Free resource · Word template

Model AI Charter: Framing the Use of Generative AI in 15 Articles

A ready-to-adapt and publish template, aligned with the AI Act, GDPR, CNIL and labor code, with a note for the writer for each article.

📄 Word, 25 pages⚖️ 15 articles and 4 appendices🇪🇺 AI Act and GDPR🆓 Free

Download the modelSee all 15 articles

Conceived by Flavien Besset, founder of NextStart.AI · version 2 of October 26, 2026 · 4,850 professionals trained · satisfaction 9,4/10

In most companies, generative AI is already used daily. Not because management decided it, but because a salesperson pasted a customer report into ChatGPT to generate an email, an HR assistant asked Copilot to summarize three resumes, or a developer had Claude review their code. None of these actions is a problem in itself. The problem is that they are done without rules, using personal accounts, and no one knows what data leaves the company. To measure these uses before writing rules, the Shadow AI kit offers an anonymous survey and a 90-day exit plan.

An AI charter addresses this issue in about ten pages. This page explains what it should contain in 2026, what the regulations actually require (and what they don't), and provides a complete template, in Word format, to adapt to your organization.

Model overview: what you receive

Before you leave your email address, here's an excerpt from the most frequently used article, the one that answers the question "Can I paste this?". Version 2, updated October 26, 2026.

Excerpt · Article 4

Data: what can be entered

Basic test: "Could I publish this information on the internet?"

VertPublic or inconsequential data: approved and tolerated tools.

OrangeInternal data: only in an approved tool, under a professional contract.

RedPersonal data, HR documents, confidential customer data, trade secrets, passwords and API keys.

📄 15 items ready to adapt

A default, rather cautious draft for each article, spaces to be completed highlighted in yellow, and a note for the writer explaining the choices to be made.

🤖 AI in action, already covered

Three levels of autonomy, agents created by the professions, delegation of files to Copilot Cowork or Claude Coworkand the list of things that AI never does on its own.

🗂️ 4 operational annexes

Register of approved, tolerated and prohibited tools, regulatory benchmarks 2025-2030, fourteen-step checklist, official sources (CNIL, DINUM, ANSSI, Paris Bar).

Receive the complete template by email →

1. Why an AI charter, and why now?

Three reasons, in order of importance.

Confidentiality. A free version of an AI assistant uses your conversations by default to improve its models. Any information an employee enters (customer data, payroll details, source code, acquisition plans) leaves the company's control without a contract, log, or possibility of retrieval. The risk is not theoretical: the CNIL (French Data Protection Authority) considers such entry of personal data to be data processing, and a leak to be a data breach that must be reported to them within 72 hours.

Quality and responsibility. The models invent figures, sources, and legal references with perfect confidence. Without verification rules proportionate to the stakes, the error ends up in a sales proposal or contract, and it is the company that is held responsible, not the tool.

Regulations. The European AI Act has been phased in since February 2025. Its sanctions regime has been in effect since August 2, 2025; since August 2, 2026, its transparency obligations have been in effect, and national authorities monitor compliance, including Article 4. For a company that uses AI without developing it, the obligations remain moderate, but they do exist, and a charter is the simplest way to demonstrate that they have been taken into account.

There's also a fourth, less frequently cited reason: a charter unlocks usage. As long as the rules aren't written down, half of the employees don't dare use AI, and the other half use it secretly. A well-crafted charter clearly states what's allowed, and it's often more than people imagine.

2. What the law actually requires in 2026

Much of the content on this topic conflates what applies to model developers, companies that develop AI systems, and those that simply use them. For a user company (a "deployer" in the regulation's terminology), here is the current state of the regulations as of October 26, 2026.

Date	This applies	Impact on a user company
2th February 2025	Prohibition of unacceptable practices (article 5) and entry into force of article 4 on the control of AI.	No recognition of emotions at work, no social rating. Train employees who use AI.
2th August 2025	General purpose model suppliers' obligations (GPAI).	None, unless you are developing a model.
27th July 2026	Entry into force of the Omnibus IA regulation (Regulation (EU) 2026/1744).	Article 4 is rewritten: it requires taking measures to "foster the development" of AI proficiency, without obligating the government to guarantee a specific level. The obligation remains, monitored by national authorities from August 2, 2026, according to each Member State's sanctions regime. High-risk deadlines are postponed.
August 2, 2026	Article 50 (transparency) applicable and control by national authorities, including article 4 (the sanctions regime applies from 2 August 2025).	Inform people who interact with a chatbot, report AI-generated images, sounds and videos. Penalties of up to €35 million or 7% of global turnover for prohibited practices, €15 million or 3% for other breaches.
2th December 2026	Two new bans (hyper-manipulation of intimate or sexual images of an identifiable person without their consent, child pornography); end of the marking deadline for generative systems placed on the market before August 2, 2026.	Prohibit these uses in the charter and verify that your tools comply with article 50.
2th December 2027	High-risk systems of Annex III.	A CV sorting, evaluation or employee management tool becomes a high-risk system: human supervision, informing employees and the CSE, logs, impact analysis.
2th August 2028	High-risk systems integrated into regulated products (Annex I).	Machinery, medical devices, vehicles, toys.

