Blog
Writing an AI policy: create one that fits your company in five minutes
21 October 2026 By Tijn Meijerink
The short answer. An AI policy sets out which AI tools your people use, which data may and may not go into them, who checks what AI produces and who owns it all. No law requires a document with that name. It is, however, the fastest way to show that you do what the AI Act and the GDPR require: measures for AI literacy (since February 2025), transparency towards customers about AI (since August 2026) and the stricter rules for recruitment and credit assessment from 2 December 2027. With the generator below, you have a policy in five minutes that fits your tools, your data and your risks.
Written for organisations with 10 to 250 employees. Based on the AI Act as amended by the Digital Omnibus on AI of July 2026, and on the GDPR.
Live document
AI policy for [organisation name]
1Purpose and scope
- AI Act art. 4
This policy sets out how we use AI at [organisation name]: sensibly, safely and in a way we can explain to customers, employees and regulators.
It applies to everyone who works with AI on behalf of [organisation name]: employees, managers, interns, temporary workers and freelancers. It applies to all AI tools, including AI features built into existing software.
AI may make our work faster and better. Responsibility for what we do with the result always lies with a person.
2Definitions
- AI tool: software that produces text, images, sound, code or predictions, such as ChatGPT, Copilot or an AI feature in a CRM.
- Register: the list of AI tools and use cases approved at [organisation name], with an owner for each tool.
- Sensitive data: personal data, customer data, financial data, confidential business information and source code.
- Output: everything an AI tool produces, from a summary to a calculation or a piece of advice.
3First, take stock: which AI is already running
We do not yet know exactly which AI tools are being used for work. So within 30 days of the adoption of this policy, tell the AI owner which AI tools you use for your work, including free tools and personal accounts.
Reporting has no consequences, even if a tool does not comply with this policy. We will then find an approved alternative together. After this period, working with an unreported tool is a breach of this policy.
4Which AI tools you may use
- GDPR art. 28
You only use tools from the register, with an [organisation name] account. For each type of tool:
Free and personal AI toolsConditional
Only for public information and general questions. Never with names, customer data or internal documents, because free versions may use your input to train their models.
Business AI subscriptionsConditional
Allowed for internal work, including with sensitive data, provided four conditions are met: a business account from [organisation name], training on our data is switched off, there is a data processing agreement, and storage and processing take place in the EU wherever possible.
Microsoft 365 CopilotConditional
Allowed within our Microsoft 365 environment. Copilot finds everything you have access to. That is why the AI owner first checks the permissions on SharePoint, Teams and OneDrive, and you never share files more widely than necessary.
If you want to use a new tool with internal data, request it from the AI owner. You will get a decision within ten working days. Trying a tool out with public information does not need a request.
5Which data you may and may not put into AI
- GDPR art. 5
- GDPR art. 9
Before you put anything into an AI tool, look at the type of data. If in doubt, the strictest colour applies.
Red: never in an AI tool
- Passwords, API keys and other access credentials
- National identification numbers, such as the Dutch citizen service number (BSN), and copies of identity documents
- Information a customer has expressly asked us to keep confidential
Orange: only in business tools from the register
Use as little data as possible: leave out names and numbers if you do not need them.
- Personal data of customers, applicants and employees
- Contracts, files and other confidential business information
Green: allowed in all tools from the register
- Public information, such as our website and published material
- Your own texts and ideas without names or customer data
- General questions and knowledge
6Human review
AI makes mistakes that sound convincing. Check facts, figures, names, sources and calculations before you use output. The bigger the consequences, the more thorough the check.
You are responsible for what you do with AI output, just as with any other work. Output you send to customers or the outside world, you read yourself first. For automated applications, the owner records how the review is arranged.
7Being open about AI
- AI Act art. 50
If a customer talks to one of our AI systems, such as a chatbot or an automatically sent reply, we make that clear at the first contact. A customer can always ask for a person.
An employee checks answers about a customer’s contracts, prices, claims or rights before they are sent.
