An AI usage policy is a two- or three-page document that tells your employees which artificial intelligence tools they can use, what data they must never enter into them, who reviews the output, and what to do in the event of an error. For a Quebec-based small or medium-sized business, it also serves as a guide for complying with Bill 25. Below you’ll find a complete template that you can copy and adapt in half a day.
The question is no longer whether your employees are using AI. According to the 2024 Work Trend Index from Microsoft and LinkedIn, 78% of people who use AI at work bring their own tools to the job—a figure that rises to 80% in small and medium-sized businesses. Without written guidelines, each person decides for themselves what they can copy into ChatGPT, Claude, Gemini, or Copilot.
This article delves deeper into a chapter from our guide on mistakes to avoid when using artificial intelligence in business —specifically, the chapter that recommends establishing an internal policy. Here, we move from the recommendation to the document itself.
Contents
Why an AI Policy Is Necessary for an SME
The widespread adoption of AI is progressing rapidly in Canada. According to Statistics Canada, 19.2% of businesses used AI to produce goods or provide services in the second quarter of 2026, up from 12.2% a year earlier and 6.1% in 2024. In Quebec,the Institut de la statistique du Québec reported this rate at 12.7% in the second quarter of 2025.
These figures reflect what the company has decided. They do not reflect what employees are already doing on their own. The gap between one in five companies that officially use AI and three out of four office workers who use it at work has a name: Shadow AI—the use of AI tools without approval or supervision.
Training is lagging behind. Among Canadian companies that use AI, Statistics Canada notes that 32% have trained their employees, and only 24% of companies with 1 to 4 employees have done so. On the employee side, the Microsoft survey indicates that 39% of AI users have received training from their employer.
A written policy doesn’t solve everything. However, it does provide everyone with the same answer to the three questions that cause most incidents:
- What tools am I allowed to use?
- What information can I enter into it?
- Who needs to review it before the results leave the company?
What an AI Usage Policy Should Include
A good AI policy answers ten specific questions, each in just a few lines. If a section cannot be covered in a single paragraph, it likely belongs in a separate procedure.
| Section | Question it addresses |
|---|---|
| Purpose and Scope | To whom does the policy apply: employees, contractors, interns? |
| Principles | Who remains responsible for work produced using AI? |
| Authorized tools | Which tools, and what type of account? |
| Data Classification | What information can be entered into which tool? |
| Prohibited Uses | What is prohibited, regardless of the tool? |
| Human validation | Who proofreads, and before what? |
| Personal Information | Which requirements of Act 25 apply? |
| Adding a tool | How do I get a new tool approved? |
| Training | Who needs to be trained, and when? |
| Incidents and Review | What to do in case of an error, and when should the policy be reviewed? |
For a more detailed version, the guide *Generative AI in Your Organization*, published by Nord Ouvert in January 2026, also provides model clauses for Quebec SMEs.
Sample AI Usage Policy for SMEs
Copy this template into your word processor and replace the text in square brackets. It is designed for a company with 5 to 50 employees that does not have a dedicated IT department. Allow half a day to adapt it, then have your data protection officer review it.
1. Purpose and Scope
[Company Name] encourages the use of artificial intelligence to save time and improve the quality of work. This policy governs such use to protect our customers, employees, and information. It applies to anyone who works for or on behalf of the company—including employees, managers, interns, contractors, and subcontractors—on any device, including personal devices.
2. Principles
- The individual remains responsible. AI is a support tool. Anyone who uses content generated by AI is responsible for it as if they had written it themselves.
- Confidentiality takes precedence over speed. If there is any doubt about a piece of information, do not enter it into an AI tool.
- Tools are selected by the company. Only the tools listed in Section 3 may be used for work.