Three clarifications that change the way the charter is written.

Article 4 is no longer an obligation of result. In its initial version, the AI Act required companies to "take measures to ensure" a sufficient level of AI proficiency. Omnibus Regulation (EU) 2026/1744 replaced this wording with "promoting the development of AI proficiency" and clarifies that there is no longer a requirement to guarantee a specific level for each individual; the Commission and Member States must support these efforts, particularly those of SMEs. The obligation remains, however: compliance has been monitored by national supervisory authorities since August 2, 2026, according to the sanctions regime established by each Member State, and the Commission specifies that no certificate is required; an internal register of actions adapted to roles is sufficient. This does not make training optional: in the event of an incident, the question asked will be, "What had you done to ensure your teams knew how to use these tools?", and a register of awareness-raising actions is the simplest answer.

The GDPR applies independently of the AI Act. Entering a client's name, a candidate's CV, or an employee's performance review into an AI tool constitutes the processing of personal data. This requires a legal basis, notification of the individuals involved, registration in the data processing register, and, for external tools, a data processing agreement. Article 4 of the model (data classification) is the core of this process.

The Works Council must be informed and consulted Before the introduction of tools impacting working conditions or enabling monitoring of employee activity (French Labor Code, Articles L2312-8 and L2312-38), a charter appended to the company rules must follow the same procedure (consultation with the Works Council, filing with the clerk of the court, and transmission to the labor inspectorate). This is what gives it disciplinary force.

3. The 15 articles of the model, and what they regulate

The model is designed for organizations that use generative AI without developing it, ranging from a team of a few dozen people to a group of several thousand. We drafted it by combining the best publicly available sources as of September 2026: the DINUM's guide to using AI for government employees (June 2026), the CNIL's Q&A on generative AI and its July 2026 note on agentic AI, the ANSSI's security recommendations and its April 2026 alert on AI agents, the charters of the Ministries of Culture and National Education, the Council of State, and the model adopted by the Paris Bar Association in July 2026. Each article offers a default, rather cautious wording, and a note explains the choices to be made. Here's what each one sets.

Article 1. Purpose and scope

Who is affected (employees, interns, temporary workers, contractors), which tools (including AI functions integrated into existing software and personal accounts used in the office), and which situations (including remote work and personal equipment)? This is also where the alignment with internal regulations and the IT charter is decided.

Article 2. Guiding Principles

Seven principles serve as a reference when an unforeseen situation arises: human responsibility, confidentiality, verification, transparency, fairness and accessibility, real-world usefulness, and preservation of skills. The first is the most important: the user remains the author of what they produce with AI. The last, borrowed from the CNIL (French Data Protection Authority), addresses the automation bias: reflexively validating what the AI ​​suggests, to the point of no longer knowing how to do things without it.

Article 3. Approved, tolerated and prohibited tools

Three categories instead of two. "Approved" for tools under a professional contract whose data is not used for training. "Tolerated" for consumer versions, limited to public data. "Prohibited" for everything else, including any tool used via a personal account. The article also addresses accounts (professional accounts, strong authentication, no sharing), browser extensions, and subscriptions purchased without validation, which are the source of shadow AI. Two sections were added in version 2: what truly distinguishes an enterprise offering from a consumer offering (training, GDPR contract, account management, connectors), and a procedure for reporting unauthorized uses without penalty, to bring shadow AI into the open. The list of names is in the appendix, so it can be updated without requiring re-signing the charter.

Article 4. Data: what can be entered

The core of the system. A basic test borrowed from the DINUM guide ("Could I publish this information on the internet?"), followed by a three-level classification (green, orange, red) cross-referenced with the three categories of tools. An employee must be able to answer the question "Can I paste this?" in ten seconds. Personal data, HR documents, customer data under confidentiality agreements, trade secrets, and technical secrets (passwords, API keys) are red by default, following the list that ANSSI recommends never entering into an online tool. One section addresses oversharing: an assistant connected to email or document repositories can find everything the user has permission to open, hence the need to review access rights before opening it.

Article 5. Verification and liability

A level of review proportionate to the intended use: personal draft, internal document, external document, decision affecting a person. For this last case, the rule is simple: the AI ​​does not decide; it prepares elements that a human examines and takes responsibility for. The article adds specific rules to the generated code (reviewing, no automatic execution, verification of suggested libraries) and a list of situations where AI is not used, inspired by the charter of the Ministry of Culture.

