Artificial intelligence has settled into companies without any fanfare. One employee tries ChatGPT to draft an email, another asks an AI to summarize a contract, a third generates images for social media. Before the business leader even notices, internal, customer, or strategic data is passing through tools whose terms of use no one has ever reviewed.
An AI usage charter fixes this problem. This document, often short, sets out who can use what, under what conditions, with what data. It isn't meant to ban things: it's meant to make AI use predictable, traceable, and compliant. For an SMB or an independent professional, this is the first act of AI governance. And it's often the only one needed for months.
Key Takeaways
- According to a June 2025 study by Bpifrance Le Lab, 43% of SMBs and mid-sized companies have already adopted AI.
- An AI charter governs which tools are allowed, which data can be used, and which cases require mandatory human review.
- GDPR, the AI Act, and employer liability require sensitive uses to be documented.
- A good charter template fits on one A4 page and reads in under ten minutes.
- NexeAI supports SMBs in drafting and rolling out their AI charter.
What is an AI usage charter
An AI usage charter is an internal document that defines the rules for using artificial intelligence tools within the company. It answers five simple questions: who can use AI, for what purpose, with what data, in which tools, and under what oversight.
It doesn't replace the IT security policy or the internal rules of procedure. It complements them by addressing one specific point: the line between what the company allows and what it forbids when it comes to AI. That line varies by sector. A law firm won't accept the same uses as a real estate agency. A software services company won't have the same constraints as a restaurant.
The goal isn't to produce a twenty-page legal document. A useful charter is understood on the first read. If an employee has to reread it three times to know whether they can use a tool, the charter has failed.
Why an SMB needs an AI charter today
AI adoption is no longer marginal. According to a June 2025 study by Bpifrance Le Lab, 43% of SMBs and mid-sized companies have already adopted AI. That figure hides a more complex reality: in many companies, AI is used with no framework, no inventory, and no risk validation.
This lack of a framework creates three problems.
Data leaks. An employee who pastes a contract, a balance sheet, or a medical file into an online interface can breach professional secrecy or GDPR (the EU's General Data Protection Regulation). Even the best-known consumer tools temporarily store conversations and potentially use them to improve their models.
Employer liability. In the event of harm caused by unfair or negligent use of AI, the business leader can be held liable. An employee who generates copyrighted images, drafts an incorrect medical opinion, or automates a discriminatory decision exposes the company. An audit of your AI risks helps identify these situations before they become problems.
Loss of trust. Customers and partners increasingly ask questions about AI use. A company unable to explain how it uses these tools looks like it isn't in control. A published charter, even a partial one, strengthens credibility. The most advanced companies build this step into a broader approach to AI in business.
The six points an AI charter must cover
An effective charter template rests on six sections. They cover the essentials without drowning the reader in theory.
1. Scope and definitions
The charter starts by saying who it applies to: all employees, interns, freelancers, subcontractors. It then defines what it means by "AI tool": conversational assistants, text, image, code, and video generators, transcription, translation, and summarization tools, and any software that embeds a language model.
This section avoids ambiguity. An employee using the writing feature in their office software needs to know whether the charter applies.
2. Approved and banned tools
The charter lists the tools the company has approved. For each one, it states the allowed use, the accepted level of data confidentiality, and which account to use. It also specifies banned tools, even if they're free or popular.
It's useful to sort tools into three categories:
- Self-service: tools approved for everyday use without prior authorization.
- Prior authorization required: tools reserved for certain roles or certain data.
- Banned: tools that don't meet the company's confidentiality or security requirements.
3. Data that can and cannot be used
This is the most technical and most important section. The charter must clearly state which data can be entered into an AI tool. General rule: no personal data, no confidential customer data, no information covered by professional secrecy, no non-public strategic information into a consumer tool without approval.
It also spells out exceptions. For example, a tool self-hosted on the company's own servers may process sensitive data. A tool certified for health data hosting (HDS, the French health-data hosting certification) may be used for health data. Every exception must be justified.
4. Cases requiring mandatory human review
AI doesn't replace human judgment in every case. The charter lists the situations where a human operator must approve, correct, or sign off on the AI's work. Common examples: advice to customers, financial decisions, diagnoses, content published in the company's name, responses to authorities.
This section guards against two extremes: blanket bans, which paralyze teams, and blind trust, which exposes the company to errors.
5. Intellectual property and content verification
The charter reminds everyone that the company remains liable for content produced with AI assistance. It requires fact-checking, proofreading text, checking sources, and making sure generated images or code don't infringe third-party rights.
It can also set a transparency rule: disclosing when content was produced or assisted by AI, particularly in external communications.
