An IA charter is the document that tells your teams what artificial intelligence tools they can use, for what purposes, and with what data. No text imposes it by that name, but it is the means to frame a practice that already exists in most companies, often without any rules. Here’s what it should contain: a complete model to adapt to, and a step-by-step guide for a small business.
In short
- An AI charter sets out the allowed tools, the permitted or prohibited uses, and the data that should never be entered.
- Since July 27, 2026, Article 4 of the European AI regulation, replaced by Regulation (EU) 2026/1744, requires companies that use AI to «take measures to promote the development of AI mastery» by their personnel. The former wording referred to «ensuring, to the extent possible, an adequate level of AI mastery.».
- If it contains obligations or prohibitions, it follows the rules of the internal regulations: opinion of the CSE if available, submission to the registry of the labor arbitration board, notification to the labor inspection.
- A good charter is kept to two pages, is based on real practices, and is revised every six months.
What is an AI charter in a company?
An IA charter is an internal document that sets out the use of artificial intelligence tools by employees: conversational assistants like ChatGPT or Copilot, translation and transcription tools, image generation tools, or agents designed for a specific profession.
It answers three simple questions: What tools do we have the right to use it, What to do, and with what information. The rest (principles, roles, revision) serves to make these three responses applicable in everyday life.
It differs from the IT charter, which regulates the use of hardware, messaging, and the internet. Many companies add an AI chapter to their existing IT charter: this is a good solution, provided that this chapter is concrete.
Why write an IA charter now?
Because AI is already present in the company, with or without regulation. An employee pastes a customer contract into a public tool to summarize it; another leaves the AI to write a response without rereading it: these are not mistakes; they are practices without a framework.
A charter reduces three risks:
- The leak of information Depending on the tool and its contract, what is seized can be retained or reused by the supplier.
- The credible error A generative AI tool can produce fake but plausible text. Without review, the error comes from the customer.
- The hidden use When AI is banned or ignored, teams still use it, with their personal accounts.
The CNIL also recommends that any organization deploying generative AI start with a specific need, define a list of permitted and prohibited uses, train users, and involve the relevant decision-makers from the outset.
Value does not come from the tool, but from the way it is used: the charter is the place where the company writes that way.
Is an AI charter mandatory?
No, no text mandates an «AI charter» under that name. But two texts provide a very useful written framework.
The European regulation on AI, modified in July 2026
Regulation (EU) 2024/1689, known as the AI Act, devotes its Article 4 to «the control of AI». This article has been replaced by Regulation (EU) 2026/1744 of 8 July 2026, In force since July 27, 2026. It now requires companies that use AI systems to «take measures to promote the development of AI mastery» by their staff, specifying that «this obligation does not … require ensuring a specific level of AI mastery by an individual.» Guides published before this date cite the former wording, which spoke of «guaranteeing.».
The text does not say what measures to take. A charter and a short training course are simple measures that can be implemented and documented.
The Labour Code
If your charter merely contains recommendations, it is an informational document. If it sets General and permanent obligations In matters of discipline, health or safety, Article L1321-5 links it to the internal regulations: it is an addition to them when the company has one, and in all cases it follows the rules provided for it. Specifically:
- opinion of the social and economic committee, which exists from the moment there are 11 employees (articles L1321-4 and L2311-2);
- filing with the registry of the labor arbitration board (article R1321-2);
- communication to the Labour Inspectorate, with the opinion of the CSE (articles L1321-4 and R1321-4);
- information from all the persons concerned, by any means (Article R1321-1);
- entry into force at least one month after these formalities (article L1321-4).
The internal regulations themselves are mandatory for companies with 50 or more employees (article L1311-2). If you want to be able to sanction a breach of the charter, have your labor law counsel review its wording.
What to include in an AI charter: the 8 sections
- The goal : why the company encourages AI, and what it wants to avoid.
- The field : who is involved (employees, interns, contractors) and what tools are used.
- The allowed tools : a nominative list, attached, dated and updated.
- The uses What is allowed, what requires verification, what is forbidden.
- The data What is never captured in an unvalidated tool (personal data, customer information, non-public figures, manufacturing secrets).
- The review All content produced with AI and intended for external use is reviewed by a person, who remains responsible for it.
- The reference : the person to whom a question is asked or an incident is reported.
- The revision : a fixed revision date, for example every six months.
The IA charter model, ready to adapt
This model is in two pages. Replace the elements in brackets. It contains prohibitions: it therefore follows the procedure described above before coming into effect.
With the attachment of the tools, the status report questionnaire and the accused reading the document.
Charter for the use of artificial intelligence — [Name of the company]
Version of [date] · Next revision: [date + 6 months] · Reference: [first name, function, address]1. Why this charter. [Company name] encourages the use of artificial intelligence to save time on repetitive tasks and better serve our customers. This charter sets the framework for doing so safely.
2. To whom it applies. To any person who works for [Name of the company] (employees, interns, trainees, contractors), for any AI tool used in the context of their work, including on a personal device.
3. The authorized tools. Only the tools listed in the annex can be used with company information. To add one, contact the contact person.
4. The uses.
- Permit : reformulate, summarize or translate a non-confidential text; seek ideas; prepare a first draft.
