AI policy: a one-page example you can use today

Why one page

A policy nobody reads protects nobody. The Dutch data protection authority published guidance and a practical tool for organisations using generative AI, and the core is always the same: know which data goes in, to whom, and be able to show it. That calls for rules a staff member understands in two minutes. See Writing an AI policy for the approach; this article gives the text.

The example

Replace [organisation], [own AI environment] and [reporting point] with your own names.

1. Purpose and scope. This policy applies to everyone working for [organisation], including contractors and interns, and to every use of AI tools for work, on any device.
2. Permitted tools. For work involving data of clients, customers, employees or confidential documents you use only [own AI environment]. Public AI services are permitted only for public material, such as a press release or a published report.
3. What never goes into a public AI service. Names and contact details of people, files, contracts, financial data, source code, passwords, internal decisions and anything under a duty of confidentiality.
4. Checking output. AI output is a draft. Whoever uses it checks the content and the sources and remains responsible for what goes out.
5. Decisions about people. AI takes no decision about a person: not on hiring, appraisal, granting or refusing. AI may prepare; a person decides and gives reasons.
6. Transparency. Where a customer or client talks to AI or receives an AI text that was not reviewed, we say so.
7. Access and accounts. You use your own work account. No private accounts for work, no shared accounts, no access to sources you do not need for your role.
8. Reporting. A wrong answer that had consequences, data in the wrong tool or a suspicion of manipulation is reported immediately to [reporting point]. Reporting never has adverse consequences for the reporter.
9. Training. Everyone follows a short briefing on joining and with every new application. Attendance is recorded.
10. Ownership and review. [Role] owns this policy and the AI register. The policy is reviewed annually and with every new application. Date of last version: [date].

How to adapt it

• Professional secrecy. Lawyers, notaries, accountants and healthcare professionals add their statutory duty to article 3 and refer to the rules of their professional body.
• Public sector. Add the algorithm register and freedom-of-information law: draft versions can be requested, and applications that affect residents go into the register.
• Works council. An AI environment that records use per employee may require consent. Submit the policy.
• Register. Article 10 refers to a register of applications. See Setting up an AI register.

Common mistakes

• Banning without an alternative. Then use moves to the private phone. See Is ChatGPT GDPR-compliant? for why a public tool is the problem, and provide an environment of your own first.
• Ten pages. The longer the policy, the less it is read. Put the details in an annex for IT and the data protection officer.
• No owner. A policy without a name under it is out of date within a year.
• No reporting. Without a safe reporting point you hear of an error only when a customer calls.

How werqly fits in

Article 2 of the example only works if there is an environment of your own at least as good as the public tools. werqly supplies it: a dedicated node with open-weight models, your own documents as sources, roles per team and an audit log that makes articles 7 and 8 demonstrable.