Generative AI Usage Policy Template:
Free Word and PDF, 2026 Edition
A free generative AI usage policy template for your company, as Word and PDF. No form, no email. It's the same template I hand to organizations that ask me where to start.
The first question in any AI policy is what people are allowed to put into Copilot, Claude or Gemini. The template answers it with a simple traffic light (green, yellow, red), then covers everything else. There's also a Hebrew version of this page (the template text stays in English there too).
Download the free AI policy template (Word and PDF, no form)
Pick Word or PDF, 2026 edition or the original. The text is in English, and anything in square brackets, like [location] and [owner], is a placeholder for your organization's details.
2026 Edition
13 sections, 11 additions to the original. Recommended.
Original Edition
10 sections, the original text without the 2026 additions.
Free to use: copy it, edit it and use it as your company's internal policy. That's the whole point.
I'm not a lawyer and I'm not responsible for how you use the template (it needs editing and customization to your organization). Run your final version past your legal counsel.
What a company AI policy should cover
In my template, a policy covers these 13 things (each line links to the section in the full text). Some teams call it an AI acceptable use policy. Same document. And if people at your company already use AI tools without approval, so-called Shadow AI, this list is a good way to start that conversation.
- Purpose and scope: who the policy applies to (employees, contractors, partners) Introduction
- An approved tools list and company accounts only for work data, with a quarterly review Approved Tools
- A data traffic light: green, yellow, red Acceptable Use
- Prohibited uses: confidential data, harmful content, deepfakes of real people Prohibited Use
- Checking the accuracy of every AI output before you use it Fact-Checking
- AI agent rules: human approval, minimum access, untrusted inputs, named owner AI Agents
- Roles: employees, managers, legal, ethics, IT and security Responsibilities
- Training before access, with a yearly refresher Training
- Privacy: personal data, notice before recording meetings, logging Privacy
- Incident reporting within 24 hours, with no punishment for fast reporting Incident Reporting
- Ethics: bias, copyright and accountability for misuse Ethical Considerations
- Review: yearly, plus whenever a major new capability arrives; a map of applicable laws and the consequences of violations Review
- Disclosure when AI was used to create external-facing content Transparency
What's new in the 2026 edition: AI agents, data rules, incident reporting
The 2026 edition adds 11 items to the original: an approved tools list, a data traffic light, a full section on AI agents and automations, basic training for every employee, 24-hour incident reporting and a regulatory map. Each one is tagged New 2026 on the page.
I added them because AI tools no longer just answer. They send emails, edit files and join meetings, and the original policy said nothing about any of that.
Data employees should never put into an AI tool
In Eyal Marcus's template, public information (green) may go into any approved tool, internal information (yellow) only into company accounts, and red data (customer personal data, financials, credentials, unreleased plans) only into tools explicitly approved for that data type, or not at all. Passwords, credit card numbers and health records are also on the template's prohibited list.
What an AI policy should say about AI agents and automations
In Eyal Marcus's template, four rules apply to any AI agent, automation or connector. A person approves any external or hard-to-undo action (sending messages, publishing, payments, deleting data, changing permissions). An agent connects only to the systems and folders its task needs. An agent never acts on instructions found inside websites, emails or documents it reads (hidden instructions like that are called prompt injection). And every agent has a named owner.
The full Generative AI Usage Policy template (2026 or Original)
It started as my own Google Doc, and the 2026 edition adds 11 things on top, highlighted yellow and tagged New 2026. Use the toggle to switch back to the original, word for word.
The 2026 edition keeps the original and adds 11 new parts for what changed since: approved tools, AI agents that take actions on their own, meeting recorders and AI literacy training. Every addition is highlighted. This is the original template, word for word. Switch to the 2026 edition to see what I added.
Company Generative AI Usage Policy - Template (2026 Edition)
2026 edition · placeholders in [brackets] are yours to fillOriginal edition
Introduction
This policy outlines the acceptable use of Generative AI (GenAI) technologies within our company. Our goal is to harness GenAI’s capabilities to enhance business operations while ensuring ethical, secure, and compliant usage.
