AI policy template for companies: free download
An AI policy sets out which AI tools employees may use and for what. You can copy the template below without signing up, or download it as a Word file.
Does a company need an AI policy?
An AI policy is not mandatory, but it helps with three obligations that do apply: AI literacy measures under Art. 4, the disclosure of deepfakes and certain AI-generated texts under Art. 50(4), and data protection under the GDPR as soon as personal data ends up in AI tools. What Art. 4 requires is explained on the page AI literacy obligation under Art. 4.
What belongs in an AI policy?
The template has ten sections and an annex with the list of approved tools. The text is the same as in the Word file:
AI policy of [company]
1. Purpose and scope
This policy governs the use of AI systems at [company]. It applies to all employees as well as to freelancers and service providers who use AI systems on our behalf. The aim is a safe, lawful and traceable use of AI.
2. Approved AI tools
Only the AI tools listed in Annex 1 are used for work. Employees request new tools from [responsible person]. Private AI accounts are not used for work tasks.
3. Prohibited uses
Not permitted are AI applications that are prohibited under Art. 5 EU AI Act, for example inferring emotions in the workplace or manipulative techniques, as well as any use that violates laws or this policy.
4. Confidential and personal data
Personal data, trade secrets and confidential customer data are only entered into AI tools that are approved for this in Annex 1. The necessary contracts are in place for these tools, such as a data processing agreement under Art. 28 GDPR. In case of doubt, employees ask [data protection officer].
5. Copyright and third-party rights
Outputs of AI tools can infringe third-party rights. Text, images and code from AI tools are checked for this before they are published or passed on. Third-party content is only entered if we are allowed to use it for that purpose.
6. Human review
AI outputs can be wrong, outdated or biased. Anyone who uses an AI output checks it first and remains responsible for the result. Decisions about people are not made by an AI system alone.
7. Labelling
AI-generated or manipulated image, audio and video content that resembles real persons, places or events (deepfakes) is disclosed by us as artificially generated (Art. 50(4) EU AI Act). This also applies to AI-generated text that we publish to inform the public on matters of public interest, unless a human has reviewed it editorially and is editorially responsible for it. Chatbots that talk to customers identify themselves as AI.
8. Use in high-risk areas
Before AI is used in areas listed in Annex III EU AI Act, for example in recruitment, in evaluating employee performance or in assessing creditworthiness, [responsible person] is involved. From 2 December 2027, special obligations for deployers apply to such systems (Art. 26 EU AI Act).
9. AI literacy
All persons who use AI systems on our behalf take part in AI literacy measures before they start using the tools, and refresh them when new tools or roles come up (Art. 4 EU AI Act). [Responsible person] keeps a record of who took part in which measure and when.
10. Responsibilities, reporting and review
The contact person for this policy is [responsible person]. Employees report errors, data breaches or conspicuous AI results without delay to [reporting channel]. We review the policy at least once a year and when significant changes occur. Last updated: [date].
Annex 1: Approved AI tools: Tool · Purpose · Permitted data · Contract (e.g. DPA) · Responsible
How do you put the template to use?
- List which AI tools are already used in the company and enter the approved ones in Annex 1.
- Adapt the sections, especially responsibilities, reporting channel and permitted data.
- Agree the policy with data protection and, if there are any, employee representatives.
- Inform everyone involved and combine the policy with an EU AI Act training course so that the rules are also understood.
Whoever looks after the policy in the company does not have to be a specially appointed AI officer. More on the page AI officer: mandatory or voluntary?
Frequently asked questions about the AI policy
Is an AI policy mandatory?
No, the EU AI Act does not prescribe an AI policy. It is one of several possible measures to promote AI literacy under Art. 4, and it makes the rules on data protection and labelling clear to everyone.
May I use the template freely?
Yes. You may use the template free of charge and without signing up, adapt it and distribute it within your company. It does not replace legal advice; check the content for your specific use.
Who has to approve the AI policy?
That depends on the company. Where employee representatives exist, national law often gives them information or co-determination rights over technical systems that can monitor behaviour or performance, so involve them early. The policy is put into force by management.
Download template (Word) Download template (PDF) Train your team now
Note: this template is for general information only and does not constitute legal advice.