Article 6. Transparency

What Article 50 of the AI Act has mandated since August 2026 (chatbots, deepfakes, published content) and what the company chooses to add: a standardized disclosure formula ("content partially generated by AI and verified by…", inspired by the state's design system), cases where it is not required (translation, language correction), notification to clients when an intellectual service relies heavily on AI, a prohibition on imitating a real person without consent, and a ban on deepfakes of intimate details. The article follows the European Commission's guidelines of July 2026 (European icons, agents that present themselves as AI).

Article 7. Intellectual Property and Confidentiality

In one sense, it's about not submitting content to AI for which you don't hold the rights. In another, it's about recognizing that content generated without human creative input is generally not protectable and that it can reproduce an existing work. The article also addresses the most common blind spot: AI features activated by the publisher in already deployed tools (meeting summaries, email assistants).

Article 8. AI agents, extensions and automations

The article that the 2025 models lack. An AI agent doesn't respond, it acts: it reads and sends emails, modifies files, places orders. In April 2026, the French National Cybersecurity Agency (ANSSI) issued a warning about these products installed on workstations, and the French Data Protection Authority (CNIL) published a note on agentic AI in July. The model distinguishes three levels of autonomy (the conversing assistant, the connected assistant, the acting agent) and derives simple rules from them: prior validation, rights limited to what is strictly necessary and reviewed quarterly, declaration of agents created by employees as soon as they are shared, and a dedicated work folder for delegating a task to an AI (Copilot). Cowork, Claudius Cowork, agent mode), list of what AI never does on its own (send a message to a third party, delete a document, pay, create rights), tests in isolated environment, prompt injection awareness, logging.

Article 9. Meetings recorded and transcribed

The most widespread and least regulated AI function. Participants must be informed and have the option to object, personal note-taking assistants are prohibited, individual interviews (recruitment, evaluation, disciplinary) cannot be transcribed, data retention is limited, and the report must be reviewed before being sent.

Article 10. AI Training and Mastery

The response to Article 4 of the AI Act: awareness-raising for all within three months (with, as an option, access to tools conditional on its follow-up), in-depth training for intensive or sensitive uses and above all access to agentic functions, a guide to good practices, and above all a register of actions carried out with evidence (signatures, supports, dates).

Article 11. Reporting of incidents

What to report (including an unwanted action by an agent or a compromised account), to whom, and within what timeframe. With one crucial clause: a report made in good faith, even regarding one's own error, will not result in any penalty. Without this clause, data entry errors will never be detected.

Article 12. Governance and decisions concerning individuals

A specifically designated AI expert, the Data Protection Officer (DPO) as the ethics contact point, a committee that meets on a fixed schedule (quarterly by default), a register of critical uses, including shared agents. And a section dedicated to HR decisions: no recruitment, evaluation, or disciplinary decisions based solely on automated processing (Article 22 of the GDPR), no emotion recognition or monitoring beyond what is legally permitted, and the identification now of HR tools that will be considered high-risk by December 2027.

Articles 13 to 15. Shortcomings, review, adoption

A reference to the internal regulations and the disciplinary procedure of the labor code, with graduated sanctions. An annual review, and triggers for re-examining a tool adapted from the Paris Bar Association model (change of publisher ownership, terms of use, hosting). An adoption article specifying consultation with the Works Council, addition to the internal regulations, and the individual signature block.

Four annexes complete the document: the register of tools (with the validation date, the verified guarantees and the questions to ask a publisher), the regulatory benchmarks 2025-2030, a fourteen-step checklist to deploy the charter, and the list of sources used.

4. Errors that render a charter useless

We've supported around thirty organizations in their AI adoption, and the charter comes up almost every time. Charters that are useless almost always share one of these flaws.

• Ban everything. A charter stating "the use of AI is prohibited without authorization" is circumvented the very next day, with personal accounts on personal phones. You lose visibility without gaining security.
• Name the tools in the body of the text. The tools change every six months. If each change requires a new signature, the charter will never be up to date. Include the list in the appendix.
• Forget about AI functions that are already activated. Automatic summaries of video conference meetings, messaging assistants, and completion in office suites: these features have been activated by the publisher, not by you, and they transmit data.
• Don't say what you can stick on. A charter that refers to "sensitive data" without defining it leaves the decision to each individual. The green/orange/red grid with concrete examples is what makes the rule applicable.
• Distribute via email and consider it done. Without requiring internal regulations or individual signatures, the charter serves only as information. It is difficult to justify sanctions and does not replace consultation with the Works Council when such consultation is required.
• Do not train. An unexplained charter is an unread charter. A two-hour awareness session, with examples drawn from the company's various roles, does more for confidentiality than ten pages of rules. This is also what Article 4 of the AI Act expects.
• Never see her again. The regulatory calendar runs until 2030. Set an annual review date from the first version.

