Writing an AI policy: structure, template and pitfalls

Your people use AI, whether or not anything has been agreed. Usually with a personal account and no idea what can and cannot go in. An AI policy sets out which tools are allowed, which data may go into them and who is responsible for what. The difference between a policy that works and one that disappears into a folder is rarely legal quality. It is length and how concrete it is.

This article is general information, not legal advice. Have a policy that touches on employee participation or special categories of personal data checked by a lawyer.

Is an AI policy mandatory?

No. The EU AI Act does not require a policy document. But you do have obligations that are hard to demonstrate without written agreements. Article 4 asks you to take measures to support AI literacy among your people. Article 50 covers transparency, for example that people know they are talking to an AI system; those rules have applied since 2 August 2026. And the GDPR applies as soon as personal data goes into an AI tool. The policy is where you record and date those agreements. More on Article 4 in the AI literacy requirement.

Why you want one anyway

To steer use that already exists. A ban does not work: people simply do it where you cannot see. A short list of what is allowed, with a good alternative, does.

To answer questions. Customers and contracting authorities ask about AI governance in supplier questionnaires. A dated policy turns that into a five-minute answer.

To prevent mistakes you cannot undo. A customer contract pasted into a free chatbot, or a figure from AI output that ends up unchecked in a quote.

The ten sections of a workable AI policy

1. Purpose and scope

Why the document exists and who it applies to. Explicitly include contractors, temps and suppliers working on your behalf. Otherwise that group drops out of sight.

2. Definitions

Three to five, in plain language. What is an AI system, what is generative AI, what do you call confidential.

3. Roles

Who owns the policy, who assesses new tools, who receives incident reports, who arranges training. Put names next to them. "IT" is not a name.

4. Approved tools

A short, current list. For example: the business version of ChatGPT, Microsoft Copilot and the AI features in your own CRM. Not allowed: personal accounts and tools without a data processing agreement. Nobody maintains a list of thirty tools.

5. Which data may go in?

The most important section, and the one most often left vague. Use four categories and give examples.

• Public, such as website copy and published brochures: allowed in approved tools.
• Internal, such as process descriptions, internal notes and draft quotes without customer names: allowed in approved business accounts.
• Confidential, such as customer contracts, pricing agreements, personnel files, source code and financial figures: only with permission from the policy owner.
• Special, such as health data and other special categories of personal data under the GDPR: not allowed, unless there is a documented legal basis and assessment.

Add one rule of thumb everyone remembers: if you would not email it to an outside party without thinking, do not put it into an AI tool without checking.

6. Human oversight

AI produces drafts, summaries and analyses. A person checks and sends. Decisions about people, such as applicants, appraisals and complaints, are not taken automatically. Name the reviewer for each process, or everyone checks and so nobody does.

7. Checking output

Figures, legal articles, names, quotes and legal statements from AI output are checked before they go out. See preventing AI hallucinations.

8. Transparency towards customers

A chatbot identifies itself as AI. AI-generated images that look like real material are labelled. When AI helps write customer messages, a person remains responsible.

9. New tools and incidents

A short check for new tools: what problem does it solve, which data goes in, is there a data processing agreement, where is the data processed, is your input used for training, and what does it cost. And for incidents: who to report to, how quickly, and who assesses whether it is a data breach.

10. Review

Version number, adoption date, who adopted it and when it will be reviewed. At least once a year, and with every new tool or change in the law.

An outline to start from

Use this as a skeleton. Fill in the placeholders and delete what does not apply.

• Header: AI policy [company name], version 1.0, adopted on [date] by [name, role], next review [date].
• Purpose and scope: this policy applies to everyone working on behalf of [company name], whatever their type of contract.
• Roles: policy owner [name], incident contact [name], responsible for training [name].
• Approved tools: [tool 1], [tool 2], [tool 3]. Other tools only with approval from the policy owner. No personal accounts for work.
• Data: the four categories with examples, plus the rule of thumb.
• Oversight: AI delivers drafts, a person decides. Factual claims are checked before sending.
• Transparency: customers know when they are communicating with AI.
• New tools: request via the policy owner with purpose, data, supplier, data processing agreement, storage location and cost.
• Incidents: report immediately to [name] if confidential data has ended up in an unapproved tool or AI output has caused harm.

Alongside it, make one page with the five rules people need every day. That page is what they read. The policy is what you show when someone asks.

Five mistakes that make an AI policy unusable

Too long. Twenty pages nobody reads are worse than three everyone knows. You also need to be able to show the rules are known.

Only bans. "Generative AI is not permitted" leads to use on personal accounts, exactly the risk you wanted to cover.

Vague about data. "Handle confidential information with care" steers nothing. People need categories and examples.

No owner. Without a name, new tools go unchecked and incidents go unreported.

Never reviewed. A two-year-old policy lists tools nobody uses and misses the ones everyone does.

The role of the works council

In the Netherlands, an AI policy regularly touches on matters where the works council (ondernemingsraad) has a say. If AI is used to monitor attendance, behaviour or performance, a right of consent may apply (Article 27 of the Dutch Works Councils Act, WOR). Introducing a significant new technology may fall under the right to advise (Article 25 WOR). Have each situation checked.

In practice: involve the works council while drafting, not only at adoption. A council that is involved from the start usually speeds things up.

How the policy connects to the GDPR

The AI policy does not replace your privacy documentation, but there is a lot of overlap. The data categories link to your record of processing activities. The check for new tools is largely a check on the data processing agreement. Two points need specific attention with AI: where the data is processed, and whether the supplier trains on your input. Check this per subscription in the supplier's terms. Free and consumer versions are often set up differently from business subscriptions; that is the main reason to rule out personal accounts. See ChatGPT for business and AI Act and GDPR: what to arrange.

From paper to practice

• Link it to training. Cover the house rules in the AI literacy session you are organising anyway.
• Make the approved route the easiest one. If the business account is more cumbersome than a personal one, you lose.
• Handle the first report well. Whoever reports that a contract accidentally ended up in an AI tool should not regret it. Otherwise there will be no second report.
• Discuss two real cases every quarter. What went well, what went wrong. That is your input for the review.

Where to start

Writing the policy takes an afternoon. Taking stock of what is already running in your company is the real work. It is the same inventory you need to decide which processes suit AI. If you want to do it properly in one go, the AI Opportunity Audit maps where AI is already used and where it adds the most value. The policy, and the responsibility for it, remain yours.

Sources: AI Act, Regulation (EU) 2024/1689, Regulation (EU) 2026/1744, Dutch Works Councils Act (WOR), in Dutch, Dutch Data Protection Authority on AI and algorithms, in Dutch. Status: October 2026.