AI Usage Policy for a Company: A Ready Template

In short

An AI usage policy is an internal document that defines which AI tools are allowed in the company, what data must never be sent to them and who is responsible for what. Any company whose staff use ChatGPT, Claude, GigaChat or AI coding assistants needs one: without rules, people send customer databases and NDA-covered code to the cloud, and it is the company that answers for it. In Russia the fine for a personal data breach runs from 3 to 15 million ₽, and for a repeat breach up to 3% of annual revenue (Code of Administrative Offenses, Art. 13.11, as of July 2026). Below is the full template, section by section: data classification, roles, approving tools, an employee cheat sheet. Copy it, adapt it, adopt it by formal order. The complete template file is in the pinned post of the Telegram channel t.me/qvib.

Why you need a policy if the staff are "careful anyway"

Shadow AI means employees using AI tools without the company's knowledge: personal accounts, free plans, work data from a personal phone. It exists almost everywhere AI was never "officially adopted": the marketer uploads a CRM export to "segment the customers," the accountant a payment register, the developer a client's NDA-covered code.

The classic example is Samsung: in 2023 engineers sent confidential source code and internal materials to ChatGPT several times, after which the company banned public chatbots on work devices. The stakes have risen since then — these are the Russian fines for a personal data breach (Code of Administrative Offenses, Art. 13.11, as of July 2026):

Banning AI outright is the worst answer: these tools deliver a real speed-up (where and how much is in our hub on AI agents for business), and a total ban just pushes usage into the shadows. The job of a policy is not to forbid but to permit what is safe. Another argument: in July 2026 the State Duma passed a framework law on regulating AI (expected to take effect on 1 September 2026, with some provisions later; the final version contains no ban on foreign AI services). Requirements for business will get more detailed — a company with a policy adapts calmly, everyone else plays catch-up.

What data must never go into cloud AI

Personal data is any information relating to a directly or indirectly identified person: a name paired with a phone number, passport details, an address, health information (152-FZ, Russia's Personal Data Law). Trade secrets are information that has value because third parties do not know it: purchase prices, margins, customer and supplier databases (98-FZ). Neither category may be sent to a cloud LLM — nor may someone else's code or documents under NDA.

There are two reasons. First: free and personal plans on many services may use your conversations to further train their models — corporate plans and API access usually have that switched off, but every service has to be checked separately. Second: sending personal data to a foreign cloud service is a cross-border transfer, with its own legal grounds and a notification to Roskomnadzor (the Russian data protection regulator). A detailed legal breakdown is in our article on AI and 152-FZ.

AI usage policy template: the full text

Copy the sections below, insert your company name, cross out what does not apply and adopt it by order with signed acknowledgment. This is a practical guide, not legal advice: before adopting it, and for auditing your 152-FZ processes, show the document to a lawyer.

1. General provisions

• 1.1. This Policy sets the rules for using generative AI (ChatGPT, Claude, GigaChat, YandexGPT, AI coding assistants and others) by the Company's employees and contractors.
• 1.2. Using AI for work tasks is permitted and encouraged — provided this Policy is followed.
• 1.3. The Policy is binding on everyone with access to the Company's information, including freelancers and agencies.

2. Data classification

• 2.1. Green data — public information (website copy, job postings, published materials): may be used in any tool from the Approved Register.
• 2.2. Yellow data — internal information containing no personal data or trade secrets (drafts, instructions, de-identified examples): only in tools from the Register.
• 2.3. Red data — must never be sent to cloud AI services in any form: personal data of customers and employees; trade secrets (purchase prices, margins, contract terms, customer and supplier databases); code, documents and data under NDA; credentials (passwords, API keys, tokens, server access); unpublished financial statements.
• 2.4. When in doubt, data is treated as red; the category is confirmed by the data owner or the AI Officer.
• 2.5. Red data is de-identified before any use with AI: names and figures are replaced with "Customer N," "X ₽."

3. Tool register and approving new tools

• 3.1. The Company maintains a Register of approved AI tools: name, plan, permitted data categories, responsible person.
• 3.2. A new tool is onboarded by request to the AI Officer: purpose, data categories, link to the vendor's privacy policy.
• 3.3. Within 5 business days the Officer checks: whether the model trains on your data, where it is stored, whether there is a corporate plan or API mode, and the risks around blocking and payment.
• 3.4. Using tools outside the Register with yellow or red data is prohibited.

