into a LinkedIn post; suggest 5 subject lines for the monthly newsletter.
• Forbidden uses: paste a customer support ticket into a public AI tool; publish an AI-written case study without a review by the customer success lead; reuse a protected article or image found online as is.
• Green: published blog articles and the public product documentation.
• Amber: anonymized results of a customer survey and the draft of next quarter's campaign plan.
• Red: the CRM export with customer names and emails, and unpublished revenue figures.

How to roll out your AI usage policy

1. Involve leadership, legal or privacy, and IT. Each one checks a different risk, so ask them early.
2. Name an AI lead. This person answers questions, collects incidents and owns the policy.
3. Present the policy to the team. Spend 30 minutes on the 5 rules and on real examples.
4. Train your team. Training supports the AI literacy the AI Act asks you to support.
5. Review the policy every 6 months. Your tools and your uses change, so your rules follow.

If your values and your positioning are not written down yet, start with a brand messaging framework: your AI policy builds on it.

How to write your AI policy with the generator

1. Describe your company. Enter your website address and pick who the policy covers: the marketing and communications team, or the whole company. Then pick your sector: no specific rules, finance and insurance, health, legal and consulting, or public sector and education.
2. List your tools if you want. You may list the AI tools your team uses, in 200 characters at most. You don't need to sign up.
3. Let Mark read your site. Mark reads up to 5 pages to learn your business, your customers and your tone. An AI then writes your policy in 10 sections, with a summary in 5 rules.
4. Finish and copy. Fill in the effective date and the name of your AI lead. Copy the whole policy with its formatting for Word, Google Docs or Notion, or copy the 5 rules alone. The share link stays active for 7 days.

What the generator never invents

• It cites no law or article on its own, and removes a sentence that would. The legal reminder comes from Mark AI, written and dated.
• It says nothing about AI vendors' terms, and names only the AI tools you list.
• It removes any sentence that cites a key figure missing from your website's pages.
• It leaves the effective date and the AI lead blank, because only you know them.

Mistakes to avoid

1. Banning everything. Your team then uses AI in secret, with no rules at all.
2. Copying another company's policy. Its uses, data and risks differ from yours.
3. Forgetting data. A policy with no green, amber and red list leaves the main risk open.
4. Naming no owner. If nobody owns the policy, nobody answers questions or handles incidents.
5. Never updating it. A policy written once and forgotten stops matching your real uses.

How to apply this today

1. Run the generator with your website address, your scope and your sector.
2. Ask 3 people on your team which AI tools they use, and add them to the form.
3. Sort your 10 most common types of data into green, amber and red.
4. Name your AI lead and fill in the effective date.
5. Send the draft to your counsel or privacy lead for review.
6. Share the 5 rules with your team, then plan your AI content in your communication plan.

Frequently asked questions