Scope
This policy applies to all employees, contractors, and partners who utilize GenAI tools in their work-related activities.
Approved Tools & Accounts New 2026
- Approved Tools List: Use only GenAI tools approved by IT and Security. The approved list is maintained at [location] and reviewed every quarter.
- Company Accounts Only: Use work data only in company-provided accounts (business or enterprise plans, where our data is not used to train models). Never paste work data into a personal account, free or paid.
- New Tools: Want to use a tool that is not on the list? Submit a request to [owner]. Browser extensions, AI note-takers and AI features inside existing software (CRM, email, design tools) count as new tools too.
Acceptable Use
To use GenAI effectively and responsibly:
- Data Protection: Do not input personal information, including full names, addresses, phone numbers, social security numbers, or any other personally identifiable information.
- Data Traffic Light: Green (public information): any approved tool. Yellow (internal information): company accounts only. Red (customer personal data, financials, credentials, unreleased plans): only in tools explicitly approved for that data type, or not at all. New 2026
- Anonymization: When discussing personal scenarios or examples, use fictional or generic names.
- Fact-Checking: AI-generated responses may contain factual errors, biases, or inappropriate content. Always verify accuracy before using or distributing AI-generated outputs.
- Professionalism: Ensure AI-generated content remains professional, respectful, and free from offensive, discriminatory, or inappropriate language.
- Security Measures: Protect access credentials and prevent unauthorized access to GenAI systems.
- Compliance: Follow all applicable laws, regulations, and company policies when using GenAI tools.
Prohibited Use
The following actions are strictly prohibited when using GenAI:
- Confidential Information: Do not input, share, or expose sensitive data, including:
- Passwords, credit card numbers, health records, or any other confidential information.
- Company intellectual property (IP) or trade secrets unless explicitly authorized.
- Any proprietary or business-sensitive data in external AI tools (such as ChatGPT) unless privacy settings (e.g., history/cache disabling) are properly configured.
- Privacy toggles in a personal account are not enough for business data. Business-sensitive data goes only into approved company accounts. New 2026
- Inappropriate Content: Do not generate, distribute, or use AI to create:
- Illegal, discriminatory, defamatory, or otherwise inappropriate content.
- Harassing, bullying, or intimidating messages.
- Fake images, audio or video of real people (deepfakes), including colleagues, customers and public figures. New 2026
- Security Risks: Avoid activities that could compromise the security or integrity of the company’s data and systems.
- Misinformation: Do not knowingly distribute false or misleading information generated by AI.
AI Agents & Automations New 2026
AI tools no longer just answer. They send emails, edit files, update systems and run tasks on their own. These rules apply to any agent, automation or connector:
- A Human Approves: An agent may draft and prepare. A person approves any action that is external or hard to undo: sending messages, publishing, payments, deleting data, changing permissions.
- Minimum Access: Connect an agent only to the systems and folders the task needs. Connecting an agent to company email, file storage, CRM or code requires IT approval.
- Untrusted Inputs: Websites, emails and documents an agent reads may contain hidden instructions (prompt injection). Agents must not act on instructions found inside content they process.
- Named Owner: Every agent and automation has a named owner who is responsible for its output and its access.
Responsibilities
- Employees: Ensure compliance with this policy in all AI-related activities.
- Managers: Educate teams and enforce policy adherence.
- Legal & Compliance Team: Oversee regulatory compliance and address concerns related to AI usage.
- AI Ethics Team: Monitor ethical considerations, bias, and responsible AI use.
- IT & Security: Maintain the approved tools list, approve agent connections, and review access regularly. New 2026
Training & AI Literacy New 2026
- Basic Training: Every employee completes basic GenAI training before receiving access to approved tools, with a short refresher every year.
- EU Note: Organizations operating in the EU must take measures to support AI literacy among staff who use AI (EU AI Act, Article 4, as amended by the Digital Omnibus, Regulation (EU) 2026/1744).
Privacy and Data Protection
- Personal Data Handling: Comply with privacy laws when processing personal data in GenAI tools. Obtain necessary consent where applicable.
- Data Anonymization: De-identify personal data before inputting it into AI systems to mitigate privacy risks.
