AI policy template for European businesses
Everything we have learnt about rolling out AI safely at work, from a free AI policy template to hands-on guides for Claude, ChatGPT and Copilot.
Documents
Pick a document to open it
AI policy (template)
Rules for safe and lawful AI use in your organisation, written for the GDPR and the EU AI Act
Purpose
Make sure the business uses AI tools in a way that protects personal data, trade secrets and the brand, and that meets the law that applies to us, starting with the GDPR and the EU AI Act.
Where AI pays off
What should we use AI for?
- Repetitive writing: emails, reports and summaries
- Brainstorming ideas for projects and problems
- Code review and suggested fixes
- Data analysis and spotting patterns
- Translation and proofreading
Finding the gains
- List the tasks you do several times a week
- Start small, test AI on one minor task first
- Time the task before and after, so the saving is a number
- Share what worked with the team
1. Scope
This policy applies to every employee, contractor and partner who uses AI tools in our work.
2. Definitions
| Term | Meaning |
|---|---|
| AI tool | Software or a service that generates, analyses or processes data using artificial intelligence or machine learning. |
| Personal data | Any information relating to an identified or identifiable living person, as defined in Article 4(1) of the GDPR. |
| Sensitive information | Personal data, trade secrets, internal strategy, customer and supplier lists, source code and any other non-public information. |
3. Five principles
Data protection
Never enter national ID numbers, customer lists, secret code or other sensitive information into an AI tool.
Purpose
Use AI only for work tasks that support business goals.
Quality
AI output can contain errors, and you are responsible for checking facts before anything leaves your desk.
Accountability
You are as responsible for AI-generated content as if you had written it yourself.
Ethics
No offensive, discriminatory or unlawful content is tolerated.
4. Practical examples
| Risky | Safe |
|---|---|
| "Analyse our customers' buying behaviour from the attached list" | "Analyse buying behaviour for an online shop with 1,000+ customers" |
| "Write an email to Lukas in HR about his performance" | "Write a professional email with constructive feedback to an employee" |
| "Sophie Laurent, customer no. 48213, born 01/12/1980, has a problem with her order" | "A customer has a problem with their order" |
| Using a private AI account for work data | Using AI services approved by the business, with proper licences |
5. Rules for AI tools
- Use only AI services approved by IT and the data protection lead.
- Check the data sharing and training settings, and switch off training on your data wherever you can.
- Read the terms of use before you start using a tool.
- Report any new AI tool to IT for review and approval before you use it.
6. When something goes wrong
- 1Stop straight away: stop using the AI tool.
- 2Document: take a screenshot of what was shared.
- 3Report: tell IT and the data protection lead within 2 hours.
- 4Decide: if personal data was exposed, the data protection lead decides whether to notify the supervisory authority, which Article 33 of the GDPR requires within 72 hours of becoming aware of a breach.
- 5Learn: add to the incident report so the same thing does not happen twice.
7. Quick check before you press send
- 1Sensitive information in the prompt: No → continue.
- 2Personal data in the prompt: No → continue.
- 3Approved AI tool: Yes → send.
8. Approved AI tools and status (example)
| Status | Tool | Comment |
|---|---|---|
| Claude Team or Enterprise | Business account, Anthropic does not train models on customer content under its commercial terms | |
| ChatGPT Business or Enterprise | Business workspace, no training on business data by default | |
| Microsoft 365 Copilot | Needs a licence and the company tenant | |
| Google Gemini | Needs IT approval first | |
| Free AI accounts | Not allowed for work data |
9. Requesting a licence
Getting a licence, step by step
- 1Ask IT support through the usual channel (email or helpdesk)
- 2Fill in the licence request with your reason and use case
- 3Wait for approval from IT and the data protection lead
- 4Get access to the approved AI tool on a business licence
Example reason for IT:
"I need Claude Team to draft our weekly reports and customer updates. That saves me about 5 hours a week and cuts copy-paste errors. I will use it for [specific purpose], and I understand that only non-sensitive information may be used under our AI policy."
What goes in the request
- Which AI tool you want to use
- A concrete use case and what the business gets out of it
- Estimated time saved per week
- Confirmation that you follow this AI policy
10. AI transcription
- We only use AI transcription tools that the business has approved for meetings and calls.
- If an external participant brings their own AI note taker, the meeting organiser must approve it first.
- Everyone in the meeting is told before it starts that AI transcription is running.
- Sensitive meetings are not transcribed with AI tools.
11. Compliance and review
- Under Article 4 of the EU AI Act, which has applied since 2 February 2025, we take measures so that everyone who uses AI at work has enough AI literacy for the tools they use, and we log who has been trained.
- AI-generated images, audio or video that could pass as real (deepfakes) are labelled as AI-generated, as Article 50 of the EU AI Act requires from 2 August 2026.
- The policy is reviewed once a year, or sooner when the law or the technology changes.
- Breaking the policy can lead to disciplinary action under the relevant employment or contractor agreement.
Your next step
Copy the template, swap the tool list in section 8 for the tools you actually pay for, and send it to your team this week.
We use analytics cookies to see which pages people read, and marketing cookies stay off unless you tick them under Details.