Free resource · Word template

Model AI Charter: Framing the Use of Generative AI in 15 Articles

A ready-to-adapt and publish template, aligned with the AI Act, GDPR, CNIL and labor code, with a note for the writer for each article.

📄 Word, 19 pages⚖️ 15 articles and 4 appendices🇪🇺 AI Act and GDPR🆓 Free

Download the modelSee all 15 articles

In most companies, generative AI is already used daily. Not because management decided it, but because a salesperson pasted a customer report into ChatGPT to generate an email, an HR assistant asked Copilot to summarize three resumes, or a developer had Claude review their code. None of these actions is a problem in itself. The problem is that they are done without rules, using personal accounts, and no one knows what data leaves the company. To measure these uses before writing rules, the Shadow AI kit offers an anonymous survey and a 90-day exit plan.

An AI charter addresses this issue in about ten pages. This page explains what it should contain in 2026, what the regulations actually require (and what they don't), and provides a complete template, in Word format, to adapt to your organization.

1. Why an AI charter, and why now?

Three reasons, in order of importance.

Confidentiality. A free version of an AI assistant uses your conversations by default to improve its models. Any information an employee enters (customer data, payroll details, source code, acquisition plans) leaves the company's control without a contract, log, or possibility of retrieval. The risk is not theoretical: the CNIL (French Data Protection Authority) considers such entry of personal data to be data processing, and a leak to be a data breach that must be reported to them within 72 hours.

Quality and responsibility. The models invent figures, sources, and legal references with perfect confidence. Without verification rules proportionate to the stakes, the error ends up in a sales proposal or contract, and it is the company that is held responsible, not the tool.

Regulations. The European AI Act has been phased in since February 2025. Its sanctions regime has been in effect since August 2, 2025; since August 2, 2026, its transparency obligations have been in effect, and national authorities monitor compliance, including Article 4. For a company that uses AI without developing it, the obligations remain moderate, but they do exist, and a charter is the simplest way to demonstrate that they have been taken into account.

There's also a fourth, less frequently cited reason: a charter unlocks usage. As long as the rules aren't written down, half of the employees don't dare use AI, and the other half use it secretly. A well-crafted charter clearly states what's allowed, and it's often more than people imagine.

2. What the law actually requires in 2026

Much of the content on this topic conflates what applies to model developers, companies that develop AI systems, and those that simply use them. For a user company (a "deployer" in the regulation's terminology), here is the current state of the regulations as of September 12, 2026.

Date	This applies	Impact on a user company
2th February 2025	Prohibition of unacceptable practices (article 5) and entry into force of article 4 on the control of AI.	No recognition of emotions at work, no social rating. Train employees who use AI.
2th August 2025	General purpose model suppliers' obligations (GPAI).	None, unless you are developing a model.
27th July 2026	Entry into force of the Omnibus IA regulation (Regulation (EU) 2026/1744).	Article 4 becomes an obligation of means ("promoting the development" of AI mastery). There is no specific fine under Article 4, but oversight by national authorities (since August 2, 2026) can lead to proportionate measures. High-risk deadlines are postponed.
August 2, 2026	Article 50 (transparency) applicable and control by national authorities, including article 4 (the sanctions regime applies from 2 August 2025).	Inform people who interact with a chatbot, report AI-generated images, sounds and videos. Penalties of up to €35 million or 7% of global turnover for prohibited practices, €15 million or 3% for other breaches.
2th December 2026	End of deadline for generative systems already on the market; new bans.	Check that your tools comply with article 50.
2th December 2027	High-risk systems of Annex III.	A CV sorting, evaluation or employee management tool becomes a high-risk system: human supervision, informing employees and the CSE, logs, impact analysis.
2th August 2028	High-risk systems integrated into regulated products (Annex I).	Machinery, medical devices, vehicles, toys.

Three clarifications that change the way the charter is written.

