How to Set Up a Practical AI Usage Charter in Your Company

Artificial intelligence has become an essential tool across departments, company sizes and industries. Its growing use raises ethical, legal and organizational questions that must be anticipated, especially with the AI Act coming into force in 2026. An AI usage charter helps guide employees toward responsible, compliant practices. Notably, a large share of employees using tools such as ChatGPT at work do not discuss it with their supervisors, which makes open dialogue and awareness all the more necessary.

An AI usage charter is a company-specific document defining the general conditions for using AI tools internally. It is not legally mandatory, but it provides practical, operational guidance: which uses are permitted or forbidden, which best practices to follow, and what sanctions may apply in case of misuse. It should be written in clear language that every employee can understand.

Before drafting, companies should reflect internally and involve all stakeholders. Useful questions include: Which AI tools are employees already using? In which situations should AI be avoided, such as sharing customer data or trade secrets? Is AI use aligned with corporate values? What current practices exist, such as prompt use or specialized writing? Which good practices could be shared, for example a library of common prompts? Which tools on the market fit the company's needs, and what do their terms of use say? How can employees be supported through change management and training? Answers to these questions form the basis of a clear and precise charter.

The charter has no fixed formal requirements. It can take the form of a question-and-answer document or a more formal, operational text resembling an IT charter. It can be annexed to the employment contract and/or internal rules, giving it regulatory value and making it binding on all employees. Alternatively, it can be distributed internally for information only; this still positively shapes the company's AI roadmap but carries no binding force.

At a minimum, the charter should include: a preamble explaining its objectives; definitions of key terms such as generative AI, sensitive data and trade secrets; its purpose and scope; the authorized uses, ideally illustrated with concrete examples; the prohibited uses, with the reasons behind them; the control measures in place; the potential sanctions; the training offered to employees; and a concluding section. Its enforceability should also be stated, subject to compliance with labor code requirements such as consultation of the works council (CSE).

Authorized uses should be described concretely, for instance using ChatGPT to help draft emails. Equally important is transparency about prohibited uses. For example, no personal data of clients should appear in prompts, and certain contracts signed by the company may impose extended confidentiality obligations covering the use of information by AI tools. Stating the reasons behind each prohibition helps employees understand and respect the rules.

To protect the business, companies may block unauthorized websites and limit access to sensitive data to employees who genuinely need it. The charter should describe these measures openly. Where the charter carries binding force, it should also specify possible disciplinary sanctions, such as warnings, in proportion to the seriousness of breaches.

A charter is only effective if employees understand and apply it. The company should offer training on the proper use of AI tools, through workshops, sessions or practical guides. Awareness initiatives encourage open discussion, reduce hidden use, and help the organization adopt AI with confidence and consistency.

When annexed to the employment contract or internal rules, and when the statutory consultation requirements of the Labor Code are respected (CSE, labor inspectorate), the charter gains binding value within the company. This transforms it from a recommendation into an enforceable framework, which strengthens legal certainty for both employer and employees.

Creating the charter typically involves six steps: assess how employees use AI, ensuring every function such as HR, communications and IT is represented; list good and bad practices; identify potential tools and review their terms of use; map sensitive data within the company; draft the document; and communicate it to employees with supporting training. Because tools and regulations evolve quickly, the charter should be reviewed periodically to integrate new tools and changes in the law. Specialized technology firms and lawyers can support this process where needed.