5. Deploy the charter in four weeks

The timeline below reflects what we see working in an organization starting from scratch.

Weekdays	What we do	About
1	Appoint the AI ​​expert. Identify the tools actually used (anonymous five-question survey, license review, inventory of AI functions activated in existing software).	Management, IT Department
2	Classify the tools (approved, tolerated, prohibited). Align the data grid with the GDPR register. Adapt articles 5, 6 and 11 to the business needs.	AI expert, DPO
3	Legal review. Information and consultation of the Works Council if required. Choice of adoption method (annex to the internal regulations or individual signature).	Management, advice, CSE
4	Awareness-raising for all relevant employees (two hours, using concrete examples from the company). Distribution, signatures, archiving. Planning of the first review.	AI expert, HR

Week 4 is the crucial one. A charter presented in a meeting, with examples drawn from the teams' daily work and a question-and-answer session, is implemented. A copy of the charter sent as an attachment is archived. An often-overlooked point: the Works Council (CSE) must be consulted before any deployment. A pilot program that equips an entire department, becomes a long-term initiative, or impacts working conditions already constitutes a deployment (Nanterre Court of Appeal, February 14, 2025, which suspended, under penalty of a fine, an AI deployment launched without consultation); only a truly voluntary test, limited in time and scope, can precede it (Paris Court of Appeal, February 10, 2026).

6. Frequently Asked Questions

GPT charter, ChatGPT charter or AI charter: what's the difference?

None: it's the same document. "GPT Charter" and "ChatGPT Charter" are the common names, inherited from the most well-known tool. But a charter limited to ChatGPT quickly becomes outdated, as teams also use Copilot, Claude, Gemini, Mistral, and the AI ​​functions integrated into their software. This template therefore covers all generative AI tools, with an appendix that classifies each one as approved, tolerated, or prohibited.

Is an AI charter mandatory?

No. No law mandates a document titled "AI Charter." However, the AI Act requires promoting the control of AI (Article 4) and ensuring transparency (Article 50), the GDPR requires regulating the processing of personal data, and the French Labor Code requires informing and consulting the Works Council (CSE). A charter is the simplest way to fulfill these obligations and demonstrate compliance.

AI Charter or amendment to the internal regulations?

The two are combined. The charter is the readable document that explains and provides examples. To be enforceable against employees, it is appended to the company rules and follows the same procedure (consultation with the Works Council, filing, and submission to the labor inspectorate). In a company without company rules (fewer than 50 employees), an individual signature is the alternative.

Should free versions be banned?

Not necessarily. The model classifies them as "tolerated" and limits them to public or non-stakeholder data, with training disabled in the settings. This is more realistic than a ban, and it incentivizes the company to provide an approved tool to those who need it.

How long should a charter be?

Between six and twelve pages, excluding appendices. Anything shorter doesn't answer practical questions (what can I paste?). Any longer won't be read. The template is twenty-five pages long, including appendices and editorial notes, which should be removed before distribution. The section on transcribed meetings can be omitted in an organization that doesn't use any transcription tools; the section on agents should remain, as major suites now offer agents and connectors that users can activate themselves.

Is the model suitable for a large group?

It provides a solid foundation, but a large group will need more robust governance (a formal AI committee, a tool evaluation process, coordination with subsidiaries and group policies) and specific handling of high-risk systems. This is a tailored approach that we undertake on a project basis.

How often should it be updated?

The register of tools (appendix) is subject to change at any time, without requiring a new signature. The body of the charter is reviewed annually, and at major regulatory deadlines: December 2026, December 2027, August 2028.

7. Going further

The template covers common uses. If you would like a charter drafted with your teams, aligned with your business and sector, and deployed with training that meets Article 4 of the AI Act, Discover our mission statement and charter for the use of generative AI. or book a 30-minute exchange.

Sources

• Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (AI Act): thumb up
• Regulation (EU) 2026/1744 known as "Omnibus IA", which entered into force on 27 July 2026, amending in particular Article 4 and the timetable for implementation.
• CNIL, recommendations on the development of AI systems and practical guide on the use of generative AI assistants at work: cnil.fr
• Labour Code, articles L1222-4, L1321-5, L2312-8 and L2312-38: legifrance.gouv.fr
• DINUM, DITP, DGAFP, Guide to the use of AI for state public servants, June 2026: ia.numerique.gouv.fr
• ANSSI, Security Recommendations for a Generative AI System (April 2024) and CERTFR-2026-ACT-016 alert on AI agents on workstations (April 2026): cert.ssi.gouv.fr
• Paris Bar Association, model charter for the use of AI for law firms, July 2026: avocatparis.org