How to Write a Corporate AI Policy: Guide and Template

1. Why Every Company Needs an AI Policy

A corporate AI Policy is the document that establishes the rules, limits, and responsibilities for using artificial intelligence within an organization. With the EU AI Act now in force, it is no longer optional: Art. 4 of the regulation requires all companies using AI systems to ensure an adequate level of AI literacy and internal governance.

The data is clear: according to the Politecnico di Milano Observatory, only 9% of large Italian enterprises have structured AI Governance processes (AI Observatory, Politecnico di Milano, 2025). The remaining 91% operate without codified rules, exposing themselves to legal, reputational, and operational risks. Employees uploading sensitive data to ChatGPT, teams using AI for hiring decisions without oversight, AI-generated content published without review: these are everyday situations in companies without a policy.

Yellow Tech has drafted AI Policies for a vast number of Italian companies, from SMEs to enterprises with thousands of employees. Experience shows that a good policy is not a bureaucratic document that limits innovation. On the contrary, it is the tool that enables accelerating AI adoption safely, giving every employee a clear framework on what they can and cannot do.

2. What a Complete AI Policy Must Contain

An effective AI Policy covers six fundamental areas. There is no one-size-fits-all model -- the content must be calibrated to the company's industry, size, and AI maturity -- but the basic structure is shared.

The first area is scope and definitions: who the policy applies to (employees, contractors, vendors), which AI tools are covered (only approved tools or personal ones too), what "AI system" means in the company context. The second area covers authorized AI tools: the list of company-approved tools (e.g., ChatGPT Enterprise, Microsoft Copilot, Claude for Business), procedures for requesting approval of new tools, and the prohibition of using consumer versions for company data.

The third area covers data classification: which data can be entered into AI systems (public data, non-sensitive internal data) and which are strictly prohibited (personal data, trade secrets, non-public financial information). This point directly intersects with GDPR compliance.

The fourth area defines rules for specific use cases: content generation (mandatory human review before publication), customer interaction (AI disclosure requirement), decisions about people (hiring, evaluations, credit -- enhanced AI Act obligations for high-risk systems), and AI-assisted software development (IP and licensing of generated code).

• Scope and definitions -- who is subject to the policy, what counts as AI, application perimeter
• Authorized tools -- list of approved tools, new request procedure, consumer version prohibition
• Data classification -- what can and cannot be entered into AI systems, GDPR alignment
• Use case rules -- content, customer-facing, decisions about people, code development
• Responsibilities and roles -- who approves, who monitors, who is accountable for incidents
• Training and updates -- training obligations, policy revision frequency

3. How to Write It: The 5-Step Process

Writing an AI Policy from scratch requires methodology. Here is the process Yellow Tech uses with its 500+ client organizations, refined through hundreds of implementations.

Step 1: Audit existing AI usage. Before writing rules, you need to understand what is happening today. Interviews with team leaders, anonymous employee surveys, analysis of tools in use (unauthorized AI tools used widely often emerge). Our proprietary assessment framework maps AI usage across all business functions.

Step 2: Risk classification. Each identified AI use is classified according to the AI Act risk levels. An internal HR FAQ chatbot is minimal risk. A system that screens CVs for hiring is high risk. The classification determines the level of governance required.

Step 3: Policy drafting. The draft is written in accessible language (not legalese) and organized by business function: rules for marketing differ from those for HR or finance. The document must be usable by the average employee, not just the DPO.

Step 4: Multi-stakeholder validation. The draft is reviewed by Legal, IT, HR, Compliance, and operational teams. Each stakeholder brings their perspective: Legal verifies regulatory conformity, IT assesses technical feasibility, HR evaluates the impact on people. This step is critical -- a policy written solely by Legal without operational input ends up in a drawer.

Step 5: Approval, communication, and training. The policy is approved by the board or CEO, communicated to the entire organization through dedicated sessions, and integrated into the onboarding process. Our AI training programs include specific modules on the company AI policy.

4. Stakeholder Involvement: Who Must Participate

The main reason AI Policies fail is lack of cross-functional involvement. A policy written exclusively by the legal department risks being too restrictive and unworkable. A policy written solely by IT risks overlooking regulatory aspects. The solution is an AI committee representing all key functions.

Essential roles on the committee are: an executive sponsor (CEO or C-level with decision-making power), the DPO or privacy officer (for GDPR alignment), the CTO or IT Director (for technical feasibility and security), the HR Director (for people impact and training), and at least two operational representatives from the functions that use AI most intensively.

We also recommend appointing a dedicated AI Officer, a role emerging in the most advanced Italian companies. The AI Officer coordinates policy implementation, manages approval requests for new tools, monitors compliance, and updates the document. In companies with fewer than 200 employees, the role can be covered part-time by the CTO or innovation manager. For more on roles and organizational structure, see our guide on AI governance and compliance.

5. Continuous Updates and Revision

Artificial intelligence evolves at unprecedented speed. An AI Policy written today could be obsolete in six months, as new tools, new capabilities, and new risks emerge continuously. This is why the policy must include a structured periodic review mechanism.

The recommended frequency is a full review every 6 months, with point updates whenever a trigger occurs: new AI tool adopted in the company, regulatory change (AI Act update, European AI Office guidelines, Privacy Authority rulings), AI-related incident or near-miss, significant change in the business model.

Each review must update the list of authorized tools, reassess risk classification in light of new use cases, verify alignment with current regulations, and collect employee feedback on rule applicability. We offer a policy maintenance service that includes semi-annual audit, document updates, and refresh sessions for the AI committee. This is the same approach used with over 500 client organizations.

6. Practical Examples of AI Policy Clauses

Below are examples of real clauses, derived from AI Policies drafted by Yellow Tech for Italian companies. These models should be adapted to specific contexts, but they represent established best practices.

Prohibited data clause: "It is strictly forbidden to enter the following into AI systems not approved by the IT department: personal data of employees, customers, or suppliers; non-public financial information; trade secrets and intellectual property; health data; documents classified as confidential under the company data classification policy."

Transparency clause: "All content generated or substantially modified with AI tools and intended for external stakeholders (customers, partners, media) must undergo human review before publication. In automated customer-facing communications, it must be indicated that the counterpart is an artificial intelligence system."

HR decision clause: "The use of AI systems for CV screening, performance evaluation, and disciplinary decisions is classified as high risk under the AI Act. Such systems may be used exclusively as support for human decision-making, never as autonomous decision-makers, and require a prior FRIA (Fundamental Rights Impact Assessment) approved by the DPO."

To receive a complete template customized for your industry, contact us. We provide industry-specific templates based on experience with 500+ organizations.

Frequently Asked Questions