AI Usage Policy: Template for Companies

An AI usage policy defines which AI tools are allowed in the company, for what purposes, with which data and under what controls. The BSI recommends informing employees which AI applications they may use for which purposes, what inputs they may make and how they may reuse outputs. These rules should be set down in binding form, for example in a policy, and supported technically, for example by blocking or enabling certain services (BSI, Generative AI Models, version 2.0, measure M16).

The RTR AI Service Desk advises reflecting the company’s approach in an internal AI policy: with clear roles, references to other policies, clearly communicated and easy for employees to find. To be able to demonstrate implementation of Art. 4 of the AI Act, it recommends recording the AI strategy, policy and training concept in writing and documenting training per person.

The AI Act does not require a written policy. For Art. 4, the European Commission requires neither a certificate nor an AI officer; companies can document training and other measures internally (AI Literacy Q&A). The policy is the tool you use to implement and demonstrate the obligations under the AI Act and the GDPR in everyday work.

The European Commission proposed the Digital Omnibus on AI on November 19, 2025. It was adopted as Regulation (EU) 2026/1744 of July 8, 2026, published in the Official Journal on July 24, 2026, and has been in force since July 27, 2026 (Art. 4: third day after publication).

For deployers of AI assistants, the key points are: Art. 4 no longer requires ensuring, to their best extent, a “sufficient level” of AI literacy, but rather measures that support its development (Art. 1(5) Regulation 2026/1744). Art. 5 gains two new prohibitions, and the high-risk obligations start later (Art. 1 nos. 7 and 40). Art. 26 and Art. 50(1) to (4) remained unchanged.

Do not confuse: in parallel, the Commission also proposed amendments to the GDPR (Digital Omnibus Regulation, COM(2025) 837). According to EUR-Lex, this procedure 2025/0360/COD has not yet been completed as of October 25, 2026. The GDPR in its previous version applies.

How to use the sample text: replace the placeholders in square brackets, fill in the annexes and coordinate the text with data protection, information security, HR and, if there is one, the works council. The RTR cites interdisciplinary monitoring by technology, legal, compliance, IT security, HR and the works council as good practice, depending on company size.

Why § 8 matters: under § 26b para. 1 no. 3 UWG (Austrian Unfair Competition Act), a trade secret is only protected if it is subject to reasonable confidentiality measures. Rules on which confidential information may go into which AI tools can be part of such measures.

Vendor information changes. Your contract and the current documentation are decisive; for other services, such as ChatGPT, their own terms apply. The BSI advises selecting tools according to defined criteria, such as features, training data, security safeguards, liability and operation (measure M1). Record in Annex 1 which account and which contract variant is approved.

• Inventory: record AI systems and AI features, including in standard software and after updates (RTR).
• Clarify the role per tool: deployer or, for example with your own chatbot, provider (Art. 3(3) and (4)).
• Review purposes: nothing under Art. 5; assess Annex III purposes such as applicant selection as high-risk.
• Select tools according to criteria: features, data use, security, terms (BSI M1).
• Clarify contracts: data processing (Art. 28 GDPR), training with inputs, storage location.
• Update the record of processing activities (Art. 30 GDPR), assess the need for a data protection impact assessment (Art. 35).
• Clean up permissions before an assistant accesses SharePoint, OneDrive or Teams.
• Block services that have not been approved technically, allow approved ones selectively (BSI M16).
• Adapt the sample text, coordinate it with data protection, IT security, HR and the works council, and approve it.
• Announce the policy and store it where everyone can find it easily (RTR).
• Plan, deliver and document training per person, including for new hires (Art. 4, RTR).
• Set up a reporting channel; define who assesses a notification under Art. 33 GDPR.
• Embed labeling under Art. 50(4) in the approval process for publications.
• Review the policy and Annex 1 regularly and whenever there is cause (RTR).

The sample text and checklist are TOMORIS recommendations. Legally required are the obligations of the AI Act and the GDPR mentioned above; neither law prescribes a specific form for the policy.

• Policy without a tool list: without Annex 1, it is unclear what is allowed.
• Overlooking AI features in existing software: updates to standard software often bring new AI components too (RTR).
• Permissions not cleaned up: Microsoft Copilot uses content a user is allowed to access, including files that are shared too broadly (Microsoft Learn).
• Accepting results without review: convincing outputs encourage automation bias (BSI R8).
• Adopting the legal status before the Digital Omnibus: since July 27, 2026, Art. 4 no longer requires a “sufficient level”; high-risk obligations under Annex III only apply from December 2, 2027.
• Forgetting data protection: if personal data reaches third parties without authorization, there may be a reportable breach (Art. 4(12) and Art. 33 GDPR).