6. Sanctions and updates
The charter specifies the consequences of non-compliance. These range from a warning to disciplinary action depending on severity. Finally, it states who approves changes to the charter and how often it's reviewed. An annual update is a minimum, with a quick review whenever a major new tool appears.
AI charter template to adapt
Here's a template you can copy and complete. It fits on one page and covers the six points above.
Artificial Intelligence Usage Charter
Company: [name] Effective date: [date] Charter owner: [name / role]
1. Purpose This charter sets the rules for using artificial intelligence tools within the company. It applies to all employees, regardless of contract type.
2. Approved tools The following tools are approved for professional use: [list]. Any other AI tool requires prior request to [owner].
3. Approved data Only public, anonymized, or non-sensitive internal data may be entered into approved tools. The following are banned: customers' personal data, confidential financial data, trade secrets, files covered by professional secrecy.
4. Human review Any content produced by AI and intended for use in the company's name must be proofread, checked, and approved by a human before it is distributed.
5. Intellectual property The company alone remains liable for content generated with AI assistance. The employee ensures that content complies with third-party rights.
6. Sanctions Non-compliance with this charter exposes the employee to disciplinary action proportionate to the severity of the breach.
7. Updates This charter is reviewed every year and whenever the tools in use change significantly.
This template is a starting point. It doesn't replace legal advice tailored to your sector. Regulated professions must supplement these rules with their own specific obligations.
Adapting the charter to your sector
A generic charter is better than no charter. A charter tailored to your trade is better than a generic one.
Law firms and legal professions. Professional secrecy and the confidentiality of deliberations forbid entering client files into a tool hosted outside the European Union. The charter must require local or self-hosted tools, with traceable access. Our support for the legal sector
Accountants and statutory auditors. Clients' tax and payroll data is protected. The charter bans entering it into consumer tools and specifies where AI can help draft standard documents without access to named individuals' data.
Doctors and healthcare professionals. Health data falls under medical confidentiality. Only tools certified for health data hosting (HDS) and hosted in France may be used. The charter must require systematic verification of any medical information generated by AI.
Real estate agencies. Sellers', buyers', and tenants' data is personal. The charter governs the use of AI to draft listings, property descriptions, or replies to inquiries, while banning the entry of complete files.
Tradespeople and shopkeepers. The risks mainly concern customer data protection and checking advertising content. A simple charter, focused on approved tools and human review, is often enough.
Getting the charter adopted in the company
A document sitting somewhere on the server serves no purpose. The charter needs to become a reflex. Three actions make adoption easier.
Training. Hold a twenty-minute presentation meeting. Show concrete examples: a customer email pasted into an unapproved tool, an image generated with copyright issues, an AI reply sent without review. The concrete convinces more than the theoretical. To go further, business AI training helps teams tell approved uses apart from risky ones.
Building it into onboarding. Every new employee signs the charter when they join. This creates a habit and prevents bad practices from taking hold. This signature fits naturally into a broader guide to using AI in business.
A point of contact. Appoint a go-to person for questions. An employee who's unsure needs to know where to ask. This person keeps the list of approved tools up to date and handles edge cases.
FAQ
Is an AI charter mandatory in France?
There's currently no explicit legal requirement to draft an AI charter. However, GDPR, the AI Act, and labor law require companies to manage the risks tied to the tools their employees use. A charter is the simplest way to demonstrate that this is under control.
What's the difference between an AI charter and an IT security policy?
The IT security policy covers access, passwords, networks, and equipment. The AI charter specifically covers the use of artificial intelligence: approved tools, data that can be entered, human review. The two documents complement each other.
Can an AI charter be imposed on freelancers and subcontractors?
Yes, to the extent they access data or act on the company's behalf. The charter should be built into the contract or added as an amendment. The same confidentiality rules apply.
Is an AI tool hosted in France automatically compliant?
No. Hosting in France or Europe is a necessary condition for sensitive data, but not a sufficient one. You also need to check the terms of service, the certification level, whether data is reused for training, and access traceability.
How long does it take to set up an AI charter?
A simple first version can be drafted in half a day. The longest phase is usually internal consultation and approval by the business leader. Rollout, with training and signatures, spreads over a few days.
Conclusion
An AI usage charter isn't a brake. It's a clarifying tool that gives teams the right to use AI within a secure scope. It reduces legal risk, protects the company's reputation, and reassures customers.
For an SMB or an independent professional, the process stays simple. A one-page template, adapted to the trade, signed by employees, and reviewed once a year is enough to turn informal use into managed practice.
If you'd like your AI charter drafted by a team that understands the constraints of French SMBs, contact us. We help you identify your risks, choose your tools, and train your teams.
