Published
8 MIN READ
AI use policy: a template for your company to adopt
An AI use policy is the internal document that says which artificial intelligence tools the company allows, what data can go into them, who reviews what comes out and what to do when something goes wrong. In Brazil, no law requires a document by that name, but the LGPD, Brazil's data protection law, demands the measures it organizes.
The team has been using writing, transcription and coding assistants for months, each person with whatever account they found best, and someone asks whether that's allowed. Anyone who has read about the LGPD and artificial intelligence inside the product will recognize the same logic, now applied to people and vendors.
At Wama, AI goes into code and automation, with Claude Code and Framer's agents, and every output goes through human review before reaching the client. That rule fits on one line and is already a use policy. The template below turns that kind of decision into ten clauses you adapt to your operation.
Why does a company need an AI use policy?
Because the law demands the result, and the policy is the cheapest way to prove it exists. Article 50 of the LGPD allows companies to draw up rules of good practice and governance, with procedures, security standards, educational actions and internal oversight mechanisms. The same article lists what a privacy governance program should have, including internal policies and incident response plans.
Article 46 requires technical and administrative security measures and says they apply from the design of the product or service. A personal AI assistant account receiving a customer spreadsheet is exactly the kind of exposure those measures exist to prevent.
Without a written rule, each person decides alone what's acceptable, and the company only discovers the pattern after the problem. The article on Claude Code in development shows the other side: with a clear rule, AI speeds up the work without anyone having to guess the limit.
The template in ten clauses
The following template was designed for a mid-sized company, with a team that already uses AI day to day. Replace the brackets with your operation's details and review it with whoever handles data protection before distributing it.
Purpose and scope. This policy applies to everyone at [COMPANY] and to whoever works on its behalf, including vendors. Owner: [NAME AND TITLE].
Approved tools. Only tools on the official list, with a company account: [TOOL, ACCOUNT TYPE, PERMITTED USE].
Requesting a new tool. Before approving, check whether the vendor uses data to train models, where it processes it and what the contract says.
Permitted data. Follow the green, yellow and red traffic light (next section).
Prohibited uses. Making decisions about people without recorded human review; sending a client text that no one has read.
Human review. Whoever uses the AI is accountable for the result; numbers, quotes and sources are checked at the origin.
Transparency. Let clients and users know when they're talking to an automated system.
Vendors. The same rules go into the contract of whoever works for the company.
Incidents. Exposed red data goes to [OWNER] the same day.
Review. Every [6 MONTHS] or when a new tool comes in.
Clause 3 is the one that protects the most. It gains weight when AI stops just answering and starts querying internal systems, the subject of the article on MCP for businesses.
What data can go into an AI tool?
Only what's necessary for the task, and never sensitive data or credentials. The necessity principle, in Article 6 of Brazil's General Data Protection Law, limits processing to the minimum required for the purpose, and that applies equally when processing happens inside an AI assistant.
Color | What goes in | Condition |
|---|---|---|
Green | public information, your own text with no personal data, fictional examples | any approved tool |
Yellow | internal documents, de-identified customer data, draft contracts | only an approved tool with a company contract |
Red | passwords and access keys, health data, full banking data, employee data for evaluation | never |
Yellow is where the real work lives, which is why the tool list in clause 2 matters so much. The same spreadsheet can be green after anonymization and red before it.
Financial companies have an extra layer: a credit decision supported by a model gives the data subject the right to request a review, a point the article on AI for fintechs details.
What to require from a vendor that uses AI on your project
The policy applies to whoever works on the company's behalf, and that includes agencies, studios and developers. When hiring, ask for four answers in writing: which AI tools go into the project, what data of yours goes into them, who reviews what the AI produces and who owns the result at the end of the contract.
In software, ownership of the code depends on the contract, and the article on custom software and who owns the code shows the clauses that settle that question.
When Wama delivers a project, it's transferred to the client's account: website, domain and account are in the client's name, and a single person is accountable from brief to deploy. That kind of verifiable answer is what clause 8 should require from any vendor.
If the project is a product with AI inside, the list grows: a log of what the model did, review of decisions and a contract with the model provider. Anyone who's going to build a SaaS with AI needs these answers before the design.
What should you do when someone pastes sensitive data into AI?
Treat it as a possible security incident, the same day. The Incident Reporting Regulation of the ANPD, Brazil's data protection authority, approved by CD/ANPD Resolution No. 15 of April 24, 2024, defines an incident as a confirmed adverse event that violates the confidentiality, integrity, availability or authenticity of personal data.
If the incident may cause relevant risk or harm, notification to the ANPD and to the data subject must go out within three business days, counted from when the company learned that personal data was affected. For small processing agents, the deadline is doubled.
Even an incident that doesn't need to be reported goes into the internal log, kept for at least five years. That's why clause 9 names an owner and requires notice the same day.
In practice, the playbook has four steps: delete the conversation when the tool allows it, notify the owner, assess the risk with whoever handles data protection and record what happened.
Common mistakes
Copying another organization's policy. A scientific journal and a newsroom have risks different from yours; their text rarely talks about clients, contracts or vendors.
Banning everything. The team keeps using AI on their phones, now with no rules at all, and the company loses even the chance to know what's circulating.
Writing it and not training anyone. A policy nobody understood doesn't change the work; a short conversation, with real traffic-light examples, is worth more than the PDF.
Forgetting the vendor. Client data leaves through the hired agency or developer, outside the reach of the internal rule.
Promising that AI will shorten every deadline. At Wama, AI sped up building, not deciding, and the total timeline of projects didn't change; the gain showed up in the finish.
Frequently asked questions
Is an AI use policy mandatory in Brazil?
No Brazilian law requires a document by that name. The LGPD, however, demands security measures from the design stage, harm prevention and accountability, and Article 50 provides for rules of good practice and governance. An AI use policy is the simplest way to bring those measures together and prove they exist.
Who should approve the AI use policy?
The company's leadership, with support from whoever handles data protection and whoever knows the tools day to day. The document needs an owner with a name and title, because that person approves new tools, receives incident notices and decides the gray areas the text doesn't resolve.
Does the AI use policy apply to vendors?
It should. Agencies, studios and developers handle the company's data and produce material on its behalf, so the same rules go into the contract. When it's time to choose a web design agency, ask which AI tools it uses, what data of yours goes into them and who reviews the result.
How often should the policy be reviewed?
A review every six months is usually enough to start, and it should also happen whenever a new tool comes in or usage changes. The list of approved tools ages quickly. Write the date of the next review into the document itself, next to the name of the person responsible for updating it.
Does the AI use policy replace the LGPD program?
No. It's one piece of it. The privacy governance program described in Article 50 of the LGPD covers all of the company's data processing, with risk assessment and an incident response plan. The AI use policy applies those rules to a specific type of tool and to the people who use it.
If your company is going to put AI inside a product or a website this cycle, start with the policy: it defines what the project can use and what the vendor needs to answer before the first screen. Talk to Wama about your project.
