How to Create a Corporate AI Use Policy: The 10 Sections and How to Put the Policy into Practice
By Pedro Sonda, dooop
A corporate AI policy should include ten sections: purpose and scope, principles, roles and responsibilities, risk classification, tools and approval of new uses, data, human review and transparency, suppliers, incidents, and policy review. It serves as the governance reference document and must be approved by leadership. For employees, the policy is translated into a one-page practical rules summary. It only works when accompanied by four mechanisms: usage inventory, training, a channel for questions and incidents, and periodic review.
Updated October 2026.
This content does not replace legal advice.
Why the Policy Is Urgent, and Why It Alone Is Not Enough
| Data | Source |
|---|---|
| Only 40% of employees say there is a policy or guidance on generative AI at work; nearly half admit to using AI in ways that violate rules | KPMG and University of Melbourne, 2025 |
| 63% of organizations that suffered data breaches had no AI governance policy or were still developing one; only 34% conduct regular audits of unauthorized AI use | IBM, 2025 |
| 54% of workers would use AI tools even without authorization | BCG, 2025 |
Interpretation: Without a policy, use occurs without rules; with a policy but no audits or approved alternatives, use continues outside the rules. The policy is necessary but must be accompanied by mechanisms.
dooop Framework: The 10 Sections
| # | Section | What It Defines | Example Content |
|---|---|---|---|
| 1 | Purpose and Scope | To which people, systems, and suppliers the policy applies | Employees, contractors, internal systems, and market tools |
| 2 | Principles | The company’s commitments regarding AI use | Human responsibility, data protection, transparency, proportionality |
| 3 | Roles and Responsibilities | Who approves, operates, reviews, and supervises | Governance lead; owners of each use; decision forum |
| 4 | Risk Classification | Risk levels and requirements for each | Minimal, limited, high, and prohibited, with examples |
| 5 | Tools and New Uses | How a tool or use is approved | List of approved tools; approval workflow with deadlines |
| 6 | Data | Which data can be used in which tools | Data classification; rules for personal and confidential data |
| 7 | Human Review and Transparency | Where review is mandatory and when to disclose AI use | Review before external submission; client notice in AI-assisted service |
| 8 | Suppliers | Requirements for contracting AI solutions | Evaluation, contractual clauses, information about AI use |
| 9 | Incidents | How to report and handle errors and failures | Channel, deadlines, responsible parties; reporting without punishment |
| 10 | Policy Review | When and by whom the policy is reviewed | Semiannual review or after significant changes |
Two Document Layers
| Document | Audience | Length |
|---|---|---|
| Corporate Policy | Leadership, governance, legal, IT, system owners | Several pages, covering the 10 sections |
| Employee Use Rules | All employees | One page, with practical examples; see How to Create Safe AI Use Criteria for Employees |
The 4 Mechanisms That Put the Policy into Practice
| Mechanism | Function |
|---|---|
| Usage Inventory | Shows what the policy is being applied to |
| Short Training | Ensures people know the rules with practical cases |
| Channel for Questions and Incidents | Provides a way to ask questions and report without fear |
| Periodic Review | Keeps the policy updated with new tools and regulations |
How to Build the Policy in 6 Steps
- Identify current AI uses, including unofficial ones.
- Define principles and prohibited uses with leadership; see AI Governance: What Should Leadership Decide?.
- Draft the first version with the 10 sections, concisely.
- Review with legal, IT, HR, and business areas.
- Approve with the executive team and publish alongside the employee one-page rules.
- Train, monitor, and review after six months.
Common Mistakes
- Copying another company’s policy without adapting to actual uses and risks.
- Prohibiting without offering alternatives: use continues but hidden.
- Writing for lawyers: if managers don’t understand, the policy is not applied.
- Not naming responsible parties: rules without owners are not enforced.
What to Do Now
- Check if the company covers the 10 sections in any document.
- Draft missing sections starting with roles, data, and tools.
- Publish the one-page employee version alongside the policy.
To create an applicable and proportional AI policy, explore dooop’s AI Governance practice.
Frequently Asked Questions
Does the policy need board approval? In companies with a board, it is recommended that the board is aware of the principles and risk appetite. The policy itself is usually approved by the executive board.
How often should the policy be reviewed? At least once a year, and whenever relevant tools, uses, or rules emerge. In the first years, semiannual reviews are often necessary.
Should the policy mention specific tools? The list of approved tools should be in an updatable annex, not in the policy body, to avoid requiring new approval with each change.
Also Read
About dooop
dooop is a consultancy based in Caxias do Sul (RS) that prepares leaders and organizations to transform artificial intelligence into business capability through strategy, governance, and training.