Responsible AI Use Policy (Including Generative AI)

How to use this document

• What it is for. This is the base policy that sets which AI tools staff may use, for what, with what information and under which controls. It is the day-one containment measure against unauthorized AI use: approve it before any other AI document.
• It is modular. A core (Sections 1 to 11) applies to every organization. Modules 12 to 15 are kept only if the organization integrates models through APIs, hosts its own models, trains models or uses agents, and Section 16 only if it operates in a sector with its own rules. Choose the modules with the "Module selection" table.
• Levels. Paragraphs marked [BASIC LEVEL], [STANDARD LEVEL] or [REINFORCED LEVEL] apply only at that level. The Basic level (under about 50 people, only purchased tools, no sensitive data and no decisions about people) is a complete policy on its own.
• Who should own it. The AI lead, supported by Information security, Legal, the Data protection officer (or the country's equivalent role) and Human Resources. Enter the function in [RESPONSIBLE FUNCTION] and the person in [OWNER].
• Decisions to make first. Decide which tools are authorized (Section 4), what information may be used with each one (Section 6), which uses go to each approval lane (Section 5.2) and how the policy connects to your disciplinary rules (Section 11).
• Fields to complete. Replace the bracketed text, such as [ORGANIZATION NAME], [AI GOVERNANCE EMAIL] and [COMPLETE]. Keep [OPTIONAL] clauses only if they apply, and delete the marker when you keep them.
• Country variants. There are no country variants. Use "Related regulatory references" to identify the rules that may apply and adjust Sections 5.3, 6 and 8 if any of them calls for something more.
• Review. Ask your internal or external legal counsel to review the adapted version, especially the prohibitions, personal data, the link with employment contracts and the disciplinary rules. Consult worker representatives where employment law provides for it.
• Approval and publication. Have Management approve it, record the approval in "Version history," publish it where all staff can reach it and collect acknowledgments (aid F). The implementation aids are for internal use by the team that rolls out the policy.

Module selection

Profiles add up: an organization can be P1 and P2 and P5 at the same time. Levels do not add up downward: the Reinforced level also keeps the Standard content.

Profile or level	When it applies	Sections to keep
Core	Always	Sections 1 to 11 and aids B, C, D, F and "Related documents"
P1	Uses AI inside software it buys: assistants (ChatGPT, Copilot, Gemini…) and AI features in SaaS	Core only
P2	Integrates models through APIs or RAG into its own processes or products	Core and Section 12
P3	Hosts models on its own or rented infrastructure, including open-weight models from any origin	Core and Section 13
P4	Trains or fine-tunes models	Core and Section 14
P5	Uses agents that act in systems (send, buy, change records, run code)	Core and Section 15
Sector	Financial services and insurance, health, Human Resources or public sector	Core and the matching subsection of Section 16
Basic level	Under about 50 people, P1 only, no sensitive data and no decisions about people	Core, [BASIC LEVEL] paragraphs and aid A.1
Standard level	Default for everyone else	Core, [STANDARD LEVEL] paragraphs and aid A.2
Reinforced level	Any High-risk system, regulated sector, or P3 to P5 in production	Core, [STANDARD LEVEL] and [REINFORCED LEVEL] paragraphs, and aid A.2

Delete the sections, paragraphs and aids that do not match your profiles and level, and renumber if you wish. If you keep only the core, also delete the references to Sections 12 to 16.

Responsible AI Use Policy (Including Generative AI)

Field	Value
Organization	[LEGAL ENTITY NAME]
Owning function	[RESPONSIBLE FUNCTION]
Policy owner	[OWNER]
Profiles and level adopted	[COMPLETE: e.g., P1 + P2, Standard level]
Approved by	[APPROVED BY]
Effective date	[DATE]
Review frequency	[REVIEW FREQUENCY]
Contact for questions	[AI GOVERNANCE EMAIL]

1. Purpose

[ORGANIZATION NAME] uses artificial intelligence to improve its work and the services it provides. This policy sets the rules for doing so safely, lawfully, transparently and in line with our values. Its goals are to:

a) capture the benefits of AI, including generative AI, with controlled risks;
b) protect confidential information and personal data;
c) make sure people remain accountable for the decisions and content they produce with AI;
d) avoid uses that may cause harm, discrimination or deception;
e) assign clear responsibilities and keep evidence of how we manage AI.

2. Scope and definitions

2.1 This policy applies to all employees, managers and interns, to contractors and consultants, and to any third party acting on behalf of [ORGANIZATION NAME] or using AI with the organization's information or resources ("staff"). It applies on the organization's devices, accounts or networks and also on personal devices or accounts used for the organization's work.

2.2 It covers general-purpose generative AI tools (chat assistants, text, image, audio or video generators, coding assistants, meeting transcribers, browser extensions and AI features built into office software), the AI systems the organization buys, integrates, hosts, trains or deploys, the data used with them and the outputs they generate.

2.3 It complements, and does not replace, the information security, privacy, acceptable use of technology resources, confidentiality and procurement policies and the code of conduct. In case of conflict, the more protective rule applies.

2.4 Definitions:

• AI system: a machine-based system that, from the input it receives, infers how to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments. [OPTIONAL] Replace with the definition in the rule that applies to the organization.
• Authorized tool: an AI tool, feature or system recorded as authorized in the AI System Inventory, under the conditions stated there.
• Unauthorized tool: any other, including free or consumer versions of tools the organization has licensed in a corporate version.
• Prompt: text, a file or other information entered into an AI tool.
• Output: content, an answer, a classification, a score or a decision produced by an AI system.
• Decision about people: an AI use that can significantly affect a person's rights, opportunities, safety or access to services; for example, in employment, credit, insurance, education, health, biometrics or public benefits.
• AI agent: an AI system that, besides generating content, can take actions on its own, such as sending messages, changing records, carrying out transactions or running code.
• Confidential information, personal data and sensitive data: as defined in the information classification policy and the privacy policy of [ORGANIZATION NAME].