AI use policy for a legal department: the template to adapt

Generative AI tools are a few clicks away. In a company, a lawyer or a salesperson can therefore paste a draft contract into one without anyone having decided whether this use is acceptable. The policy first serves to get out of this gray area.

Two reference texts shed light on the subject. The CNIL (the French data protection authority), in its Q&A of July 18, 2024 on generative AI, encourages organizations to adopt an internal policy or charter that specifies authorized and prohibited uses, and to train users. The EU AI Act, in its Article 4 as amended by Regulation (EU) 2026/1744 published on July 24, 2026, requires providers and deployers to take measures to promote AI literacy among their staff, without requiring them to guarantee a specific level.

The legal department often drafts the text, but it cannot decide alone. The CNIL FAQ highlights the role of the DPO, working with the chief information security officer. It also mentions an ethics committee or ethics officer for sensitive uses.

Three scope decisions need to be made from the start:

• People. Does the policy cover only the legal team, or also the business functions that handle contracts, such as procurement and sales?
• Tools. Does it cover only generative AI, or also the AI features built into software already in place?
• Providers. Are your outside counsel and external providers covered when they work on your matters?

Finally, this document must fit with what already exists: IT charter, security policy, GDPR procedures. Depending on your organization, putting it in place may also require informing or consulting employee representatives, a point to check with your counsel.

A three-level list remains readable and is easy to update. The classification below is only an example of reasoning: it depends on your tools, your commitments and your risk appetite.

• Free use. For example, rephrasing a text with no confidential data or preparing a training outline.
• Governed use. For example, summarizing a contract or comparing a clause with an internal position, in an approved tool and with mandatory review.
• Excluded use. For example, sending a legal opinion to an internal client without review, or making a decision alone based on an AI output.

Each governed use benefits from being tied to a specific tool, a data category and a verification rule. One table row is often enough. This is the format proposed in the template.

This is the most anticipated section, and often the hardest to decide. A contract frequently combines personal data, commercial terms and sometimes a confidentiality commitment toward a third party.

The CNIL FAQ encourages users to enter only what they are authorized to share, and to avoid personal data as well as information covered by a secrecy obligation. For consumer services, it mentions using dedicated work addresses and turning off, where possible, the provider’s reuse of data. ANSSI (the French national cybersecurity agency) goes further in its 2024 guide on generative AI: its recommendation 34 rules out tools available on the internet for professional use involving sensitive data.

The questions to decide are therefore concrete:

• What categories of data exist in your company, and what can each approved tool receive?
• Should certain elements be anonymized or removed before any input, and who checks this?
• How should a contract covered by a non-disclosure agreement with a partner be handled?
• Can approved prompt templates reduce input errors? The CNIL mentions this possibility.

A point to watch in 2026: in-house lawyers’ legal opinions. French Law No. 2026-122 of February 23, 2026 creates, under conditions, confidentiality protection for these opinions. According to the analysis by the law firm Dechert published in March 2026, it will enter into force on a date set by decree, no later than February 1, 2027, and it requires in particular specific labeling and filing. The policy can therefore set out how these documents are handled in AI tools, after consulting your counsel.

An AI output can be wrong while seeming convincing. The CNIL advises never to reuse it as is and to check, in particular, its accuracy. For a lawyer, the risk is well known: a nonexistent reference or a poorly summarized clause. The article on AI hallucinations covers this subject.

A general review rule is not always enough. It becomes more useful when it answers these questions:

• Which checks are mandatory: going back to the source text, checking references, checking figures and dates?
• Who approves, and from what level of stakes is a second review required?
• Should the use of AI be disclosed in a deliverable, and to which recipient?
• What record should be kept: the prompt, the answer, the version retained, the reviewer’s name?

The policy should name a list of authorized tools and the procedure for adding one. Without this procedure, teams will test new services outside any control, often with a personal account.

Approving a tool requires reviewing at least the processing location, data retention, any reuse of data, subprocessors and contractual guarantees. Our article on hosting and confidentiality details the questions to ask. When the provider processes personal data on your behalf, Article 28 of the GDPR also applies.

A document that no one reads does not protect many people. The CNIL recommends appropriate training, regular checks and collecting user feedback. A few decisions make this workable:

• A named owner. One person answers questions and keeps the list of tools up to date.
• A point of contact. Users know whom to report an error, a doubt or an accidental input to.
• A review date. Tools and texts change quickly. The AI Act timeline was itself amended in 2026, as explained in our article on the Digital Omnibus.
• A short format. One page of rules for users, and a detailed appendix for those who need it.

An AI use policy can apply to Docform as to any other tool. AI is built into the contract lifecycle: the assistant suggests, flags points of attention and cites the source passage, and the lawyer checks and decides. The playbook turns your positions into review rules. Permissions and roles determine who can view each contract, and contracts are hosted in France. The AI can make mistakes: review remains necessary. Details of the subprocessors are on the security page.