Does my company need an AI policy?
If your staff use AI tools or AI talks to your customers, yes. No US law requires most companies to have a document called an AI policy, but several rules already expect its contents: staff training, AI disclosure, human review and records.
A written policy is the cheapest way to show you did those things. It tells staff which tools they may use and what data must never go into them, and it gives you something to point to if a regulator, client or court asks how you control AI. When we run AI consulting for a business, the risk notes in the roadmap use the same headings a good policy needs, so the policy usually comes out of that work rather than being written from a blank page. As part of paid consulting, we write the AI policy for each client to fit the brand: its voice, its customers, the data it holds and the tools its teams actually use.
We checked every rule on this page against its official source on October 30, 2026. This page explains the rules; it is not legal advice.
Which laws already expect parts of an AI policy?
The EU AI Act's AI literacy duty, Colorado's automated decision law, California's hiring and privacy rules, New York City's hiring audit law and the FTC's stance on AI claims each expect something a policy covers. Texas even rewards following NIST's AI framework.
Dates and record rules a policy has to meet
We built this table from the official texts. The right-hand column is our mapping of each rule to the policy section that answers it.
| Rule | Who it reaches | What it expects | Policy section that covers it | From |
|---|---|---|---|---|
| EU AI Act, Article 4 (AI literacy) | Providers and deployers of AI systems, including a company whose staff use ChatGPT for work, if the Act applies to it | "Measures to support the development of AI literacy" of staff; no certificate required | Training and approved tools | Applied February 2, 2025; supervision and enforcement from August 2, 2026 |
| Colorado SB 26-189 | Businesses using automated decision technology in consequential decisions | Notice at the point of interaction, explanation within 30 days of an adverse decision, human review, records for 3 years | Decisions about people, disclosure, records | January 1, 2027 |
| California CCPA ADMT regulations | CCPA-covered businesses using ADMT for significant decisions | Pre-use notice, opt-out and access rights, risk assessment | Decisions about people, disclosure | January 1, 2027 |
| California Civil Rights Council rules | Employers using automated-decision systems | No discrimination through the system; employment records, including automated-decision data, kept at least four years | Hiring tools, records | October 1, 2025 |
| NYC Local Law 144 | Employers hiring in New York City with automated employment decision tools | Bias audit within one year before use, public results summary, notice 10 business days before use | Hiring tools, vendors | Enforced since July 5, 2023 |
| Texas HB 149, section 552.105(e) | Anyone developing or deploying AI in Texas | A defense for a business that finds a violation through testing or by substantially complying with the NIST AI Risk Management Framework | Testing, governance structure | January 1, 2026 |
| FTC Act (Operation AI Comply, September 25, 2024) | Any US business | No deceptive AI claims; no AI-written fake reviews (the Rytr order) | Marketing and reviews | In force |
Two of these touch almost every company that uses AI: Article 4 if any of your AI output is used in the EU (our page on whether the EU AI Act applies to US companies explains the test), and the FTC rule on claims. The others depend on what the AI decides. Our page on US state AI laws for businesses covers the state rules in more detail.
What should an AI policy include?
Ten short sections: owner, approved tools, data rules, customer disclosure, decisions about people, human review, testing, records, training, and marketing claims. Each one answers a rule in the table above, so nothing in it is filler.
| Section | What to write | Why (rule it answers) |
|---|---|---|
| 1. Owner and review date | One named person owns the policy and the AI inventory; the date of the next review | NIST AI RMF "Govern" function; Colorado and California duties need someone accountable |
| 2. Approved tools | The list of AI tools staff may use, on company accounts, and how to request a new one | EU Article 4 literacy measures; data control |
| 3. Data rules | What never goes into a prompt: customer records, health data, passwords, client confidential material unless the tool is approved for it | Privacy law and client contracts; HIPAA for health data (see our HIPAA-compliant automation guide) |
| 4. Customer disclosure | Chat and voice agents say they are an AI at the start and when asked | Colorado Chatbot Safety Act; Texas health care disclosure; EU Article 50 |
| 5. Decisions about people | AI may not decide hiring, credit, housing, insurance, education or care on its own; list any tool that scores or ranks people | Colorado SB 26-189; California ADMT and employment rules; NYC LL144 |
| 6. Human review | Every agent has a handover path; anyone refused something can ask a person to look again | Colorado human review right; California human involvement test |
| 7. Testing before launch | Test cases, pass rules and who signs off; keep the log | Texas section 552.105(e) defense; NIST "Measure" |
| 8. Records | Keep decision records and AI data for at least four years | California four-year rule covers Colorado's three years |
| 9. Training | Short training on what the tools get wrong (made-up facts, outdated answers) and a simple training log | EU Article 4; the Commission says a log is optional but useful |
| 10. Marketing and reviews | No claims that AI does more than it does; no AI-written reviews or testimonials | FTC Operation AI Comply |
Sections 4, 6 and 7 are also build settings. In the agents we deliver, AI disclosure is on by default, every agent has a handover to a person, and we test against written cases before launch, as described in our guide on how to test an AI agent.
Does the EU AI Act require an AI policy?