4. Roles and responsibility

• 4.1. Policy Owner (the director): approves the document and the budget for tools.
• 4.2. AI Officer (in a small business, a part-time role): maintains the Register, approves tools, handles incidents, reviews the Policy quarterly.
• 4.3. Department heads: enforce compliance within their teams.
• 4.4. Employee: follows the Policy and reports incidents within 24 hours.
• 4.5. Breaching the Policy is a breach of employment duties: from a warning to a reprimand, and where damage occurs, financial liability under the Russian Labor Code.

5. Rules for development with AI

• 5.1. AI coding assistants (Claude Code, Cursor and others) are used only from the Register and only in a mode that does not train on the Company's code.
• 5.2. Prohibited: secrets in prompts and repositories, production databases used for debugging, applying changes without review.
• 5.3. AI-written code goes through the same review and tests as hand-written code.
• 5.4. On client projects under NDA, AI is used only with the client's written consent.

6. Incidents

• 6.1. An incident is sending red data to a cloud AI, discovering an unapproved tool, or discovering a leak.
• 6.2. An employee reports an incident to the AI Officer within 24 hours. No penalties apply to voluntarily reporting your own mistake.
• 6.3. In the event of a personal data breach, the Officer and a lawyer assess the duty to notify Roskomnadzor: 24 hours for the initial notification, 72 for the investigation results.

7. Employee cheat sheet

1. The main test: "Would I show this to a stranger on the internet?" If no, do not send it to an AI.
2. Names, phone numbers, passports, customer databases — never.
3. Passwords, keys, tokens — never, anywhere.
4. Prices, margins, plans — only in general terms: "product X at N ₽."
5. New AI service — request first, use second.
6. Made a mistake? Report it within a day. Honesty is not punished.

How to roll out the policy in a week

• Days 1–2. Adapt the template: a small business needs 2–3 pages. Cut the sections that do not apply (for example, the development one).
• Day 3. Adopt it by order and collect acknowledgment signatures — without them, disciplinary liability does not work.
• Day 4. Draw up a starting Register of the 3–5 tools your team already uses, and appoint an AI Officer.
• Day 5. Run a 30-minute "allowed/not allowed" session using examples from your own work — how to build sessions like that is shown in our article on training employees to work with AI.
• Ongoing. Review quarterly: tools, plans and vendor policies change fast.

The policy is one step in a systematic rollout; the full sequence is in our AI adoption checklist for business.

What a policy does not solve: from paper to tool settings

Paper will not stop a two-click copy-paste — the rules have to be duplicated in technology: corporate plans with training switched off, secret managers instead of passwords in chats, de-identifying exports before analysis.

In development this works literally: the limits are written into the AI agent's configuration (rules files such as CLAUDE.md), and the assistant itself will not read files with secrets, will not commit keys and will not touch production. Which risks to close first is covered in risks and security in vibe coding, and ready-made practices are in the security cards.

An honest note about us: qvib is one person plus AI, with no sales department (how that works — in the case study). We sell the Quest engine with preconfigured rules for safe AI agent work (4,900 ₽ one-time, as of July 2026) and run a free knowledge base. We do not sell implementation services — which is why we give away the whole template rather than "page one in exchange for your email"; for implementation agencies we offer a partner program. The full template in editable format is in the pinned post of the Telegram channel t.me/qvib.

FAQ

Does a five-person company need a policy?

Yes, but a short one: two pages plus the cheat sheet. Breach fines do not depend on company size, and the odds of a mistake are higher in a micro-business — there is no security team and no DLP systems. An hour spent adapting the template is cheap insurance.

Wouldn't it be simpler to ban AI entirely?

A ban breeds shadow AI: employees will keep going from their personal phones, they will just stop talking about it. Controlled permission is safer: you choose the tools, the plans and where the line is.

Can I send personal data to ChatGPT if the customer consented?

In practice, almost never: besides consent you need grounds for a cross-border transfer and a notification to Roskomnadzor, and a foreign vendor will not give you 152-FZ guarantees. De-identifying before sending is simpler. Take borderline cases to a lawyer — this is not legal advice.

How is an AI policy different from a personal data processing policy?

A processing policy is a document required by 152-FZ covering every process involving personal data in the company. An AI policy is an internal document about tools: what may be sent where. They complement each other — reference the processing policy from the AI policy.

How do you get people to actually follow it?

Three conditions: signed acknowledgment (creates accountability), walking through real examples (creates understanding) and convenient approved tools (removes the motive to work around the rules). If the approved tool is worse than the forbidden one, the policy loses.