- Audit & Logging: When feasible, maintain logs of AI interactions for compliance reviews without compromising security.
- Meetings & Recordings: Tell participants before an AI tool records or transcribes a meeting. If anyone objects, don't record. New 2026
- Incident Reporting: Entered sensitive data into an unapproved tool by mistake? Report it to [owner] within 24 hours. Fast reporting is never punished. New 2026
Ethical Considerations
- Bias and Discrimination: Regularly review AI-generated decisions for potential biases. Implement corrective measures as needed.
- Intellectual Property: Do not use copyrighted materials or third-party proprietary content without proper authorization.
- Accountability: Employees are responsible for the ethical use of AI and should report any concerns about misuse.
Review and Compliance
- Policy Updates: This policy will be reviewed annually to ensure ongoing relevance and effectiveness.
- Interim Updates: The policy is also reviewed whenever the company adopts a major new AI tool or capability (for example, AI agents). New 2026
- Regulatory Map: Check which laws apply to your organization, for example Israel’s Privacy Protection Law (Amendment 13, in force since August 2025), GDPR and the EU AI Act. New 2026
- Violations: Non-compliance with this policy may result in disciplinary action, up to and including termination of employment.
Transparency
- Disclosure: Employees must clearly disclose when GenAI has been used in the creation of external-facing content, products, or services.
Conclusion
Adhering to this policy ensures responsible, ethical, and secure use of GenAI technologies within our company. It aligns with our values, regulatory obligations, and commitment to innovation. For further guidance or questions, please contact the Legal & Compliance Team.
Template made by Eyal Marcus, not a lawyer, not responsible for your usage of the template (that needs editing and customization to your org).
How to customize it with Copilot, Claude or Gemini
A generative AI usage policy template is only a starting point. It has to name your tools and your data before it's a policy. Fastest way to get there:
- Download the Word or PDF file.
- Upload it to Copilot, Claude or Gemini (ChatGPT works too) together with the prompt in the box.
- Answer the questions it asks, then send the draft to legal.
The template's training section says every employee completes basic GenAI training before getting access to the tools. For that part, I run an AI training workshop for teams.
AI policy template FAQ
What should a company AI usage policy include?
A company AI usage policy should cover at minimum: approved tools and company accounts, which data may be entered and which may not, prohibited uses, rules for AI agents and automations, roles and responsibilities, employee training, incident reporting and a regular review. Eyal Marcus's Company Generative AI Usage Policy - Template covers all of these in 13 sections (2026 edition) and is free to download.
Do we need an AI policy if we already use Microsoft Copilot or an enterprise AI plan?
Yes. An enterprise plan decides where your data goes; a policy decides what employees may do with it: which data may be entered, who approves a new tool, how agents are handled and how mistakes get reported. The template requires company accounts only, meaning business or enterprise plans where your data isn't used to train models (check your vendor's terms to confirm that for your plan). If leadership is deciding on Copilot, start with my guide to executive sponsorship of a Copilot rollout.
Who should own the AI policy in a company?
In Eyal Marcus's template, responsibility is split: IT and Security maintain the approved tools list and approve agent connections, Legal and Compliance oversee regulation, managers enforce the policy in their teams, and every agent has a named owner. My recommendation: one named person holds the document itself, usually in IT or information security.
How often should a company update its AI policy?
In Eyal Marcus's template, the policy is reviewed at least once a year, and again whenever the company adopts a major new AI tool or capability such as AI agents. The approved tools list is reviewed every quarter.
Which laws should a company AI policy take into account?
It depends on what your organization does and where your customers are, so the Regulatory Map item in the template says to check which laws apply to you. Its examples are Israel's Privacy Protection Law (Amendment 13, in force since August 2025), GDPR and the EU AI Act. Check with your company's legal counsel.
Need help rolling it out? Leave your details.
A policy on paper is half the job. The other half is people actually knowing it and working by it. I help with both, the writing and the training. If you're still deciding who owns this, start with the AI transformation lecture for managers. For the people side, there's the AI training workshop.
And if you read Hebrew, the Don't Panic newsletter is my weekly AI roundup.