Article 4 is no longer an obligation of result. In its initial version, the AI Act required companies to "take measures to ensure" a sufficient level of AI proficiency. Omnibus Regulation (EU) 2026/1744 replaced this wording with "promoting the development of AI proficiency" and clarifies that there is no longer a requirement to guarantee a specific level for each individual; the Commission and Member States must support these efforts, particularly those of SMEs. Article 99 does not provide for a specific fine under Article 4, but the obligation remains: its enforcement falls under the jurisdiction of national authorities since August 2, 2026, who can take proportionate measures and sanctions. This does not make training optional: in the event of an incident, the question asked will be "what had you done to ensure your teams knew how to use these tools?", and a record of awareness-raising activities is the simplest answer.

The GDPR applies independently of the AI Act. Entering a client's name, a candidate's CV, or an employee's performance review into an AI tool constitutes the processing of personal data. This requires a legal basis, notification of the individuals involved, registration in the data processing register, and, for external tools, a data processing agreement. Article 4 of the model (data classification) is the core of this process.

The Works Council must be informed and consulted Before the introduction of tools impacting working conditions or enabling monitoring of employee activity (French Labor Code, Articles L2312-8 and L2312-38), a charter appended to the company rules must follow the same procedure (consultation with the Works Council, filing with the clerk of the court, and transmission to the labor inspectorate). This is what gives it disciplinary force.

3. The 15 articles of the model, and what they regulate

The model is designed for organizations that use generative AI without developing it, ranging from a team of a few dozen people to a group of several thousand. We drafted it by combining the best publicly available sources as of September 2026: the DINUM's guide to using AI for government employees (June 2026), the CNIL's Q&A on generative AI and its July 2026 note on agentic AI, the ANSSI's security recommendations and its April 2026 alert on AI agents, the charters of the Ministries of Culture and National Education, the Council of State, and the model adopted by the Paris Bar Association in July 2026. Each article offers a default, rather cautious wording, and a note explains the choices to be made. Here's what each one sets.

Article 1. Purpose and scope

Who is affected (employees, interns, temporary workers, contractors), which tools (including AI functions integrated into existing software and personal accounts used in the office), and which situations (including remote work and personal equipment)? This is also where the alignment with internal regulations and the IT charter is decided.

Article 2. Guiding Principles

Seven principles serve as a reference when an unforeseen situation arises: human responsibility, confidentiality, verification, transparency, fairness and accessibility, real-world usefulness, and preservation of skills. The first is the most important: the user remains the author of what they produce with AI. The last, borrowed from the CNIL (French Data Protection Authority), addresses the automation bias: reflexively validating what the AI ​​suggests, to the point of no longer knowing how to do things without it.

Article 3. Approved, tolerated and prohibited tools

Three categories instead of two. "Approved" for tools under professional contracts whose data is not used for training. "Tolerated" for consumer versions, limited to public data. "Prohibited" for everything else, including any tool used via a personal account. The article also addresses accounts (professional accounts, strong authentication, no sharing), browser extensions, and subscriptions purchased without validation, which are the source of shadow AI. The list of names is attached, so it can be updated without requiring re-signing the charter.

Article 4. Data: what can be entered

The core of the system. A basic test borrowed from the DINUM guide ("Could I publish this information on the internet?"), followed by a three-level classification (green, orange, red) cross-referenced with the three categories of tools. An employee must be able to answer the question "Can I paste this?" in ten seconds. Personal data, HR documents, customer data under confidentiality agreements, trade secrets, and technical secrets (passwords, API keys) are red by default, following the list that ANSSI recommends never entering into an online tool.

Article 5. Verification and liability

A level of review proportionate to the intended use: personal draft, internal document, external document, decision affecting a person. For this last case, the rule is simple: the AI ​​does not decide; it prepares elements that a human examines and takes responsibility for. The article adds specific rules to the generated code (reviewing, no automatic execution, verification of suggested libraries) and a list of situations where AI is not used, inspired by the charter of the Ministry of Culture.

Article 6. Transparency

What Article 50 of the AI Act requires since August 2026 (chatbots, deepfakes, published content) and what the company chooses to add: a standardized mention formula ("content written with the assistance of an AI tool and verified by…", taken from the State guide), the cases that do not require it (translation, language correction), the notification to customers when an intellectual service relies heavily on AI, the prohibition of imitating a real person without agreement.

