AI policy for companies: a free template

An AI policy defines which AI tools your employees may use, which data they may enter and who checks the results before they are used. The following template contains twelve sections to adapt to your company. It is also available as a Word file.

The template is a starting point, not legal advice. Have the final version reviewed by your data protection officer and agree it with the works council, if you have one.

Why a policy achieves more than a ban

When companies ban AI, employees often use it anyway, with private accounts and without control over the data. An approved tool and clear rules make use possible within the company. The policy is also a building block for the AI literacy measures required by Art. 4 of the AI Act. How to document the related training is described in the article AI training record.

What to clarify before writing

Which tools are already in use today? Ask openly, without consequences for employees.
Which tools does the company provide? There should be at least one, with a data processing agreement and a clarified data location.
Which data needs particular protection? This includes personnel data, customer data, trade secrets and data subject to professional secrecy.
Who is the point of contact? Name a person or function who answers questions and vets new tools.

The template

Replace the details in square brackets.

1. Purpose and scope

This policy governs the use of AI tools at [Company]. It applies to all employees, apprentices and external people who work for [Company]. AI tools within the meaning of this policy are programs that use AI to generate text, images, code, audio or analyses, such as chat assistants, AI-powered translation services or AI features in existing software.

2. Approved tools

Only the following tools may be used for work, with the company account:

Tool	Approved for	Permitted data classes
[e.g. Microsoft 365 Copilot]	[all employees]	[public, internal]
[e.g. DeepL Pro]	[all employees]	[public, internal, confidential]
[own AI solution]	[sales back office]	[as per operating documentation]

Private accounts and tools that have not been approved must not be used for business content.

3. Data classes

Public: information that has already been published.
Internal: information for official use without personal data.
Confidential: customer data, personnel data, contracts, prices, trade secrets.
Strictly confidential: health data, data subject to professional secrecy.

Strictly confidential data is not entered into any of the tools unless a tool has been explicitly approved for it.

4. Duty to review

AI results can be wrong, even when they sound convincing. Anyone who uses a result checks it beforehand for factual accuracy, completeness and tone. Responsibility for the result remains with the person who uses it.

5. Decisions about people

AI tools do not make decisions about employees, applicants or customers, for example on hiring, performance, credit or dismissal. They may only prepare such decisions if the procedure has been approved in advance.

6. Labelling

Content that reaches people outside the company and was largely generated by AI is labelled if it could be taken as genuine, such as images, audio or video of real people. Chatbots that customers talk to state that an AI is responding. [Add your company's exact rule here.]

7. Copyright and trademarks

Third-party text, images or code are not copied into AI tools if the rights of use are unclear. Before publication, it is checked whether AI results recognisably reproduce third-party works or trademarks.

8. Security

Login credentials, passwords and keys are never entered into AI tools. Extensions, plug-ins and connections to other systems are only set up after approval by [IT].

9. New tools

Anyone who wants to use a new AI tool reports it to [contact person]. The provider, data location, data processing agreement, costs and purpose are reviewed. Until it is approved, the tool is not used for business content.

10. Training

All employees who use AI tools take part in an introduction before they receive a tool. [Contact person] documents attendance. There is a refresher whenever new tools are introduced.

11. Questions and errors

Questions are answered by [contact person, email]. Anyone who notices that data has accidentally entered a tool that has not been approved reports this immediately to [data protection, email]. Reporting early has no disadvantages.

12. Validity and review

This policy applies from [date]. It is reviewed at least once a year and whenever a new tool is introduced. Version [1.0], responsible: [name, function].

Common mistakes

Only bans, no tool. Use then stays hidden.
No data classes. Everyone interprets "no sensitive data" differently.
Too long. Keep the policy readable at two to four pages and move details into appendices.
No review date. Tools change faster than policies.

Works council and works agreement

If the company provides AI tools that are objectively capable of monitoring behaviour or performance, the works council (Betriebsrat) has a right of co-determination under § 87(1) no. 6 BetrVG (Works Constitution Act). This applies to many tools that log usage data. For this reason, the policy and a works agreement (Betriebsvereinbarung) are often negotiated together. Bitkom's February 2026 guide "KI und Mitbestimmung" (AI and co-determination) describes which points such an agreement should cover.

If you would like support with the policy, tool selection or training, get in touch via the contact form.

Frequently asked questions

Does every company need an AI policy?

It is not required by law. As soon as employees use AI tools, however, it is the simplest way to regulate data protection, trade secrets and liability. It is also a good building block for the AI literacy measures under Art. 4 of the AI Act.

What belongs in an AI policy?

At a minimum: which tools are permitted, which data must not be entered into AI tools, that results are checked before use, when AI content is labelled, who the point of contact is and how new tools are approved.

Does the works council have to approve an AI policy?

The policy itself mainly regulates behaviour. Co-determination under § 87(1) no. 6 BetrVG (Works Constitution Act) applies to the introduction of technical systems that are objectively capable of monitoring behaviour or performance. This applies to many AI tools that the company provides. So involve the works council early and ideally agree tools and policy together.

May ChatGPT be used with customer data?

Not with private accounts. With a business version only if a data processing agreement is in place, the data location is clarified and the purpose permits the processing. The policy should define this for each tool.