Discuss your project

TOOLBOX · DOWNLOAD

AI usagepolicy as atemplate.

If you provide AI assistants to your employees, you are a deployer under the AI Act and must promote your staff’s AI literacy; since July 27, 2026, the version of Art. 4 as amended by the Digital Omnibus applies. This document summarizes the legal framework with references and provides sample text for an internal AI usage policy: scope, approved tools, data classes, review of results, labeling, training, reporting channels and responsible persons. A checklist helps with the rollout.

Download PDF (10 pages)What Is Inside

Free PDF · Template

AI Usage Policy: Template for Companies

Topic
AI in Business
Format
PDF, A4
Length
10 pages
Size
127 KB
Updated
Oct 25, 2026
Sources
10
Usage
Adaptation for your own use permitted; redistribute unchanged
Read as a Web Page

WHO IT IS FOR

Who This
Is for.

Sample text with placeholders, legal framework under the AI Act as amended by the Digital Omnibus and the GDPR, rollout checklist.

  • Management that wants to regulate and take responsibility for the use of AI assistants
  • Data protection officers and those responsible for data protection
  • IT managers who approve and secure tools such as Microsoft Copilot (formerly Microsoft 365 Copilot), ChatGPT or Claude
  • HR departments that organize training and review AI in HR processes

8 SECTIONS

What Is
Inside.

Every technical statement in the document names its source. The revision date appears on every page.
  • 01

    What the policy is for

    Clear rules on which AI tools are allowed, which data may be entered, who reviews results and who is responsible.

  • 02

    The legal framework in six terms

    Who is a deployer, what Art. 4, 5, 26 and 50 of the AI Act require and which GDPR principles apply.

  • 03

    Legal status as of October 25, 2026

    The Digital Omnibus on AI has been in force since July 27, 2026. What it changes for deployers and which deadlines now apply.

  • 04

    Sample text, part 1: scope, tools and data

    Sections 1 to 4 with Annexes 1 and 2. Replace everything in square brackets and delete what does not apply.

  • 05

    Sample text, part 2: results, training and responsibility

    Sections 5 to 11 with Annex 3: human review, labeling, third-party rights, training, reporting, roles, review.

  • 06

    Reviewing tools: what vendors commit to

    Two examples from vendor documentation, as of October 25, 2026. Review every tool yourself before it goes into Annex 1.

  • 07

    Checklist: rolling out the policy

    Fourteen steps from the initial inventory to regular review.

  • 08

    Common mistakes

    What makes a policy ineffective and how to avoid it.

EXCERPT

Sample text, part 1: scope, tools and data

How to use the sample text: replace the placeholders in square brackets, fill in the annexes and coordinate the text with data protection, information security, HR and, if there is one, the works council. The RTR cites interdisciplinary monitoring by technology, legal, compliance, IT security, HR and the works council as good practice, depending on company size.

AI usage policy of [Company], version [Version] of [MM/DD/YYYY]
§ 1 Purpose and scope
This policy governs the use of AI tools at [Company]. It applies to all employees and to persons who work with AI systems on our behalf, such as [service providers, temporary workers], and to all professional use, including on private devices. AI tools are applications that generate or analyze text, images, audio, video or code, including AI features in existing software.
§ 2 Approved tools
For work, use only the tools listed in Annex 1, with the account specified there and for the purposes specified there. Private accounts and consumer versions are not permitted for company data. Request new tools and new AI features from [Unit]; approval is granted after a review of data protection, contract and security. IT may block services that have not been approved.
§ 3 Data and inputs
What you may enter depends on the data classes in Annex 2. Enter only what is necessary for the task. Enter personal data, trade secrets and confidential customer data only into tools that Annex 1 expressly approves for this. Enter health data and other special categories under Art. 9 GDPR only if [Unit] has approved the specific purpose. Never enter credentials or passwords.
§ 4 Access and autonomous actions
AI assistants with access to emails, files or other systems can find anything you yourself are allowed to see. Report overly broad sharing permissions to [IT unit]. Use features that act autonomously, such as sending emails, changing data or placing orders, only if [Unit] has approved them and you confirm each action in advance.
Annex 1: Approved AI tools (to fill in, sample row in square brackets)
Tool and accountPermitted purposesHighest data classResponsible
[e.g. Microsoft Copilot Chat with work account][drafts, summaries, translations][internal][Name, role]
________________________________________
________________________________________
________________________________________
Annex 2: Data classes and what may go into which tool (adapt to your classification)
Data classExamplesPermitted in
Publicpublished texts, website, brochuresall tools in Annex 1
Internalprocesses, templates, drafts without reference to individuals or customerstools with a company account: [Tool]
Confidentialquotes, contracts, cost calculations, source code, trade secretsonly expressly approved tools: [Tool]
Personalnames, contact details, customer data, HR recordsonly tools with a data processing agreement (DPA): [Tool]
Special categories, credentialshealth data and other data under Art. 9 GDPR, passwords, keys[no tool] or only after individual approval by [Unit]; credentials never
Get the Full PDF

SOURCES

Supported
by Sources.

  1. Regulation (EU) 2024/1689 (AI Act), consolidated version of July 27, 2026, EUR-Lex (opens in a new tab)Art. 3(3) and (4); Art. 4, 5, 26, 50, 99, 111, 113; Annexes I and III; accessed October 25, 2026
  2. Regulation (EU) 2026/1744 (Digital Omnibus Regulation on AI), OJ L of July 24, 2026 (opens in a new tab)Art. 1(5), (7), (20), (39), (40) and Art. 4; accessed October 25, 2026
  3. EUR-Lex: procedure 2025/0360/COD, Digital Omnibus Regulation (COM(2025) 837) (opens in a new tab)Status “Ongoing,” accessed October 25, 2026
  4. Regulation (EU) 2016/679 (GDPR), EUR-Lex (opens in a new tab)Art. 4(12), Art. 5, 9, 28, 30, 33, 35
  5. European Commission: AI Literacy – Questions & Answers (opens in a new tab)As of October 20, 2026, accessed October 25, 2026
  6. RTR AI Service Desk: AI literacy (opens in a new tab)Sections on implementation, operational implementation, documentation; accessed October 25, 2026
  7. BSI: Generative AI Models – Opportunities and Risks for Industry and Authorities, version 2.0 (opens in a new tab)Version 2.0 of January 17, 2025; risks R3 to R6 and R8, measures M1, M16 to M18, M20
  8. Microsoft Learn: Data, privacy and security for Microsoft Copilot (opens in a new tab)Sections on organizational data, EU Data Boundary, protection; accessed October 25, 2026
  9. Anthropic Privacy Center: Is my data used for model training? (commercial products) (opens in a new tab)As of August 18, 2026, accessed October 25, 2026
  10. Bundesgesetz gegen den unlauteren Wettbewerb (UWG, Austrian Unfair Competition Act), § 26b, RIS (opens in a new tab)

This template provides an overview and does not replace legal advice. The text of the law in its current version is decisive, in particular the AI Act including Regulation (EU) 2026/1744 and the GDPR. Adapt the sample text to your company, your tools and contracts, and coordinate it internally, for example with data protection and the works council.

TOOLBOX

Explore
Further.

AI IN BUSINESS

More on
This Topic.

More free PDFs about AI in Business.
All AI in Business Downloads

YOUR NEXT STEP

From Paper
to Practice.

We review with you what is already implemented in your environment and put the rest into practice: as a project with EXPERTS or as ongoing operations with GRID.

Discuss ImplementationAll Downloads