8Privacy and security
- GDPR art. 28
- GDPR art. 32
- Only [organisation name] business accounts, with two-factor authentication.
- We have a data processing agreement with every AI provider that processes personal data.
- Training on our data is switched off, and storage and processing take place in the EU wherever possible.
- An AI tool only gets access to the data it needs for its task.
- Anyone who leaves the organisation loses access to all AI tools immediately.
9Confidentiality and copyright
- Dutch Copyright Act
Confidentiality agreements with customers and partners also apply when you use AI. Check AI output you publish for recognisable work by others, such as texts, images or trademarks, and do not use it if you are in doubt.
10Rules for our sector
If we work with clients’ files or confidential information, the agreements with that client also apply to AI use. If in doubt, ask for permission before you put their data into an AI tool.
11AI literacy
- AI Act art. 4
Everyone who works with AI on behalf of [organisation name] completes basic training within 30 days of starting, or of the adoption of this policy: what AI can and cannot do, how to check output, which data may go where, and this policy.
Anyone who builds or manages AI systems, or uses them in decisions about people, receives in-depth training suited to that role. There is a short refresher every year.
We keep track of who has completed which training. That is how we show that we take measures for AI literacy, as Article 4 of the AI Act requires.
12Reporting incidents
- GDPR art. 33
Report to the AI owner within 24 hours: sensitive data in a tool that is not approved for it, incorrect AI output that reached a customer, or an AI outcome that disadvantages someone.
If there may be a data breach, the person responsible for privacy assesses whether we must report it to the competent data protection authority (in the Netherlands: the AP) within 72 hours. Reporting is never a reason for punishment. Keeping quiet is.
13Ownership, register and review
The AI owner owns this policy and keeps the AI register: for each tool and use case, what it does, who uses it, what data goes into it, who owns it and how high the risk is.
AI changes quickly. We review this policy every six months, and sooner if the law, our tools or our use cases change.
14Adoption
This policy has been adopted by the AI owner and applies from the date of signature. Questions about this policy go to the AI owner.
I have read this policy and will comply with it.
Name
Job title
Date
Signature
14 articles · 1,133 words · 8 legal references
This policy is a solid foundation, not legal advice. If you use AI for high-risk applications, have it reviewed before you adopt it.
Why you sort this out now, and not next year
In most companies, AI is not introduced, it creeps in. Someone in sales uses a free ChatGPT account for quotes, the accounts team has invoices summarised, and since Copilot arrived in Outlook, colleagues write their emails with AI. Nobody banned it, nobody arranged it. That is called shadow AI, and the biggest risk is not in the tools themselves but in what goes into them: customer data, contracts, salaries.
A policy does not solve that by banning things. It solves it by drawing a few clear lines and offering a good alternative. People will use AI anyway. The question is whether they do so with a business account, the right data and a colleague who checks where it matters.
What a good AI policy contains
The generator builds the policy from the same building blocks we use with clients. Every article has a reason:
- Scope. Who it applies to, including freelancers and interns. The AI Act explicitly refers to everyone who works with AI on your behalf.
- A register of tools. Which tools are allowed, under which conditions, and who owns each tool.
- A data traffic light. Red, orange and green: what never goes into AI, what may only go into business tools and what can go anywhere. This is the article employees get the most out of.
- Human review. Who checks what, and how thoroughly, depending on the consequences.
- Transparency. Customers know when they are talking to AI, and realistic AI images are recognisable as such.
- High-risk applications. Recruitment, staff assessment and credit assessment call for extra rules: under the GDPR already, under the AI Act from 2 December 2027.
- AI literacy. Basic training for everyone and in-depth training per role, with a record of who completed what.
- Incidents. What you report, to whom and within what time, without reporting being punished.
- Owner and review. Who maintains the policy and when you review it. AI changes faster than any other policy topic.
