Writing an AI policy: what belongs in it and how to make it stick

Why you need an AI policy now

Staff use AI whether the organisation arranges it or not. Data protection authorities receive a growing number of breach reports caused by personal data ending up in chatbots. See Shadow AI. On top of that, the AI Act asks you to support your staff’s AI literacy, and that starts with clear rules. A complete one-page example is in AI policy: a one-page template.

An AI policy is not a list of bans. It is the agreement on how your organisation uses AI responsibly: what is allowed, what is not, and why. It protects the organisation, but also the employee who wants to know where the line is.

What belongs in an AI policy? Ten parts

1. Purpose and scope. Who does it apply to (contractors and interns too?) and which AI (chatbots, AI in existing software, self-built automations)?
2. Approved tools. A list of approved AI environments and what they are for. Anything not on the list is not allowed for work.
3. Data classes. Which data may go into which tool? For example: public information anywhere; internal information only in the approved environment; personal data, client files and trade secrets only in an environment that does not leave the organisation.
4. Prohibited use. For example: no decisions about people that rest on AI output alone, no emotion recognition, no uploads to personal accounts.
5. Human review. Who checks AI output before it goes to a client, court or patient? AI drafts; a person is accountable.
6. Transparency. When do you state that something was made with AI, and when is a customer talking to a chatbot?
7. AI literacy. Which training do staff get, and how do you keep it up to date?
8. Incidents. What does someone do who accidentally put sensitive data into a tool? Report it, without blame: then you can assess within 72 hours whether it is a notifiable breach.
9. Roles. Who maintains the list of tools, who assesses new tools, who is the point of contact?
10. Review. AI changes fast. Plan a fixed review, for example every six months.

How to draw up the policy

• Start from use, not from rules. Ask teams what they use or want to use AI for. The policy must make those tasks possible, or it will be worked around.
• Involve the DPO and the works council early. The DPO assesses the processing; in many countries the works council has a say when usage data is recorded that could be used to monitor behaviour or performance. See May you read your employees’ AI prompts?
• Keep it short. Two pages that get read are worth more than twenty that disappear into a folder. Put details in annexes per department.
• Make it concrete. “No confidential data” is vague. “No client names, ID numbers, file numbers or contract text in ChatGPT” is clear. Why that rule is needed is set out in ChatGPT and the GDPR in your organisation.

A policy alone is not enough: make it possible

The most common problem with AI policies: they ban something without an alternative. If an employee may not put client data into ChatGPT but has no other way to summarise a client file, workload beats policy.

A policy works when technology supports it:

• an approved AI environment that can handle the most requested tasks, including with sensitive data;
• safeguards that stop patterns such as ID numbers and IBANs, so a mistake is not immediately a breach;
• blocks on public AI services, introduced once the alternative is in place;
• logging, so you can show the policy works.

With werqly, that approved environment runs on a node of your own in your server room. In werqly AI Control your IT department sets per role which models and sources are available and which data is blocked. The policy on paper and the settings in the environment then say the same thing. More on choosing such an environment in What is private AI?