Guide · AI usage policy
Corporate AI usage policy template
A Corporate AI Usage Policy is the formal set of guidelines, risk matrices and operational controls that sets the limits of Artificial Intelligence adoption in a company, classifying tools and agents into three clear authorization levels: Allowed, Requires Approval and Prohibited.
In practice, it answers for every AI use whether it is allowed, needs approval or is prohibited, and says who decides, who approves and where the record lives.
The matrix
Three levels, one rule for each use.
The matrix is the core of the policy. Every AI use falls into one level, and the level defines what happens before the action. The criterion is the data involved and the impact of the action, not the tool.
free use
Allowed
Low-sensitivity tasks, with no confidential or personal data.
- Brainstorming and idea generation
- Drafting internal text without confidential data
- Summarizing public material
- Support for study and open research
human in the loop
Requires approval
Uses that affect customers, money, production or personal data. A person approves before the action.
- Working with production code
- Analyzing financial data
- Sending emails or proposals to customers
- Actions with regulatory impact or personal data (LGPD)
block list
Prohibited
Uses whose risk is not worth it in any scenario.
- Restricted customer data in a public LLM
- Credentials, passwords or access keys
- Trade secrets or undisclosed strategy
- Unapproved AI tools (shadow AI)
The examples are a starting point. Each company adjusts the matrix to its own data, industry and risk appetite, and reviews it when a new case appears.
The template
What the policy must contain.
A policy that works fits in a few pages and answers eight points. Use this structure as a template.
- 01
Purpose and scope
Who the policy applies to (employees, contractors and automated agents) and which AI uses it covers.
- 02
Approved tools
The list of approved tools and models, with the corporate account to use. Anything not on the list does not receive company data.
- 03
Data classification
Which data may go into each tool: public, internal, confidential and personal. Personal data follows the principles and security measures of Brazil's LGPD.
- 04
Usage matrix
The three levels, with examples by area: allowed, requires approval and prohibited.
- 05
Owners and approvers
Who owns each use case and who approves the actions in the middle level.
- 06
Records and audit
What is recorded for every approved use, who can consult it and for how long.
- 07
Incidents and exceptions
How to report misuse or a leak, and how to request an exception to the rule.
- 08
Training and review
How people learn the policy and when it is reviewed.
Before the policy
First, know what is already in use.
In 10 days, the Executive AI Diagnostic inventories AI uses by area, with risk, cost and priority. It is the basis for a policy that fits the company's routine.
Why now
AI is already in. The policy is not.
- 2.5x
- growth in the average monthly number of GenAI-related data security incidents in early 2025. They now account for 14% of all data security incidents across SaaS traffic.Palo Alto Networks, The State of Generative AI 2025, June 2025[1]Checked on
- 40%+
- of organizations will suffer security and compliance incidents due to the use of unauthorized AI tools by 2030.Gartner, November 2025, via Infosecurity Magazine[2]Checked on
- 69%
- of cybersecurity leaders have evidence or suspect that employees use public GenAI at work.Gartner survey, 2025, via Infosecurity Magazine[2]Checked on
- 37%
- of respondents attribute some EBIT impact to their use of AI. Individual productivity does not turn into company results on its own.McKinsey, The state of AI in 2026, August 2026[4]Checked on
Banning everything does not work: it pushes use into the shadows. A policy works when the right path is the easiest one.
From policy to practice
A PDF policy does not enforce itself.
A document says what should happen, but it does not stop something else from happening on a Friday afternoon. A policy only holds when it is checked at the moment of the action, in code. That is the role of an AI harness: inspecting every agent request at runtime and applying the rule before the action happens.
| Situation | PDF policy | Policy in the harness |
|---|---|---|
| Allowed use | Trusts that people read the document | Runs and records who asked, what and with which tool |
| Use that requires approval | Depends on someone remembering to ask | Stops the action and opens an approval for the case owner |
| Prohibited use | Found out later, after the data has left | Blocks it first, records the attempt and notifies the owner |
| New tool | Comes in without anyone knowing | Only runs once approved; the request goes to the review queue |
The full architecture is in the AI harness guide.
Read the guide: what is an AI harness
How Reveno does it
From a written policy to an enforced one.
Reveno writes the policy with your company and puts it to work. The work follows the same track as always.
Diagnose10 days
Inventory of AI uses by area, tools in use, data involved and the risk map that feeds the matrix.
Organize6 weeks
Usage policy with the three-level matrix, owners and approvers per case and the harness configured to enforce the rule.
GovernMonthly
Review of new cases, matrix updates and an executive scorecard of what was allowed, approved and blocked.
Questions about AI usage policies.
What should a corporate AI usage policy include?
Purpose and scope, approved tools, data classification, the three-level usage matrix (allowed, requires approval and prohibited), owners and approvers, records and audit, incident and exception handling, and a training and review cycle.
Does Brazil's LGPD require an AI usage policy?
The LGPD does not require a document with that name. But it requires the processing of personal data to follow principles such as purpose, necessity and security (art. 6) and requires processing agents to adopt technical and administrative measures to protect that data (art. 46). When AI processes personal data, the usage policy is the practical way to define and demonstrate those measures.
How do you deal with shadow AI in a company?
With three moves: offer approved tools that solve day-to-day work, make clear what is prohibited and why, and see the real usage. According to Palo Alto Networks, organizations have about 66 GenAI applications in use on average. Banning without offering an alternative pushes use off the radar.
Who should own the AI usage policy?
The executive team. In McKinsey's 2025 survey, CEO oversight of AI governance is among the factors most correlated with the self-reported EBIT impact of generative AI, yet only 28% of respondents said their CEO holds that role. In operations, IT and security run the controls, legal and compliance handle the regulatory framing, and each business unit owns its use cases.
How often should the policy be reviewed?
Whenever a new high-impact case appears and in regular cycles defined by the policy itself. In Reveno's monthly governance, new cases are reviewed every month and the matrix is updated when needed.
Sources
- Palo Alto Networks. GenAI's Impact: Surging Adoption and Rising Risks in 2025 (The State of Generative AI 2025), June 5, 2025.Checked on Back to the text
- Gartner, via Infosecurity Magazine. Gartner: 40% of Firms to Be Hit By Shadow AI Security Incidents, November 20, 2025.Checked on Back to the text
- McKinsey. The state of AI: How organizations are rewiring to capture value, March 2025.Checked on
- McKinsey. The state of AI in 2026: On the road to ROI, August 2026.Checked on Back to the text
- Brazil. Law 13,709/2018, General Data Protection Law (LGPD).Checked on Back to the text
How to cite this guide
- Short citation
Reveno (2026), Corporate AI usage policy template, reveno.com.br/en/guides/ai-usage-policy
- Full citation (APA)
Reveno. (2026, November 2). Corporate AI usage policy template. https://reveno.com.br/en/guides/ai-usage-policy
Cite the title, Reveno as author, the date and the link. Third party numbers keep their original source, listed above.