Article 7. Intellectual Property and Confidentiality

In one sense, it's about not submitting content to AI for which you don't hold the rights. In another, it's about recognizing that content generated without human creative input is generally not protectable and that it can reproduce an existing work. The article also addresses the most common blind spot: AI features activated by the publisher in already deployed tools (meeting summaries, email assistants).

Article 8. AI agents, extensions and automations

The article that the 2025 models lack. An AI agent doesn't respond, it acts: it reads and sends emails, modifies files, places orders. In April 2026, the French National Cybersecurity Agency (ANSSI) issued a warning about these products installed on workstations, and the French Data Protection Authority (CNIL) published a note on agentic AI in July. The model derives simple rules from this: prior validation, rights limited to the strict need and reviewed monthly, a list of what the AI ​​never does on its own (send a message to a third party, delete a document, pay, create access rights), testing in an isolated environment, awareness of prompt injection, and logging.

Article 9. Meetings recorded and transcribed

The most widespread and least regulated AI function. Participants must be informed and have the option to object, personal note-taking assistants are prohibited, individual interviews (recruitment, evaluation, disciplinary) cannot be transcribed, data retention is limited, and the report must be reviewed before being sent.

Article 10. AI Training and Mastery

The response to Article 4 of the AI Act: awareness-raising for all within three months (with, as an option, access to tools conditional on its follow-up), in-depth training for intensive or sensitive uses, a guide to good practices, and above all a register of actions carried out with evidence (signatures, supports, dates).

Article 11. Reporting of incidents

What to report (including an unwanted action by an agent or a compromised account), to whom, and within what timeframe. With one crucial clause: a report made in good faith, even regarding one's own error, will not result in any penalty. Without this clause, data entry errors will never be detected.

Article 12. Governance and decisions concerning individuals

A designated AI expert, the Data Protection Officer (DPO) as the ethics contact point, a committee that meets on a fixed schedule (one hour per month for the first six months, then every six weeks), a register of critical uses. And a section dedicated to HR decisions: no recruitment, evaluation, or disciplinary decisions based solely on automated processing (Article 22 of the GDPR), no emotion recognition or monitoring beyond what is legally required, and the identification now of HR tools that will be considered high-risk by December 2027.

Articles 13 to 15. Shortcomings, review, adoption

A reference to the internal regulations and the disciplinary procedure of the labor code, with graduated sanctions. An annual review, and triggers for re-examining a tool adapted from the Paris Bar Association model (change of publisher ownership, terms of use, hosting). An adoption article specifying consultation with the Works Council, addition to the internal regulations, and the individual signature block.

Four annexes complete the document: the register of tools (with the validation date, the verified guarantees and the questions to ask a publisher), the regulatory benchmarks 2025-2030, a twelve-step checklist to deploy the charter, and the list of sources used.

4. Errors that render a charter useless

We have assisted dozens of companies on this issue. Charters that are useless almost always share one of these flaws.

• Ban everything. A charter stating "the use of AI is prohibited without authorization" is circumvented the very next day, with personal accounts on personal phones. You lose visibility without gaining security.
• Name the tools in the body of the text. The tools change every six months. If each change requires a new signature, the charter will never be up to date. Include the list in the appendix.
• Forget about AI functions that are already activated. Automatic summaries of video conference meetings, messaging assistants, and completion in office suites: these features have been activated by the publisher, not by you, and they transmit data.
• Don't say what you can stick on. A charter that refers to "sensitive data" without defining it leaves the decision to each individual. The green/orange/red grid with concrete examples is what makes the rule applicable.
• Distribute via email and consider it done. Without requiring internal regulations or individual signatures, the charter serves only as information. It is difficult to justify sanctions and does not replace consultation with the Works Council when such consultation is required.
• Do not train. An unexplained charter is an unread charter. A two-hour awareness session, with examples drawn from the company's various roles, does more for confidentiality than ten pages of rules. This is also what Article 4 of the AI Act expects.
• Never see her again. The regulatory calendar runs until 2030. Set an annual review date from the first version.

