AI Policy Template for Companies India: Free Sample Policy

An AI policy template for companies in India should fit on one page and cover eight things: approved tools, permitted uses, data that must never be entered, prohibited uses, human review, disclosure and labelling, incident reporting and consequences of breach. No Indian law yet requires a separate AI policy, but the DPDP Act, 2023, the IT Act, 2000, the Copyright Act, 1957 and client contracts already bind your organisation, and a short policy turns those duties into clear staff rules. A sample AI usage policy you can adapt is below.

AI policy template for companies India: why it makes sense now

Staff are already using AI tools, with or without permission. Without a policy, people either use them secretly (and paste things they should not) or avoid them out of fear. A one-page policy fixes both by saying clearly what is allowed.

The legal case is concrete. Under the DPDP Act, the organisation is the Data Fiduciary and, from 13 May 2027, must take reasonable security safeguards and report personal data breaches. The February 2026 amendment to the IT Rules requires platforms to label synthetically generated audio and video, and anything your business publishes should follow the same discipline. Copyright and defamation risks arise whenever AI output is published. MeitY’s India AI Governance Guidelines favour handling AI risks under existing laws, so these are the laws that bind you.

Sample AI usage policy (adapt the brackets)

[Organisation Name]: Policy on Use of AI Tools
Effective from [date] | Owner: [name, designation] | Review: every [6/12] months

1. Purpose. To let staff use generative AI tools for work safely, lawfully and productively.
2. Who it covers. Employees, interns, consultants and vendors doing work for us, on any device.
3. Approved tools. [List tools and account types]. Other tools need written approval from [department]. Personal accounts only for tasks with no personal, client or confidential information.
4. Permitted uses. Drafting and rewriting; summarising public material; brainstorming; formatting; spreadsheet formulas using dummy data; learning.
5. Never enter (unless the tool is approved in writing for that data): personal data of customers, staff, students or patients; ID numbers, bank, salary or health details; client documents and NDA material; unpublished financial, pricing or tender information; passwords, keys and source code.
6. Prohibited uses. Final decisions on hiring, appraisal, discipline or termination; legal, medical, tax or financial advice without qualified review; realistic images, audio or video of real people without written consent; defamatory, discriminatory, obscene or misleading content; impersonation.
7. Review. The user is responsible for every output. Check facts, figures and legal references against official sources. High-risk material is reviewed by [designation] before it goes out.
8. Disclosure and labels. Disclose AI use where a client, contract or manager requires. Label realistic AI images, audio or video we publish.
9. Intellectual property. No uploading third-party copyrighted material except as law or licence permits; no prompts copying an artist’s style, brand logos or characters.
10. Security. AI apps and browser extensions only with approval; no meeting transcription tools without telling participants.
11. Incidents. Report wrong data entry or harmful output to [name, email] the same day. Prompt reporting counts in your favour.
12. Breach. May lead to action under [service rules, employment contract or vendor agreement].

Acknowledgement: I have read and will follow this policy. Name, signature, date.

Employee AI guidelines by sector

• Schools and colleges: no student names, marks, attendance, health or family details in AI tools; rules on student AI use in assignments; question papers checked against the syllabus.
• Clinics and hospitals: no patient identifiers or clinical records in unapproved tools; no AI medical advice to patients without a doctor’s review.
• Accounts and finance: no client statements, PAN, bank or tax data; tax figures checked on official portals.
• Retail and small business: no customer lists; no unprovable claims such as “No. 1” or “clinically proven” in AI-written ads.
• HR: no CVs or employee files in unapproved tools; AI never the final decision-maker on people.

How to roll it out in a week

1. List the AI tools staff already use (ask; do not punish honest answers).
2. Decide which tool and account type is approved, and which tasks may be done in personal accounts with no sensitive data.
3. Fill the template, add sector rules, and have a lawyer review it if you handle sensitive data or work in a regulated sector.
4. Explain it in a 30-minute meeting with real examples of allowed and forbidden prompts.
5. Collect signed or emailed acknowledgements.
6. Diarise a review date. AI rules are changing: MeitY published a draft further amendment to the IT Rules in 2026 that is not yet law.

Companies building AI products also need governance and risk assessment, a separate exercise.

Frequently asked questions

Is there an AI policy template for companies in India?

Yes, the sample above covers purpose, approved tools, permitted and prohibited uses, data limits, review, disclosure, IP, security, incidents and breach. Adapt the bracketed parts, add sector rules and collect staff acknowledgements.

Is an AI policy mandatory for companies in India?

There is no standalone legal requirement as on 29 October 2026. But the DPDP Act, IT Act, Copyright Act and client contracts already apply to how staff use AI, and a policy is the simplest way to show you have taken reasonable steps.

What should an employee AI policy include?

At minimum: which tools are approved, what data must never be entered, which uses are banned, who reviews high-risk output, when to disclose or label AI content, how to report incidents, and what happens on breach.

Can a company ban ChatGPT for employees?

Yes. An employer may restrict or ban AI tools for work through its policies or service rules. Some government offices have done so, for example the Department of Expenditure’s advisory of 29 January 2025.

Quick quiz

Sources

• Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025
• Information Technology Act, 2000; IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, as amended with effect from 20 February 2026
• Copyright Act, 1957
• Bharatiya Nyaya Sanhita, 2023 (s.356 defamation)
• MeitY, India AI Governance Guidelines, 5 November 2025

Train your staff on safe AI use: AI at Work certificate course. For governance of AI systems, see AI Law and Governance in India, ₹599.

This page is for education and general information, not legal advice for a specific case. Law as on 29 October 2026.