HomeAI and data protectionAI policy
AI policy for companies Clear rules so that your team can use AI safely.
A good AI policy fits on a few pages and answers the questions that employees ask themselves every day: which tool may I use, which data may I enter, and who checks the result?
As of October 2026, checked against the text of the regulation. General information, not legal advice.
The ten contents of an AI policy
This outline serves as a template. The version for your company depends on sector, data and tools.
-
1. Purpose and scope
Who the policy applies to and for which activities, including freelancers.
-
2. Approved tools
A list of the permitted AI tools, company accounts only. Everything else is not approved.
-
3. Data by traffic light
Red: personnel, health and access data, confidential customer data. Amber: internal documents only in approved tools. Green: public information.
-
4. Checking results
AI results are checked before they are used. Responsibility stays with the person.
-
5. Disclosure
When the use of AI is made known to customers or in texts and images.
-
6. Copyright and secrets
No uploading of third-party protected content, no trade secrets in tools that are not approved.
-
7. Uses that are not permitted
For example decisions about people that an AI makes entirely on its own, such as in recruitment.
-
8. Responsibilities
Who answers questions, approves new tools and keeps the list up to date.
-
9. Training
Who is trained, how and how often.
-
10. Incidents and review
How errors or data entered by mistake are reported, and that the policy is reviewed regularly.
How the policy comes about
-
Step 1: Taking stock
We ask which tools your employees already use and for what. Usually there are more than management knows.
-
Step 2: Choosing tools
You decide which tools are approved under which contract. We recommend and set up.
-
Step 3: Drafting
We draft the policy briefly and in plain language. Your data protection officers and, if there is one, the works council are involved early.
-
Step 4: Introduce and explain
A policy only works once the team understands it. That is why we write it with examples from your own work.
Experience Why short policies work better.
-
They get read
Two to four pages get read. Twenty pages end up in the filing cabinet.
-
They answer real questions
Examples from your own daily work are easier to understand than general principles.
-
They leave room
Bans without an alternative mean that private accounts continue to be used. An approved tool is better.
-
They stay current
AI tools change quickly. A short policy is easy to revise.
General information, not legal advice. The legal review of your policy is carried out by your data protection officers or your legal advisers.
Frequently asked questions about the AI policy
Is an AI policy mandatory?
No law expressly prescribes one. But it helps to protect data and trade secrets, and shows that the company has regulated the use of AI.
How long should an AI policy be?
As short as possible. Two to four pages are usually enough, supplemented by a list of approved tools.
Is there a template for an AI policy?
The ten contents on this page are an outline you can use as a template. Chambers and associations also publish general templates. For your company, the template should be adapted to your tools and data.
Who has to approve the policy?
Management. The data protection officers and, if there is one, the works council should be involved.
Should your employees use AI under clear rules?
Tell us how AI is used in your company today. We will reply personally, free of charge and without obligation.
As of October 2026, checked against the text of the regulation. General information, not legal advice.