3. Permitted Tools
| Tool | Account Type | Maximum data level | Intended Uses |
|---|---|---|---|
| [Primary assistant, e.g., ChatGPT, Claude, or Gemini] | [Work account provided by employer] | Yellow | [Writing, summaries, analysis of internal documents] |
| [Integrated tool, e.g., Copilot in Microsoft 365] | [Company license] | Yellow | [Emails, documents, meetings] |
| Any other tool, whether free or personal | Personal account | Green only | Search for ideas, public content |
The list is maintained by [name or title of the person in charge]. Any tool not included on the list is not authorized for use with yellow or red data.
4. Data Classification
| Level | Examples | Rule |
|---|---|---|
| Green: Public | Texts already published on our website, brochures, job postings, general information | Allowed in any tool |
| Yellow: Internal | Procedures, anonymous meeting notes, working documents, aggregated figures | Permitted only in approved tools with a corporate account |
| Red: Confidential | Personal information of clients or employees, HR records, non-public financial data, contracts, bids, passwords, and access | Prohibited, unless the tool has been approved in writing for this specific use |
Before entering a yellow or red document, remove any unnecessary information: names, addresses, case numbers, and amounts. An anonymized document can often be reclassified.
5. Prohibited Uses
- Making a decision about a person (hiring, credit, pricing, disciplinary action) based solely on a result generated by AI.
- Entering passwords, access keys, or security codes into an AI tool.
- Creating fake evidence, fake customer reviews, or content that impersonates a real person without their consent.
- Connecting an AI tool to our systems (email, CRM, website, accounting) without written approval.
- Deploy an AI-generated application or code into production without review by a qualified person.
6. Human Review and Transparency
All content produced using AI is reviewed by a person before it leaves the company: emails to clients, proposals, contracts, and posts on the website or social media. Numbers, dates, laws, regulations, and quotes are verified against official sources before use. When a client requests it, or when content is largely generated by AI, we disclose that AI was used.
7. Personal Information and Bill 25
- No personal information is entered into a tool that has not been approved for that purpose.
- Any proposed AI tool that will process personal information is subject to a privacy impact assessment (PIA) with the Chief Privacy Officer, including when the data is hosted outside of Quebec.
- If a decision concerning an individual is to be made exclusively through automated processing, the individual is notified and may request that a company representative review the decision.
8. Adding a New Tool
A request to add a tool is sent to [manager]. Before approving a tool, the manager verifies at a minimum: where the data is hosted, how long conversations are retained, whether the data is used to train the model, how access is controlled, and what the contract stipulates. The decision is documented, and the list in Section 3 is updated.
9. Training
All affected individuals receive training on this policy upon arrival, followed by a refresher at least once a year. The training covers data classification, verification of responses, and incident reporting.
10. Incidents
Any person who has mistakenly entered “red” information into an unauthorized tool, or who notices a significant error in content that has already been published, must report it to [the person in charge] within [24] hours. Reporting in good faith will not result in disciplinary action. The person in charge shall determine whether this constitutes a confidentiality incident within the meaning of Act 25, record it in the registry, and, if there is a serious risk of harm, notify the Commission d’accès à l’information and the individuals concerned.
11. Revision
This policy is reviewed every [six] months, or sooner if a major new tool is adopted. Version [1.0], adopted on [date] by [name, title].
Commitment: I have read [Company Name]’s AI usage policy and agree to comply with it. Name, signature, date.
AI Policy and Bill 25: The Three Obligations You Need to Know
No Quebec law requires a private company to adopt a specific AI policy. However, Bill 25 requires companies to adopt governance policies and practices for personal information, and AI directly affects three of its obligations. The general framework is explained in our article on understanding Bill 25.
- Privacy Impact Assessment (Section 3.3). Any project involving the acquisition, development, or redesign of an information system that processes personal information requires a PIA. An AI assistant connected to your CRM or customer service inbox falls into this category. The Commission d’accès à l’information publishes a guide on how to conduct a PIA.
- Data Processing Outside Quebec (Section 17). Most AI tools process data on servers located outside Quebec. As Fasken points out, hosting personal information outside Quebec—particularly in the cloud—requires a prior PIA.
- Automated Decisions (Section 12.1). Effective since September 2023, this section requires that an individual be notified when a decision concerning them is based exclusively on the automated processing of their personal information. They may then submit their comments to a representative of the company. An automated resume screening process without human review is a typical example of this.