5. Deploy the charter in four weeks

The timeline below reflects what we see working in an organization starting from scratch.

Weekdays	What we do	About
1	Appoint the AI ​​expert. Identify the tools actually used (anonymous five-question survey, license review, inventory of AI functions activated in existing software).	Management, IT Department
2	Classify the tools (approved, tolerated, prohibited). Align the data grid with the GDPR register. Adapt articles 5, 6 and 11 to the business needs.	AI expert, DPO
3	Legal review. Information and consultation of the Works Council if required. Choice of adoption method (annex to the internal regulations or individual signature).	Management, advice, CSE
4	Awareness-raising for all relevant employees (two hours, using concrete examples from the company). Distribution, signatures, archiving. Planning of the first review.	AI expert, HR

Week 4 is the crucial one. A charter presented in a meeting, with examples drawn from the teams' daily work and a question-and-answer session, is implemented. A copy of the charter sent as an attachment is archived. An often-overlooked point: the Works Council (CSE) must be consulted before any deployment. A pilot program that equips an entire department, becomes a long-term initiative, or impacts working conditions already constitutes a deployment (Nanterre Court of Appeal, February 14, 2025, which suspended, under penalty of a fine, an AI deployment launched without consultation); only a truly voluntary test, limited in time and scope, can precede it (Paris Court of Appeal, February 10, 2026).

6. Frequently Asked Questions

Is an AI charter mandatory?

No. No law mandates a document titled "AI Charter." However, the AI Act requires promoting the control of AI (Article 4) and ensuring transparency (Article 50), the GDPR requires regulating the processing of personal data, and the French Labor Code requires informing and consulting the Works Council (CSE). A charter is the simplest way to fulfill these obligations and demonstrate compliance.

AI Charter or amendment to the internal regulations?

The two are combined. The charter is the readable document that explains and provides examples. To be enforceable against employees, it is appended to the company rules and follows the same procedure (consultation with the Works Council, filing, and submission to the labor inspectorate). In a company without company rules (fewer than 50 employees), an individual signature is the alternative.

Should free versions be banned?

Not necessarily. The model classifies them as "tolerated" and limits them to public or non-stakeholder data, with training disabled in the settings. This is more realistic than a ban, and it incentivizes the company to provide an approved tool to those who need it.

How long should a charter be?

Between six and twelve pages, excluding appendices. Anything shorter doesn't answer practical questions (what can I paste?). Any longer won't be read. The template is nineteen pages long, including appendices and drafting notes, which should be removed before distribution; the body of the charter is about twelve pages, and two articles (agents, meetings) can be removed in a very small organization.

Is the model suitable for a large group?

It provides a solid foundation, but a large group will need more robust governance (a formal AI committee, a tool evaluation process, coordination with subsidiaries and group policies) and specific handling of high-risk systems. This is a tailored approach that we undertake on a project basis.

How often should it be updated?

The register of tools (appendix) is subject to change at any time, without requiring a new signature. The body of the charter is reviewed annually, and at major regulatory deadlines: December 2026, December 2027, August 2028.

7. Going further

The template covers common uses. If you would like a charter drafted with your teams, aligned with your business and sector, and deployed with training that meets Article 4 of the AI Act, Discover our mission statement and charter for the use of generative AI. or book a 30-minute exchange.

Sources

• Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (AI Act): thumb up
• Regulation (EU) 2026/1744 known as "Omnibus IA", which entered into force on 27 July 2026, amending in particular Article 4 and the timetable for implementation.
• CNIL, recommendations on the development of AI systems and practical guide on the use of generative AI assistants at work: cnil.fr
• Labour Code, articles L1222-4, L1321-5, L2312-8 and L2312-38: legifrance.gouv.fr
• DINUM, DITP, DGAFP, Guide to the use of AI for state public servants, June 2026: ia.numerique.gouv.fr
• ANSSI, Security Recommendations for a Generative AI System (April 2024) and CERTFR-2026-ACT-016 alert on AI agents on workstations (April 2026): cert.ssi.gouv.fr
• Paris Bar Association, model charter for the use of AI for law firms, July 2026: avocatparis.org