AI usage policy template for European teams

Practical guide · 21 Oct 2026

This is an operational starting point, not legal advice or a compliance certificate. Your legal and security teams must assess your specific uses.

Replace every bracketed field before sharing this policy. Confirm each approved tool with your security owner and explain the rules to your team.

1. Purpose and ownership
[Organisation] permits AI for [approved tasks]. [Policy owner] maintains the approved-tool list, answers questions and reviews this policy on [review date]. Separate approval is required for new tasks or tools.

2. Approved tools and individual access
Use only tools and models on [approved-tool list], with organisation-approved accounts and individually assigned keys. Do not share keys or put them in source code. Ask [access contact] for access, a budget and an expiry date.

3. N1 Public
Submit only information authorised for external sharing. A public webpage may still contain personal data or protected material. Check permission before reusing it. Public availability is not permission to process personal data.

4. N2 Internal
Internal procedures and working documents may go only to environments explicitly approved for N2 Internal. Remove unnecessary details. Check the model, provider and permitted data level before uploading a file or connecting a document source.

5. N3 Confidential
Customer files, non-public contracts and other confidential material require specific approval and documented safeguards. Do not submit them to consumer chat services. European hosting alone is insufficient: assess retention, training reuse, access, contracts and international transfers.

6. Experimental
Use synthetic examples or information authorised for public sharing unless a separate assessment permits more. Experimental is not a higher confidentiality level. If a document is unclassified, ask [security contact] before submitting it.

7. Minimum necessary inputs
Include only what the task needs. Remove identifiers where possible; removing names does not necessarily anonymise a file. Personal data needs its own assessment regardless of classification. Never submit passwords, access tokens or provider keys as prompts.

8. Human review and consequential decisions
The employee using AI remains responsible for the final result. Before sharing, publishing or deploying it, verify facts, calculations, sources, rights and code behaviour. Do not delegate decisions affecting people to AI alone. Recruitment and similar uses require specialist review before introduction.

9. Reporting and review
Report accidental disclosure, incorrect access or unsafe results to [incident contact] promptly, without copying sensitive content into the report. [Security owner] decides containment and follow-up. Train employees before granting access and review approvals whenever a provider or use changes.

Source and scope
This template draws on the CNIL's guidance published on 18 July 2024. The four data levels are AI-GATEWAY's operational framework, not a CNIL classification. Privacy, employment, sector rules and AI Act obligations require a separate assessment.

https://www.cnil.fr/fr/les-questions-reponses-de-la-cnil-sur-lutilisation-dun-systeme-dia-generative

https://ai-gateway.nanocorp.app/guides/ai-usage-policy