A company AI charter is an internal operating framework. It sets permitted and excluded uses, data boundaries, human review, incident reporting, rule owners and the review schedule. Adapt this one-page template to the company's context, then test it against real work scenarios. It does not replace applicable legal, employment, security, privacy or compliance work.
My operator verdict: if the charter cannot settle a case on Monday morning, it describes an intention rather than a working rule. I prefer a revisable page tied to named owners over a manifesto nobody knows how to apply.
What is a company AI charter?
A company AI charter is a shared internal operating framework that turns principles into decisions about uses, data boundaries, human review, incident reporting, owners and review. Café IA says a charter can formalise a framework, establish broad principles and open a transparent conversation; co-design aims to produce a document that represents the use context and is better appropriated by stakeholders (Café IA).
The charter connects a principle to an everyday decision. “Protect data” becomes: which data is admitted, which is excluded, who settles uncertainty and where it is reported. “Keep a human in the loop” becomes: which person reviews, at what moment and with what information.
The French government's public AI charter portal gathers examples from public administration. It is a library of references, not evidence that one example fits a private company unchanged.
How should you prepare the drafting workshop?
Invite people who use, approve, secure or experience the effects of the workflow. Café IA recommends co-design involving stakeholders to avoid drafting that is detached from practical realities (Café IA).
Tileo proposes this practical editorial template in this article: bring three real situations, but remove any data you have not decided to share. For each situation, record the input, intended output, person exposed to the result and the point where review remains possible.
- A routine use: it reveals the rule the team will apply most often.
- An uncertain case: it forces you to write a question or escalation route instead of inventing permission.
- A plausible incident: it lets you name reporting, stopping and review ownership.
Do not begin with a list of values. Begin by asking, “What should a person do in this case?” Values can then explain the rule.
What one-page AI charter template can you use?
Copy this table, then replace every bracket with a decision from your context. The test column stops polished language from remaining unverifiable.
| Section | Draft clause to adapt | Adoption test |
|---|---|---|
| Purpose | “We use AI for [named uses], serving [expected outcome].” | A person can connect their use to the written purpose. |
| Permitted uses | “Permitted: [tasks], inside [scope], with [review].” | The team gives the same answer to an allowed example. |
| Excluded uses | “Do not use AI for [decisions/actions] without [review or procedure].” | An excluded case stops or reaches the correct owner. |
| Data and sources | “Admitted inputs: [categories]. Prohibited or approval-only inputs: [categories]. Authoritative sources: [list].” | Ambiguous data triggers a question, not a submission. |
| Human review | “[Role] checks [elements] before [action or release].” | The reviewer has the input, output and useful sources. |
| Transparency | “We disclose AI use when [defined situation].” | The chosen case produces the intended information. |
| Incident and recourse | “For [error, leak, unexpected behaviour], stop [action] and report to [channel/role].” | The team finds the channel and preserves useful material. |
| Owners and review | “[Role] owns the charter. Review on [date] using [questions/incidents/changes].” | The owner can keep, change or remove a rule. |
For personal-data processing, the CNIL describes requirements including a specified, legitimate and explicit purpose, a legal basis, and attention to rights, minimisation and security. Those matters need appropriate compliance work and are not settled by this table (CNIL). To define the project below the charter, use the AI project requirements document.
Choose the right door
The first page is ready. Now choose the door that fits the remaining work.
Choose the right doorHow do you separate charter, law, employment, security and compliance?
Give each document a separate question. The charter answers, “What shared conduct do we expect?” A legal or employment policy addresses applicable rights, duties and rules. A security procedure describes measures, technical roles and incident response. Compliance work establishes the required analyses, legal bases, evidence and controls.
The EU AI Act takes a risk-based approach and sets different rules according to categories and roles. A general charter therefore cannot establish the obligations that apply to a particular system (European Commission).
ANSSI says its guide addresses the security of generative-AI system architecture from design through deployment and production use, and does not cover topics including ethics, privacy or personal-data protection (ANSSI). That boundary is instructive: even a security guide limits its own purpose.
How do you test adoption before release?
The adoption-test sequence below is a practical editorial template that Tileo proposes in this article. Give the same scenarios to several people without explaining the “right” answer. Ask each person to decide: permitted, prohibited, approval required or escalate. Then compare their reasons. This test does not measure universal performance; it finds ambiguity in your draft.
- Select scenarios. Use a routine task, an uncertain case and a plausible incident.
- Collect the decision. Record the verdict and clause used without correcting the person during the test.
- Rewrite ambiguity. When two readings create different actions, clarify the rule or escalation route.
- Name the review. The owner gathers questions, incidents and changes, then keeps, changes or removes a clause (Café IA).
Connect the charter to operational work. The method to automate your business with AI helps bound one workflow; the charter remains the shared framework above those projects.
What signals should trigger a review?
A living charter changes when the work changes or its application fails. Schedule a review and open it earlier when one rule produces contradictory decisions, a new use falls outside the written scope, an incident reveals an impractical stop route or the owner is no longer identifiable.
- A recurring unanswered question should become an explicit rule or escalation route.
- A system, integration or architecture change should be routed to suitable security review (ANSSI).
- A new use of personal data should enter the appropriate compliance work (CNIL).
- A change of role or risk category calls for analysis of applicable rules, not a simple editorial edit (European Commission).
Choose the right door
Your charter marks the boundary. The next step depends on the concrete problem.
Choose the right doorFAQ about company AI charters
How do you create an AI charter? Bring together the people involved, start from real uses, then write the purpose, permitted and excluded uses, admitted data, human review, reporting route, owners and review date on one page. Test the charter on concrete situations.
Is an AI charter mandatory? This guide does not claim that every company must have an AI charter. A charter does not replace applicable legal, employment, security, privacy or compliance work.
What is an ethical AI charter? There is no universal text in this guide. An ethical charter translates the organisation's chosen principles into observable decisions about uses, boundaries, control, transparency, recourse and review in its own context.
What is a company AI use charter? It is a shared operating framework showing how people may use AI at work, when to seek approval, how to report a problem and who reviews the rules. It remains separate from legal, employment, security and compliance documents.
What is an ethical charter? It is a document that makes shared principles and expected conduct explicit. To be usable for AI, it should connect each principle to a situation, decision, owner and reporting route.