Policy
What an AI policy should contain, how to write one in eight steps, a fictitious example of policy rules and the mistakes you are better off avoiding.
An AI policy describes which AI tools employees may use, for which tasks, with which data and under whose responsibility. It also covers what happens after a mistake or incident, how employees are trained and when the document is reviewed. A good policy fits on a few pages and is understandable without legal knowledge.
No law literally says you must have a document called an “AI policy”. There are, however, obligations that are difficult to meet without written arrangements. In its warning about AI chatbots and data breaches, the Autoriteit Persoonsgegevens (AP), the Dutch data protection authority, says organisations must make clear arrangements with their employees: may they use chatbots, and if so, which data may and may not be entered? An AI policy is where those arrangements are recorded.
It is not a technical manual, a sales pitch for a tool or a list of legal articles. Nor is it a guarantee. A policy nobody reads changes nothing in practice. Read why such use often remains out of sight in the article on shadow AI.
You can use the table below as a contents page. Each element answers one question and has one owner. If no name is attached to an element, it does not happen.
| Element | The question it answers | Owner |
|---|---|---|
| Purpose and scope | Who and which uses does this apply to? | Management |
| Permitted tools | Which AI tools and subscriptions may we use? | IT or the application administrator |
| Data | Which data may go in, and which never may? | Privacy lead or data protection officer |
| Permitted and prohibited use | Which tasks are and are not allowed? | Management, with team leaders' input |
| Human checking | Who checks the output before it leaves? | Team leaders |
| Roles and decisions | Who approves a new tool or new use? | Management |
| Incidents | Where do you report a mistake and who assesses it? | Privacy lead or data protection officer |
| Training | What must someone know before working with AI? | HR or the manager |
| Suppliers | Which agreements exist and who manages them? | Procurement or management |
| Transparency | What do we tell clients and employees about our AI use? | Management |
| Review | When do we look again and who initiates this? | Policy owner |
“Only use approved AI tools” is not a rule if nowhere says which they are. Name the tool and subscription. There is a big difference between a free account and a business subscription from the same provider; see the subscription comparison. Include a reference date, because providers regularly change their terms.
Most organisations can manage with a simple classification.
A breakdown by data type appears in May you put client data into an AI chatbot?.
Establish one route for new tools and new uses. Who may apply, who assesses it and how soon will there be an answer? If an application takes months, people arrange things themselves. A one- or two-week timeframe for simple applications is achievable if the criteria are established in advance.
An employee who accidentally puts a file containing personal data into the wrong tool must be able to report this without barriers. For a data breach, the GDPR requires notification to the supervisory authority without undue delay and, where feasible, within 72 hours. This appears in Article 33 GDPR. You will only meet that deadline if the internal report arrives the same day. Data breach through an AI chatbot explains how to assess whether notification is required.
Rules only work when people understand why they exist. Record which training someone takes before gaining access, how often it is repeated and where you track who completed it.
For an organisation with a few dozen employees, a first version is achievable within a few weeks if the inventory does not overrun. Do not wait for a perfect document. A first version covering three tools and three data groups is better than a draft circulating for six months.
Below is an extract from the AI policy of a fictitious consultancy, Bureau Voorbeeld, with eighteen employees. It illustrates tone and structure rather than serving as a template to copy. Tool names have been omitted: fill in your own choices.
Notice that every rule can be read in one go, says what to do rather than only what is prohibited, and names somewhere to turn for help. Rule 5 is deliberately strict. Using AI for decisions about people may entail stricter AI Act requirements and requires a separate assessment.
The policy is the cover sheet for three other documents. It refers to them rather than repeating them.
Article 30 GDPR requires a controller to keep a record of processing activities, including purposes, categories of data subjects and personal data, and recipients. If you process personal data with an AI tool, that belongs in the register: as new processing or an addition to existing processing, with the provider as recipient. The article has a conditional exception for small organisations. Do not simply assume it applies; ask your privacy adviser whether it applies to you.
Article 35 requires a data protection impact assessment where processing is likely to result in a high risk to people's rights and freedoms, particularly when using new technologies. Carry out the assessment before starting. Whether your AI use falls within it depends on the data and scale. Your policy records who makes that assessment and when. Find further details in DPIA for AI tools.
