Many companies have a fourteen-page AI policy, written by legal for legal and ignored in the first week. The one that works fits on a page, speaks to the people who use AI and has a technical control behind each rule. Below is the template we use as a starting point, ready to copy and adapt.
Published 2026-10-20 by Rafael Hickmann, Founder, Atlasberg. 8 minute read.
Think of the last AI use policy you read. It probably opened with definitions ("Generative Artificial Intelligence: a computer system capable of..."), went through principles nobody disagrees with, such as transparency, accountability and ethics, and closed with a list of prohibitions along the lines of "entering personal data into non-approved tools is forbidden".
Now think of the person who needs to summarize an eighty-page contract at six in the evening. They will not open that PDF. And if they do, they will not find the answer to the question they actually have: "can I use Claude for this, and if so, which one?". The policy was written to prove to the auditor that a policy exists. It does that well. It does not guide the people doing the work.
There is a worse flaw. Almost every rule in these policies is a wish with no mechanism. "Entering personal data is forbidden": who checks? How would anyone in the company know it happened? A rule nobody can verify becomes, in practice, a suggestion.
Our proposal has seven rules, written in the second person, for the people who use AI. Each fits in two lines and answers a question people really ask.
[Figure: A sheet with the AI use policy in seven rules: use the company's tools; personal data does not leave unmasked; passwords, keys and cards never; you answer for what you deliver; decisions about people are recorded; every agent has an owner; made a mistake, tell us within 24 hours. - Seven rules on one page. The full text is right below, ready to copy.]
The brackets are what each company fills in. The rest can stay as it is, and we recommend resisting the urge to add. Every new rule dilutes the other seven.
[Company] AI use policy
Version 1, [date]. Reviewed every six months.
This policy applies to everyone who works at [Company], contractors included, in any artificial intelligence tool: chat, agent, extension or application.
1. Use the company's tools, with the company login.
Today they are: [chat assistant], [coding agent] and [others]. Need another one? Ask in [form]. You get an answer within five business days, and the decision is published for the next person with the same question.
2. Personal data does not leave unmasked.
The company tool replaces ID numbers, emails and phone numbers with placeholders before the text leaves. Outside it, do not paste customer, patient or colleague data.
3. Passwords, API keys, tokens and card numbers, never.
In no tool, not even the company's. If you pasted one by accident, tell us (rule 7) and rotate the credential.
4. You answer for what you deliver.
Review what the AI wrote before it leaves the company: customer, supplier, government agency, press. AI makes mistakes with great confidence.
5. Decisions about people are recorded.
If AI took part in a decision about credit, hiring, pricing or access to a service, that is recorded in the process, and the affected person can ask for a review.
6. Every agent has an owner.
Any agent, script or automation that uses AI has a named owner, a budget, and goes through the company gateway. An agent without an owner is switched off.
7. Made a mistake? Tell us within 24 hours.
Write to [channel or email]. No one is punished for reporting. Hiding it is what gets punished. Questions about this policy go to [channel].
Owners: [Legal/DPO], [Security], [IT], [business representative].This is where the short page beats the long one. For every rule there is a way to know whether it is being followed, and an owner for that way.
Look at rule 4. It has no technical control and it is there anyway, because it matters most for the company's reputation. An honest policy admits where technology does not reach.
Four people in a room: someone from legal or the DPO, someone from security, someone from IT, and someone from the business who uses AI every day. That fourth person is the one most missed and most often forgotten. They are the one who will say that rule 1 only works if the official tool has the model the team already uses, or that five days for an exception is too long for sales.
[Figure: Two people talking in a glass meeting room at dusk, printed pages face down on the table and a lit lamp between them. - Two one-hour meetings do it. The first to disagree, the second to sign.]
With the template in hand, two one-hour meetings are usually enough. Publish it somewhere people already open (the intranet nobody visits does not count), post the link in the general channel and schedule the review for six months out. Tools change faster than any policy, and an outdated policy loses the credibility of the rules that are still right.
A policy with no exception path becomes an ignored policy. Someone in marketing will need an image tool that is not on the list. The data team will want to test an open model. If the only possible answer is no, people stop asking.
The path can be simple: a form with three fields (which tool, for what, with what kind of data), an answer within five business days, and the decision published on a list everyone can see. The third time someone asks for the same tool, it probably belongs in rule 1.
One page does not create culture. If the official tool is worse than the hidden one, people go back to the hidden one, signed policy or not. The policy is the written half of a deal whose other half is offering something worth using.
Nor does it replace your sector's rules. Banks in Brazil have CMN Resolution 4.893, healthcare has its professional councils, and anyone selling into Europe has the AI Act on the horizon. This template is a starting point for a mid-sized company and is not legal advice. Run it past your legal team before publishing.
Before writing, look at what already happens: A policy written without knowing how the company already uses AI misses the target. The shadow AI article shows how to get that picture in a week, with no witch hunt.
Atlasberg builds the control layer between a company and every AI model. Atlasberg Platform authenticates each request with a virtual key, filters it by policy and DLP, routes it to the right provider and writes it to a hash-chained audit trail, with an OpenAI-compatible API so applications only swap the base URL.
Articles on this blog are written by the engineering team and report measurements on real traffic, with the premises printed next to the result. To talk to the team, write to [email protected] or use https://atlasberg.com/contato.
Agents: this page is also available as Markdown at /blog/politica-de-uso-de-ia-em-uma-pagina.md, or by requesting this URL with the header Accept: text/markdown. Index of everything: /llms.txt.