AI usage policy for employees: what to include and how to roll it out

Why a policy (and why now)

An AI usage policy is like the rules for corporate email: it does not stop people working, it stops an everyday gesture from becoming a problem. The real risk is rarely the AI itself; it is someone pasting client data, contracts or code into a public tool without knowing what happens to it. To see how much unapproved AI is already in your company, read our guide on shadow AI.

The AI Act also asks organizations that use AI systems to adopt staff AI-literacy measures (Art. 4, as worded after the Digital Omnibus), and the GDPR requires you to know which personal data is shared with providers. The policy is the document that brings both together.

What it should include: ten sections

1. Purpose and scope: who it applies to (staff, contractors) and what it covers (generative AI, assistants built into software, translation or transcription tools…).
2. Approved tools: a short list of authorized tools, with the enterprise version where one exists, and what happens with unlisted ones (request authorization rather than silent bans).
3. Data classification: which categories may go into which tool (for example: public yes; internal only in approved tools; confidential and personal data no, unless expressly authorized). It builds on your data classification.
4. Personal data: a simple rule of “no personal data unless the tool is approved and under a processor contract”, and whom to ask when in doubt.
5. Human review: any AI output used in a document, decision or external communication is reviewed and signed off by a person who answers for the result.
6. Prohibited or pre-authorised uses: decisions about people (hiring, evaluation, dismissal), content that could mislead, and any use that may be high-risk under the AI Act.
7. Transparency: when to disclose that content or an interaction was AI-generated (for example the Article 50 duties if your case fits).
8. Intellectual property and confidentiality: do not input third-party material you have no right to use, and check each tool’s terms on data use.
9. Training and support: who teaches, how often and whom to ask.
10. Incidents and consequences: how to report a mistake without fear of reprisal the first time, and what happens in case of repeated breaches.

Rolling it out in four steps

1. Map real use: ask teams which tools they use and for what. A ten-minute anonymous survey is enough to begin.
2. Write a short policy: two pages people will read. If nobody understands it, nobody follows it.
3. Train and communicate: a 45-minute session with “do” and “don’t” examples from their daily work, and one fixed place to find the policy.
4. Measure and adjust: review queries, incidents and new tools every quarter and update the list.

Employment and privacy aspects

If the policy comes with controls (for example logging tool use or blocking), check with your employment adviser what information or consultation with employee representatives applies, and how it fits with workers’ right to privacy when using digital devices at work. And if any use involves processing employee data with AI, that is one more processing activity that belongs in your GDPR records of processing.

Common mistakes

• Banning everything: use moves to personal phones and becomes invisible.
• Unreadable legal text that nobody opens.
• No named owner for maintaining the tool list.
• No training: a policy without training is paper.

Frequently asked questions

Is an AI usage policy mandatory?

No general rule requires a document with that name, but it helps show AI-literacy measures and control over personal data.

What data should never be entered?

At a minimum, personal data without a provider contract, trade secrets, credentials and confidential client information.

How often should it be reviewed?

At least yearly and whenever an approved tool or the rules change.

Informational and indicative content; it is not legal advice. Review your case with a qualified professional.