In most organisations, employees are already using AI, often without clear rules. This leads to uncertainty: What may I enter? Can I simply use the result? A short AI policy creates clarity and protects data, quality and reputation.
Why a policy helps
- Confidence for employees: Anyone who knows what is allowed uses AI more safely and productively.
- Data protection: Clear rules prevent confidential information from ending up in the wrong tools.
- Evidence: Together with training, it documents your measures on AI literacy. To our AI training
What belongs in it
A good policy is short, understandable and practical. Above all, it answers: Which tools are allowed? Which data is off limits? Who checks results? Who decides? Whom do I turn to?
The template
Adapt the placeholders in square brackets to your organisation. Have the finished version reviewed by your data protection officer.
AI policy of [organisation] As of: [date] · Responsible: [name, role] 1. Purpose This policy governs the use of AI tools at work. It is intended to enable the benefits of AI and limit risks to data, quality and reputation. 2. Permitted tools Only the following tools may be used for work purposes: [list]. New tools are approved by [department] before use. 3. Data The following may not be entered into AI tools: - personal data of customers, employees or third parties, unless the tool has been expressly approved for this - confidential information, trade secrets, access credentials - [further categories] 4. Checking results AI results are drafts. They are checked for accuracy, completeness and tone before use. The person who uses the result remains responsible. 5. Labelling Where it matters to recipients, it is disclosed that content was created with AI. Chatbots for customers or citizens are labelled as AI. 6. Decisions AI does not make decisions about people, for example on applications, benefits or appraisals. It may prepare; a person must decide. 7. Copyright Third-party texts, images or data are only used if the rights have been cleared. 8. Training Employees who use AI are trained and regularly informed about new developments. 9. Questions and incidents Questions and possible problems are reported to [contact person]. 10. Review This policy is reviewed at least once a year.
The template is a starting point and does not replace a legal review. You are free to use and adapt it.
How to introduce the policy
Adapt the template and align it with data protection, IT and, where applicable, the staff council.
Present it in a short meeting or training session, with examples from everyday work.
File it where it is easy to find, for example on the intranet.
Review it once a year. AI is developing fast.
FAQ
Is an AI policy mandatory?
There is no explicit legal obligation to have a policy. It does help you comply with data protection rules and document your AI literacy measures under the EU AI Act.
Who should be involved?
Management, data protection, IT and, where there is one, the works council or staff council.
