AI policy template for employees: a free example to copy

Do companies need an AI policy?

Not as a standalone document. Rules do apply to every company that uses AI, and a policy is the usual way to set them down. GDPR requires you to be able to show how you protect personal data, with an appropriate data protection policy where that is proportionate (Articles 5(2) and 24). The Dutch data protection authority's checklist for generative AI (July 2026, in Dutch) lists internal policy among the measures it asks about.

What is the AI literacy requirement in the EU AI Act, and do staff need a certificate?

AI literacy is the knowledge and skill to use AI in an informed way and to understand its opportunities and risks. No certificate is required. Since 27 July 2026, Article 4 asks you to take measures that support the AI literacy of your staff. You match them to people's knowledge and experience and to the context they use AI in. The law states that you do not have to guarantee any specific level for any individual.

The original 2024 text asked companies to "take measures to ensure, to their best extent, a sufficient level of AI literacy". Much guidance online still describes that version, including some from national regulators. Check the date before you rely on it.

For a company of 10 to 200 people, reasonable measures are: a briefing on the policy when someone starts, examples of mistakes AI makes, extra guidance for anyone using AI in decisions about people, and a record of who completed what. That record shows later what you did.

How do you write an AI policy?

Work in this order.

• Ask which AI tools people already use, including personal accounts and AI features in existing software. Ask without blame, or you will not hear the answer.
• For each task, pick a tool with a business account and a data processing agreement. The section on approved tools compares four options.
• Decide what never goes in. Start with passwords, special category data and confidential client information.
• Set out how people check output and when they disclose AI use.
• Name an owner who answers questions, assesses new tools and reviews the policy every year.
• Test the draft with a few people who use AI daily. Rules that block the work get worked around.
• Share the policy with everyone and record who has read it. That already counts as a first AI literacy measure.

What should an AI policy for employees include? A template to copy

The template is written for a company of 10 to 200 people in the EU. Replace everything in [brackets] and delete what does not fit. This is not legal advice: have the policy checked if you process special category data or your sector has its own rules.

AI Policy, [Company name]
Version [1.0], approved on [date] by [name, role]
Next review: no later than [date]

1. Scope
1.1 This policy applies to everyone who works for [Company name]: employees, interns, agency staff and freelancers.
1.2 It covers AI tools that create or summarise text, images, audio or code, including AI features in your email, meeting or writing apps.

2. Approved tools
2.1 For work, use only these tools, with your work account:
- [Tool], for [tasks]. Personal data: [yes/no].
- [Tool], for [tasks]. Personal data: [yes/no].
2.2 For work, use only accounts and settings that [Company name] has approved. Never a personal account.
2.3 To use another tool or AI feature, ask [owner] first. We approve a tool only if:
- the vendor does not use our input to train models;
- we have a data processing agreement with the vendor where it processes personal data for us;
- [our data is stored in the EU, and any transfer outside the EU has a basis under the GDPR];
- [for a tool that can search our files: we control which files it can reach, for example through access rights we have checked].

3. What never goes into an AI tool
Not even into an approved tool:
- passwords, access codes and keys;
- [national ID numbers];
- [health data and other special category data (Article 9 GDPR)];
- complete customer, patient or staff files;
- information we hold under confidentiality for a client or partner, unless [owner] confirms in writing that our agreements and any professional secrecy duties allow this use;
- [add your own, for example unpublished financials, source code or quotes].

4. Personal data
4.1 Enter personal data only when your task needs it, and only in a tool marked "Personal data: yes" in section 2.
4.2 Remove names and identifying details when the task allows it.
4.3 Let AI record, transcribe or summarise a meeting only for a purpose [owner] has approved, and only with a tool from section 2. Before approving, [owner] records the purpose, the lawful basis and how long the output is needed. Tell participants beforehand that it will happen and why. Delete recordings, transcripts and summaries once they are no longer needed, and no later than [30 days], unless [owner] records why a longer period is necessary.

5. Checking output
5.1 AI can be confidently wrong. You are responsible for what you make with it.
5.2 Check facts, figures, names, quotes and sources before you use or send anything.
5.3 A person makes decisions about candidates, staff and customers. That person weighs the facts themselves and may overrule the AI output.
5.4 Do not use AI to screen candidates or evaluate performance without prior approval from [owner]. Never use AI to infer colleagues' emotions.

6. Being open about AI
6.1 If you share, show or publish images, audio or video made or altered with AI that look real, say that AI was used.
6.2 AI-generated or AI-edited text we publish to inform the public on matters of public interest carries an AI notice, unless a colleague has reviewed it and [Company name] takes editorial responsibility for it.
6.3 If a client asks whether you used AI, or the contract requires it, tell them honestly.

7. AI literacy
7.1 Everyone who uses AI completes [the internal briefing or training] within [one month] of starting, and a refresher every [year].
7.2 Anyone using AI in [HR or other decisions about people] gets extra guidance on the risks.
7.3 [Owner] keeps a record of who completed which training.

8. Reporting mistakes and incidents
8.1 Entered something you should not have, or did an AI error reach a client? Report it immediately to [name, email, phone].
8.2 Nobody is penalised for reporting their own mistake.
8.3 [Owner] follows [our data breach procedure]: limits the damage, records the incident and assesses whether it is a personal data breach. If we act as a processor for a client, we inform that client without undue delay, within [the deadline in our contract]. Where we act as a controller, we report a notifiable breach to [our data protection authority] without undue delay and, where feasible, within 72 hours of becoming aware of it, and inform the people affected where required.

9. Ownership and review
9.1 [Name, role] owns this policy, maintains the tool list in section 2 and answers questions.
9.2 We review this policy every [12] months, and sooner after a new tool, a change in the law or an incident.

How do you adapt the template to your company?

Sector rules come first. Health data falls under Article 9 GDPR and often under sector security standards. Lawyers, accountants and notaries have confidentiality duties, and some professional bodies publish their own AI guidance.

Check what your works council can decide before you log or monitor AI use. In the Netherlands, the employer needs the works council's consent (a works council is normally required from 50 staff) for rules on staff personal data and on monitoring behaviour or performance (Article 27 WOR). Many EU countries have similar rules.

If AI will process personal data, first check whether the task can be done without it. That is the first advice in the Dutch regulator's checklist, which then covers your record of processing, retention periods and a DPIA.

Which AI tools should you approve for employees?

Make the tool list in section 2 specific: name, account, tasks and whether personal data is allowed. A ban without an approved alternative pushes people to personal accounts. Check each candidate against clause 2.3. Four options, and when each fits:

• ChatGPT Business or Enterprise, for drafting and summarising. Neither plan trains on your data by default, and OpenAI signs a data processing agreement for both. What each plan does with your data.
• Microsoft 365 Copilot, when the work happens in Word, Outlook and Teams. Copilot does not train on your data and falls under Microsoft's data processing agreement. It reaches what each user can open, so check sharing permissions first. Copilot vs seef.
• Gemini in Google Workspace, when the work happens in Gmail and Docs. Google does not use your Workspace data to train models without your permission, and your prompts fall under its data processing addendum. Google's privacy page.
• seef, for questions about your own documents. You decide what goes into its knowledge base, and every answer shows its sources. Each company gets its own environment, hosted in the EU. People sign in with their work account (Microsoft 365 or Google Workspace). The data processing agreement records the models and processing location we agree. seef is a service of Timformatie, certified to ISO 27001:2022 and NEN 7510-1:2024 (security page).