Not a document by that name. Article 4 requires providers and deployers to take measures for staff AI literacy, and the European Commission says no certificate or set format is needed. A short policy plus a training log shows the measures simply.
The Commission's AI literacy questions and answers, last updated October 20, 2026, say "There is no one size fit all when it comes to AI literacy". They give the example of a company whose staff use ChatGPT to write advertising text or translate, which should tell those staff about risks such as hallucination. Organisations "can keep their own log" of trainings, but formal records are not required. Article 4 has applied since February 2, 2025, and national authorities supervise and enforce it from August 2, 2026. The Digital Omnibus amendments, in force since mid-July 2026, keep AI literacy as an obligation for providers and deployers.
How long should an AI policy be, and who should write it?
For most companies, two to four pages is enough. The person who owns operations or compliance should own it, with input from whoever runs your AI tools, and a lawyer should read the parts on hiring, credit, health or other regulated decisions.
A short policy that staff read beats a long one nobody opens. The NIST AI Risk Management Framework, released January 26, 2023 and "intended for voluntary use", gives four headings that work as an outline: Govern (who is responsible), Map (where AI is used and what can go wrong), Measure (how you test and track it), Manage (what you do when something breaks). NIST says the framework is being revised, so use the headings and keep the detail your own.
The length we suggest is our own working view from writing AI roadmaps; no rule sets a length.
How do we roll out an AI policy?
Start with an inventory of every AI tool in use, sort them into approved, needs review and stop, write the ten sections, train staff in one short session, then review the policy whenever you add an AI tool or a law changes.
Six steps from AI inventory to review date
- Inventory. Ask every team which AI tools they use, including free ones on personal accounts. Our AI readiness assessment checklist includes the inventory questions.
- Sort. Approved (company account, safe data), needs review (touches customers or decisions), stop (personal accounts with client data).
- Write. The ten sections above, in plain language.
- Train. One session, then a line in the training log.
- Build the rules in. Disclosure, handover and logging set inside the tools, so the policy does not rely on memory.
- Review. Each time a tool or law changes, and at least once a year.
Step 5 is where most policies fail, because the rules stay on paper. We set them inside the AI agents and AI workflows we build on your own accounts. The strategy call and first audit are free; paid consulting is quoted per business, and a small build of two or three automations is about $1,000 at the time of writing.
More questions about company AI policies
Is there a free AI policy template we can use?
The ten-section table on this page works as a template: copy the section names and write your own rules under each. Generic templates online are a fine start, but they cannot know which of your tools touch customers or decisions about people, and that is where the legal risk sits. Have a lawyer read any section on hiring, credit, housing or health decisions.
Should we ban ChatGPT and other AI tools at work?
A ban is hard to enforce, and staff who keep using AI on personal accounts put your data at more risk than approved tools would. A safer rule is approved tools on company accounts, a clear list of data that never goes into a prompt, and training on what the tools get wrong. The European Commission's AI literacy guidance uses staff writing ads with ChatGPT as a normal case to manage.
What is the difference between an AI policy and an AI acceptable use policy?
An acceptable use policy covers staff behaviour: which tools, which data, what is forbidden. A full AI policy adds the company's own systems: customer-facing agents, disclosure, decisions about people, testing, records and who owns them. A small company that only uses off-the-shelf tools can start with the acceptable use part and add the rest when it deploys its first agent.
Do we need to tell customers we use AI?
When an AI talks to them, increasingly yes. Colorado's Chatbot Safety Act requires disclosure by operators in scope from January 1, 2027, Texas requires it from health care providers, and the EU AI Act requires it for chat and voice agents serving EU users. Using AI behind the scenes to draft emails usually needs no notice, but your policy should say who decides.
How often should an AI policy be reviewed?
Whenever you add an AI tool, launch a customer-facing agent, or a rule you rely on changes, and at least once a year. In 2026 alone Colorado replaced its AI law and the EU amended the AI Act, so a policy written in 2025 may already cite the wrong rules. Put the next review date on the first page.
Does a small business need an AI policy?
A short one, yes, as soon as staff use AI with customer or client data. Texas's AI law applies to any person who deploys AI in Texas, regardless of size, and the FTC's rules on AI claims apply to every business. One page with approved tools, data rules and disclosure covers most of the risk for a small team.
Who should own the AI policy?
One named person, usually whoever owns operations or compliance, with the authority to approve or stop a tool. NIST's framework puts accountability under its Govern function for this reason. In smaller companies that is often the founder or operations lead; what matters is that staff know whom to ask before trying a new AI tool with company data.
Sources and further reading
- European Commission, AI literacy questions and answers (last updated October 20, 2026; read October 30, 2026)
- NIST, AI Risk Management Framework (read October 30, 2026)
- Colorado General Assembly, SB 26-189 and HB 26-1263
- California Privacy Protection Agency, approved regulation text (ADMT, sections 7200 and 7220)
- California Civil Rights Department, automated-decision system regulations release
- NYC Department of Consumer and Worker Protection, Automated Employment Decision Tools
- Texas Legislature, HB 149 enrolled text
- FTC, Operation AI Comply, September 25, 2024