Article 4 of the EU AI Act has applied since 2 February 2025. The text was amended in summer 2026 by the digital omnibus on AI. Providers and deployers of AI systems take measures to support the development of their staff's AI literacy. They do not have to ensure a particular level for each person. Your policy's training section is where you describe those measures. Read what that means for employers in AI literacy is mandatory.
The policy is not a register, DPIA or data processing agreement. It states that these exist, who manages them and where to find them. Whether your organisation thereby meets its obligations is a judgement you make yourself, with a lawyer or your data protection officer where necessary.
Through behaviour, rather than the document. Employees ask questions before trying something new. Reports of small mistakes come in. The list of permitted tools grows on request. Silence is rarely a good sign.
PrivaSearch is a search layer for documents containing personal data: it pseudonymises, has a colleague approve the result and then enables searching with source references. That environment involves paperwork, some of which it writes itself. The page on the GDPR and the AI Act lists those documents.
One is an AI policy. According to that page, it comprises thirteen chapters on permitted and prohibited AI use, roles, incidents and AI Act classification, with appendices for technical configuration and an employee checklist. It is created from one form, without a language model, and its content follows your environment's actual configuration. It therefore contains no measure that is not enabled.
You also receive a DPIA starter document, an entry for your record of processing activities and a written lawful basis with a balancing assessment. These are starter documents, not legal advice. The rest of your record of processing activities, your data protection officer's advice and formal adoption remain your responsibility. Also check for yourself whether the document covers all AI use in your organisation, such as rewriting emails or summarising meetings, and supplement it where it does not.
The policy's training is part of the product. Employees take brief AI literacy training, repeated periodically, and without current training the workspace does not open. The page on how it works explains this. The AI assistant connection works with Claude, ChatGPT Business and Mistral Vibe. Read what that means for the GDPR on the page about AI chatbots and the GDPR.
To see the documents for your own situation, book a demo.
No law requires a document with that name. However, the GDPR and AI Act require things difficult to arrange without recorded agreements, such as a record of processing activities, risk assessment and AI literacy measures. The Autoriteit Persoonsgegevens asks organisations to make clear arrangements with employees about AI chatbot use. An AI policy is the usual way to do this.
As short as possible. For many organisations, two to four pages of rules suffice, with appendices listing permitted tools and technical configuration. The rules themselves should be readable in a few minutes. If the document becomes longer, separate employee rules from the substantiation for management and the supervisory authority.
Management or the board, because it involves choices about risk, budget and responsibility. The content usually comes from an owner working with IT, the privacy lead or data protection officer, and several employees with practical experience. If your organisation has a works council, check in advance whether it has a role, for example if the policy also concerns monitoring employees.
You can have a chatbot draft an outline, but the result describes a generic organisation rather than yours. You must fill in and check the tools, subscriptions, settings and responsible people yourself. Do not enter internal or confidential data into a tool for which you have made no arrangements. Have someone knowledgeable about privacy review the draft before adopting it.
Schedule at least one regular review annually and identify triggers for interim reviews. Think of a new tool, an incident, changed provider terms or new rules. In 2026, for example, the European AI literacy rule's text was amended. The list of permitted tools and subscriptions deserves more frequent attention, for example quarterly.
An AI policy sets arrangements for employees: which tools, which data, who decides. A DPIA assesses the risks of one processing activity for the people the data concerns, with the measures you take to address them. The GDPR requires a DPIA where high risk is likely. The policy refers to the DPIA, but does not replace it.
Who decides on AI tools, who assesses the risks and who oversees them? The roles explained, with a simple meeting structure and an AI register.
Employees often use AI chatbots outside their organisation's visibility. What that means, what can go wrong and how to gain control step by step.
Copilot shows what employees can already open, including overshared files. What Microsoft documents, what the DPIAs say and what to arrange first.
We show it with fictitious client files from your sector: upload, detection, review, search and the connection with your AI assistant. Afterwards you'll know exactly what your team can use safely.
Book a demo →