What the law requires, and what it does not
AI Act Article 4: AI literacy
Since 2 February 2025, you must take measures for the AI literacy of everyone who works with AI on your behalf. Through the Digital Omnibus, that was softened on 27 July 2026: you support the development of AI literacy, but you do not have to guarantee a specific level. There is no fine attached. What exactly changed is covered in our piece on Article 4.
AI Act Article 50: transparency
The transparency rules have applied since 2 August 2026. People must know that they are communicating with an AI system, and images, video or audio made with AI that look real must be recognisable as AI-generated. If you use a chatbot or automated replies, this belongs in your policy.
High risk: recruitment, staff and credit
AI in recruitment and selection, in decisions on promotion or dismissal, in assessing employees, in the creditworthiness of individuals and in premiums for life and health insurance is listed in Annex III of the AI Act. Deployers face extra obligations for this from 2 December 2027 (Article 26): using the system in line with the instructions, human oversight by competent people, keeping logs for at least six months and informing employees before you put such a system to use in the workplace. If you already work this way, you will not have to overhaul anything later.
GDPR: what has applied for years
If an AI provider processes personal data for you, you need a data processing agreement (Article 28). Where there is a high privacy risk, you carry out a DPIA beforehand (Article 35). A decision that is taken fully automatically and significantly affects people is only allowed on the basis of a contract, the law or explicit consent, and always with the right to human intervention (Article 22). And you report a data breach to the Dutch Data Protection Authority (AP) within 72 hours, unless it is unlikely to result in a risk (Article 33). More on AI and privacy in our piece on company data and the GDPR.
The works council
If you have a works council, it has a right of consent over arrangements on appointment, dismissal and promotion (Article 27(1), point e, of the Dutch Works Councils Act, the WOR), staff training (point f), appraisal systems (point g), processing staff data (point k) and systems that can monitor employees’ attendance, behaviour or performance (point l). If your AI policy touches on those subjects, submit it to the works council beforehand.
How to introduce the policy in four weeks
- Week 1: take stock. Ask everyone which AI tools they use, including free and personal ones. Without consequences, otherwise you will not hear about them.
- Week 2: choose. Decide which tools you provide for business use, sign data processing agreements and switch off training on your data. If you are considering ChatGPT for business or Copilot, you will find the differences there.
- Week 3: explain. Give short basic training of one to two hours that covers the policy itself, especially the data traffic light.
- Week 4: adopt. Have the policy signed, publish the register internally and put the first review in the diary.
Five mistakes that make an AI policy worthless
Banning everything. A ban without an alternative pushes AI use onto personal phones and free accounts. You no longer see it, but it still happens.
Rules without a register. A policy that says "only use approved tools" without a list of those tools is followed by nobody.
Not offering a business tool. If the only alternative to free ChatGPT is "nothing", people choose free ChatGPT.
Leaving it to IT alone. A policy about tools written without the people who use those tools misses the questions that matter in practice.
Never reviewing it. Tools, prices and legislation change quickly. A policy from 2024 misses tools that are now used every day.
Frequently asked questions
Is an AI policy mandatory?
No, a document with that name is not mandatory. What is mandatory are the measures for AI literacy, transparency about AI and careful handling of personal data. An AI policy is a practical way to arrange those in a way you can demonstrate.
May employees use free ChatGPT?
For public information and general questions, that is defensible. For customer data, contracts or other internal information, it is not: free versions may use your input to train their models and you have no data processing agreement with them. Offer a business version, and the reason to use the free one anyway disappears.
How often should you review an AI policy?
At least every year, and preferably every six months. Also review it sooner if you introduce a new tool, start using AI in decisions about people or if the law changes.
What is the difference between an AI policy and AI governance?
The AI policy is the document with the rules. AI governance is everything around it: who decides, the register, the checks, the training and the review. The policy is the visible part.
Is this policy enough if I use AI for recruitment or credit assessment?
It is a solid foundation, but high-risk applications need more: a DPIA, a description of the system, agreements with the provider and properly organised human oversight. In that case, have the policy reviewed before you adopt it.