- With verification : any text sent to a client, a supplier or published; any number, reference or quote produced by AI.
- Forbidden : make a decision alone concerning an individual (recruitment, evaluation, sanction); present as verified content that was not verified.
5. The data. Never enter data into a tool that is not listed in the annex: personal data (clients, employees, candidates), confidential information about clients, prices, margins or non-public figures, plans or manufacturing secrets, identifiers and passwords. In a listed tool, personal data is only entered if the annex indicates so.
6. Responsibility. The person who uses AI remains responsible for the result. Content intended for external use is always reviewed before being sent.
7. The incidents. In the event of the accidental disclosure of prohibited information, notify the reference officer on the same day. There is no blame in reporting it; there is blame in hiding it.
8. Training and revision. Each person concerned receives a presentation of this charter upon arrival. The charter is reviewed every six months, along with the list of tools.
Appendix — Authorized tools (updated on [date]): [tool name] — [version or formula] — [permitted uses] — [authorized data] — [GDPR subcontracting contract signed: yes / no].
Usage by usage: permitted, to be verified, prohibited
| Situation | Level | Why |
|---|---|---|
| Reformulate an internal email | Permit | No sensitive information, no external stake |
| Summarizing a standard or a public text | Permit, with verification of the passages mentioned | AI can be wrong about a detail |
| Preparing a technical tender document | To be checked | Every means and every reference cited must be real. |
| Analyzing a customer contract | Only in a validated tool | Confidential information |
| Sorting the candidacies | Forbidden without human decision | Decision that concerns an individual |
| Attach a customer file for a follow-up | Banned in a general-use tool | Personal data |
How to implement it in a SME in 5 steps
- Identifying real uses. An anonymous five-question questionnaire is sufficient: which tools do you use? for which tasks? with a personal or company account? have you ever entered customer information? what would save you the most time?
- Choosing the tools. For each one, check in the contract whether the entered data is retained or reused to train the model, where it is hosted and processed, and, if personal data passes through it, whether the provider signs a subcontracting agreement in accordance with Article 28 of the GDPR.
- Draft Starting from the model above, based on the practices identified in step 1, not a theoretical list.
- Consulting, presenting and training Follow the procedure of the internal rules, then explain the charter in one hour, using examples from the team’s work.
- Review every six months Tools change quickly, and the list in the annex is no exception.
To present the charter: the IA training kit
The outline of the one-hour session, the handout for the discussion and the follow-up sheet to keep track of the training and the charter: a Word file and an Excel spreadsheet.
The errors that make a charter useless
- Ban everything. The use continues, but it is out of sight.
- Writing for lawyers. A charter that cannot be understood in five minutes is not being implemented.
- Organize the list of tools in the body of the text: put it in an annex, dated.
- Forget the examples. «No confidential data» is not enough: please specify which ones, with examples from the field.
- Never revise it. A charter from 2025 does not include the tools of 2026.
And after the charter: the task that remains
The fifth question of the census, «What would make you spend the most time?», almost always brings up a specific task, which often comes up again and involves your own documents. It is through a task like this that a project begins. Optima Studio : an agent, a process.
During our webinar on October 13, 2026 with the CCI Marne-Ardenne, Mathieu Domon, our president, opened each of the three cases presented by a task, not by a technology. replay, available for free, also includes a section on data security and privacy. The method for choosing this first task is detailed in our article Integrating AI in SMEs: where to start?
Frequently asked questions
Is an AI charter mandatory in companies?
No. No text mandates an AI charter under this name. Since July 27, 2026, Article 4 of the European regulation on AI, replaced by Regulation (EU) 2026/1744, requires «taking measures to promote the development of AI mastery» by staff, without specifying which. An accompanying charter is part of this.
Is an IT charter mandatory?
No longer. But if an IT charter or an AI charter sets out general and permanent obligations, it follows the procedure of the internal regulations (Article L1321-5 of the Labour Code).
What is the difference between an AI charter and an IT charter?
The IT charter regulates hardware, messaging and the internet. The AI charter regulates artificial intelligence tools: which ones, for what uses, with what data. It can be a chapter of the IT charter.
Should the CSE be consulted?
Yes, if the charter sets out general and permanent obligations regarding discipline, health and safety, and the company has an employee representative body (from 11 employees). A simple guide to good practices is not subject to it.
Who should draft the IA charter?
In a SME, the management team, with one or two people who already use AI on a daily basis, and the IT manager, if one exists. The most important thing is to start from the actual usage patterns of the teams.
Should the charter be signed by the employees?
The signature is not what makes it applicable. What matters is that it is made known to everyone and, if it sets out obligations, that the internal rules have been followed. Having a signed reading sheet remains a good practice for proving that it has been communicated.
Sources
- Regulation (EU) 2024/1689 on artificial intelligence, Article 4 (EUR-Lex)
- Regulation (EU) 2026/1744 of 8 July 2026, known as the «digital omnibus on AI», which replaces Article 4 (EUR-Lex)
- Labour Code: L1321-5, L1321-4, L1311-2, L2311-2, R1321-1, R1321-2, R1321-4 (Digital Labour Code)
- CNIL, «How to deploy generative AI?»
- General Data Protection Regulation (GDPR), Article 28
French 
English