Your company's AI charter, and what the law requires

What happens while you hesitate

A team member pastes an extract from a contract into a public assistant to get it summarised. An accountant has it check over a letter containing a client's name and turnover. Nobody means any harm, everyone wants to go faster, and none of it leaves any trace inside the company.

Banning it by internal memo doesn't work: the tool is in everyone's phone. A charter isn't there to ban, it's there to make the rule clear enough to be followed, and to offer an internal alternative when the rule blocks something useful.

What European regulation already requires

The European regulation on artificial intelligence has been applying in stages since February 2025. Two obligations concern any company that uses these tools, even one that builds none of them.

The first is literacy: the company has to make sure that the people using an AI system on its behalf understand well enough what they are handling. This obligation has been in force since 2 February 2025 and doesn't depend on any size threshold. The second is about transparency: when content is produced by a machine, that has to be knowable.

On top of that comes personal data regulation, which hasn't changed: sending client data to a third-party service is still processing, with everything that requires in terms of legal basis and information. A charter that only talks about AI without talking about personal data has covered half the subject.

The eight points a charter has to settle

Which tools are allowed, by name, and which are not. Which data can go into them and which never leaves: client identities, accounting documents, personnel files, passwords and access credentials.

What has to be read by a human before it leaves the building. What has to be flagged as machine-produced. Who decides when a case is not covered. What you do with a wrong answer, and who you report it to. How a new tool gets onto the approved list. And the date of the next review of the text, because a 2025 charter describes a landscape that no longer exists.

A template to adapt, in eight articles

Article 1, purpose. This charter sets out how artificial intelligence is used here. It applies to everyone: employees, interns and contractors, on every device, work or personal, whenever the company's work is involved.

Article 2, approved tools. Only the tools on the list maintained by [the designated officer] may be used for work. Any other tool requires written approval before first use.

Article 3, prohibited data. The following never leave for an external AI tool: client names and contact details, the documents and figures in a client file, staff data, usernames and passwords, documents marked confidential. Where there is doubt, the data is treated as prohibited.

Article 4, human review. No text produced by an AI goes out to a client, a partner or a public body without being read and approved by the person sending it. That person remains responsible for it.

Article 5, transparency. Content substantially produced by an AI and intended for outside the company says so. Automated replies sent in the company's name are signed as such.

Article 6, errors. A wrong or doubtful answer is reported to [the designated officer], who corrects the source or removes the tool from the list. No one is penalised for reporting an error.

Article 7, training. Everyone concerned is given a walkthrough of the approved tools, their limits and this charter, before first use and whenever something significant changes.

Article 8, review. This charter is reviewed at least once a year by [the designated officer]. Version [number], in force as of [date].

What a charter does not solve

It does not replace an internal tool either. As long as the only way to get a document summarised is to paste it into a public service, the charter will be worked around by people in a hurry acting in good faith. That is the point of what we are building: an assistant that works on the company's own documents, in an instance the company owns, and that forces nobody to choose between the rule and getting the job done.

Nor does it replace the record of processing activities or the impact assessment where one is required. If what you do touches sensitive data or decisions that affect people, the charter is the start of the work, not the end.