By Laas NuryMost companies already use AI, whether they decided to or not. Someone drafts customer e-mails in ChatGPT, the CRM switched on an AI feature last quarter, and the finance team tried a tool that reads invoices. An AI policy is how you turn that into something you can stand behind: which AI you use, what may go into it, who checks the output, and who to ask.
This article explains what a good AI policy covers, what to leave out, and how to introduce it so people follow it. At the bottom you can download our two-page template, in English and in Dutch, and fill it in.
Why a company needs one
No law asks for a document with that name. Three things make it worth having anyway:
- The EU AI Act's AI literacy duty. Every company that uses AI must take measures so its people understand the AI they use, and be able to show what it did. A policy plus a short introduction is the core of that. We cover the duty in detail in AI literacy under the EU AI Act.
- Personal data and confidentiality. Under the GDPR you need to know where personal data goes. The biggest practical risk is not the AI itself; it is a colleague pasting a customer file into a free tool.
- Clarity for your people. Most employees want to use AI well and are unsure what is allowed. A policy removes the guessing.
What a good AI policy covers
Ten short sections are enough. Each answers one question a colleague could ask:
- Why this policy exists and who it applies to. Including freelancers, temporary staff and suppliers who use AI on your behalf.
- Who is responsible. One owner for the policy, one owner per tool, one address for questions.
- Which AI tools may be used. Named, with what each is for. Personal and free accounts are not for work.
- What never goes into an AI tool. Personal data (unless the tool is approved for it), confidential information, passwords.
- A person checks the output. Whoever uses AI output is responsible for it. No decisions about people without approval.
- Being open about AI. Customers know when they talk to an AI; realistic AI images and video are labelled when published.
- How a new tool gets added. Ask first, record it in the register before use.
- How people learn to use it. An introduction in the first week, an explanation of each tool for the people who use it daily.
- What to do when something goes wrong. Report it straight away; reporting is always right.
- When the policy is reviewed. At least twice a year.
What to leave out
- The technology. Model names, how neural networks work, a history of AI. None of it helps someone decide whether they may paste a contract into a chat window.
- Rules nobody can follow. "AI may only be used for approved purposes after a risk assessment" sounds responsible and gets ignored. Name the tools and the purposes instead.
- The full list of tools, in the policy itself. Keep that in a separate register. Tools change every few months; the rules should not.
- Legal text copied from the AI Act. Refer to it, do not paste it. A policy is for the people doing the work.
The register next to the policy
The policy sets the rules; the register records the facts. One spreadsheet with a line per AI tool:
| Tool | Used for | Owner | Data that goes in | Where the data is stored | Who uses it | What they need to know | Introduction given |
|---|---|---|---|---|---|---|---|
| Microsoft 365 Copilot | E-mail, documents, meeting notes | Operations manager | Internal documents, e-mail | Microsoft 365 (EU Data Boundary) | Everyone | Check facts and figures; it sees everything you have access to | 14 Oct 2026 |
| AI invoice reading in the ERP | Purchase invoices | Finance lead | Supplier invoices | ERP vendor, EU | Accounts payable | Handwritten amounts go wrong; invoices over EUR 5,000 are checked | 16 Oct 2026 |
Together, the policy and the register are also most of your evidence for the AI Act's literacy duty.
How to introduce it so people follow it
A policy sent by e-mail is read by a few people and remembered by none. What works:
- Thirty minutes, in person or on a call, per team. Walk through the four rules that matter most: which tools, what never goes in, check the output, who to ask.
- Real examples from your own work. "Can I paste this supplier contract into Copilot to summarise it?" is a better conversation starter than any slide.
- An approved alternative before a ban. If people use free ChatGPT today, give them a business version on the day you ask them to stop.
- A named person to ask, who actually answers. The first weeks bring a lot of questions; that is a good sign.
- New starters get it in week one, as part of the normal introduction.
Common mistakes
- Banning everything. It moves AI use to personal phones, out of sight and out of your control.
- A twenty-page document. Nobody reads it, so it protects nobody.
- Copying a template without filling in your own tools. A policy that names no tools is a statement of intent, not a policy.
- No owner. Without one person keeping the register up to date, the policy is out of date within a quarter.
- Forgetting the AI inside existing software. The AI feature in your CRM, ERP or HR system counts. It belongs in the register.
Download the template
Our template covers the ten sections above in two pages, with everything you need to fill in marked in square brackets. Delete what does not apply to you, add your tools, and keep it short.
It is a starting point, not legal advice. If you use AI to make decisions about people, such as in hiring or credit, the AI Act asks more than a policy can cover: read our overview of the EU AI Act for companies that use AI, and have the specific use checked.