The Commission on Access to Information goes a step further. In its brief , “AI in the Workplace: Toward Better Oversight,” submitted in January 2025, it recommends that employers document in an internal policy the AI systems used, their purposes, the data processed, and how the results are used to inform decisions.
Implementing an AI Policy in 30 Days
A policy that sits in a shared folder doesn’t make a difference. Here’s a realistic four-week timeline for an SME.
- Week 1: Take stock. Ask each team which AI tools they’re already using, with which account, and for what tasks. Present this as a survey, not an investigation—you want honest answers.
- Week 2: Select tools and classify data. Choose one or two tools with enterprise accounts, then fill out the classification table using your own sample documents.
- Week 3: Adapt and Get Approval. Adjust the template, have it reviewed by your privacy officer, and, if necessary, by your legal counsel.
- Week 4: Train staff and have them sign the policy. A one-hour session is sufficient to present the policy using examples from your day-to-day work. Our training sessions can serve as a starting point.
Real-world example: a service firm with 15 employees
Let’s consider a typical scenario. At a service firm in the Laurentians, the Week 1 inventory reveals five different tools, three of which are on free personal accounts. An assistant uses one to summarize client contracts, while an advisor uses another to rewrite emails containing case numbers.
The firm retains only one assistant with a corporate account and flags contracts in red. The assistant continues to receive her summaries, but now they are versions without names or amounts. No one has lost any useful tools: the workflows have simply been brought into a familiar framework.
Errors That Render an AI Policy Useless
- Ban everything. A blanket ban drives usage toward personal accounts, where you can no longer see anything. That’s the best way to feed the Shadow AI.
- Write fifty pages. No one reads a document that looks like a contract. Aim for three pages and a table.
- Freeze the list of tools. Tools change every quarter. Without a process for adding new ones, the list will be out of date in six months.
- Forget about development. An app created with AI by an employee also needs to be supervised, as we explain in our article on “vibe coding” without a developer.
- Do not assign anyone. Without a designated person in charge, no tool requests will be processed and no incidents will be tracked.
A short AI usage policy is better than no policy at all
Your employees are probably already using AI. A three-page AI usage policy tells them which tools to choose, what data to protect, and who should review content before it’s sent. It reduces the risk of data leaks and published errors, and it puts you in a strong position with regard to Law 25.
The template above covers the essentials. Its value comes mainly from two steps: filling out the classification table with your own documents, and taking an hour to explain it to your team.
Need help adapting this template?
We help small and medium-sized businesses take stock of the tools they’re already using, organize their data, adapt their policies, and train their teams. Discover our AI support for small and medium-sized businesses or, for a one-time review of your tools and processes, our web consulting service.
Frequently Asked Questions
Is an AI usage policy mandatory in Quebec?
No law requires private companies to have a specific AI policy. However, Bill 25 mandates governance policies and practices for personal information. Since AI tools often process this type of information, an AI policy effectively becomes an extension of these obligations.
Can employers ban employees from using ChatGPT?
Yes, an employer can restrict the tools used for work. However, a total ban rarely works: employees simply shift their usage to personal phones and accounts. It is more effective to authorize a tool with a company account and prohibit the use of sensitive data elsewhere.
Who should draft and approve the AI policy?
In an SME, the executive approves it and has it drafted by the person most familiar with the tools, in collaboration with the privacy officer. Under Act 25, this role falls by default to the person with the highest authority in the company, unless that person delegates it in writing.
How often should the policy be updated?
Every six months is a good schedule, since tools and their terms and conditions change quickly. An update is also necessary as soon as a major new tool is adopted or an incident reveals a misunderstood rule.
Should you inform your clients that you use AI?
It is mandatory when a decision affecting them is based exclusively on the automated processing of their personal information (Section 12.1 of Bill 25). In other cases, it is a best practice, especially if their information passes through an AI tool: your privacy policy should then mention this.
