Compliance and security
Writing an AI policy: what goes in and how to start
David Homan · · 3 min read The short answer
An AI policy sets out which AI tools your staff may use, which data may go into them, who is responsible and how your people learned to work with them. The AI Act does not mention it by name. In practice you need one to show that you meet Article 4 and the transparency rules, and for most organisations it fits on two pages.
Why you need one
Your staff already use AI, with or without agreements. An AI policy makes that use visible and safe. It keeps customer data out of the wrong tool, it gives people clarity about what is allowed, and it is your evidence for customers, auditors and regulators.
The AI Act does not require a policy document by name. But Article 4 asks you to take measures for the AI literacy of your people, and the transparency rules ask you to show when something was made or answered by AI. Agreements on paper are the simplest way to demonstrate that. Read more in the AI Act.
What goes into an AI policy
Eight fixed sections. Together they fit on two pages.
| Section | What you record |
|---|---|
| Purpose and scope | Who it applies to and which kinds of AI it covers |
| Approved tools | Which tools are allowed, in which version (business or consumer), and how to request a new tool |
| Data classes | Which data may go in: public, internal, confidential, personal data |
| Human review | That a person checks every output before it goes out or leads to a decision |
| Transparency | When you tell customers they are dealing with AI |
| Training | Who gets which training and how you record it (Article 4) |
| Owner and reporting | Who manages the policy and where you report a mistake or incident |
| Review | When the policy is looked at again |
Step-by-step plan
- Take stock of current use. Ask teams which AI they use and for what. Done when: you have a list of tools, users and kinds of data.
- Classify your data. Decide which classes of data you have and which may go into which tool. Done when: every member of staff can say in one sentence what may and may not go into a prompt.
- Choose your tools. For each use, choose a tool with business terms, and a data processing agreement where personal data is involved. Done when: there is a short list of approved tools.
- Write the draft. Use the eight sections above. Done when: it fits on two pages.
- Test it with users. Have a few people who use AI every day read it. Done when: their questions are answered in the text.
- Train and record. Make sure everyone knows it and knows how to work with it. Done when: you can show who was taken through it, and when.
- Plan the review. Put a date in the calendar. Done when: there is an owner and a date.
What often goes wrong
- Too long. Nobody reads twenty pages of legal text.
- Only prohibitions. A policy that only forbids gets worked around. Also record what is allowed and which tool to use for it.
- Not tested. Without input from users it misses the situations that actually happen.
- No owner. Without an owner it is out of date within six months.
If you have AI built for you
Your own AI application calls for extra agreements: what the system logs, who oversees it, where it runs and how long data is kept. In a build that is part of the design, and the agreements go into your policy. Read more in human oversight and logging.
What AI Heroes does here
With the AI Act check we map which AI you use and which agreements you need. We base the template on this page on the AI policy we are writing for ourselves. For the assistant on this site, the agreements are public on the transparency page.
Frequently asked questions
Is an AI policy mandatory?
The AI Act does not prescribe a separate policy document. You do have to meet Article 4 (AI literacy) and the transparency rules, and the easiest way to show that is with agreements on paper. If you work with personal data, the GDPR also asks for measures you can demonstrate.
How long should it be?
For most organisations, two pages. Longer is rarely better: a policy nobody reads does not change how people work.
Who writes it and who owns it?
Someone with a mandate, usually from management, IT or compliance, together with a few people who use AI every day. Appoint one owner who keeps it up to date and answers questions.
May staff use ChatGPT with customer data?
Only if you have agreed on it: a business version with a data processing agreement, and clarity about which data may go in. A free consumer account combined with personal data puts you at risk under the GDPR. Read AI and the GDPR.
How often should you review it?
At least once a year, and every time a new tool is added or the rules change.
Is there a template?
It is on its way: a template in Word and PDF that you request on this page. Until then, we are happy to help you directly at info@aiheroes.io.
Want to know which agreements your organisation needs? The AI Act check shows which AI you use and what you need to arrange.
See the AI Act checkFurther reading
-
The AI Act: what does your organisation need to arrange?
Does the EU AI Act apply to your organisation, what applies now and what is still to come? The risk classes, the timeline after the Digital Omnibus and four steps to get compliant. Updated October 2026.
Read on -
AI literacy: what Article 4 asks of your organisation
What AI literacy under Article 4 of the EU AI Act means, who it applies to, what changed with the Digital Omnibus and how you show that you have it covered.
Read on -
AI and the GDPR: what to arrange before you use personal data
When the GDPR applies to AI, what you need to arrange (legal basis, data minimisation, data processing agreement, DPIA), where the data may be stored and how the GDPR and the AI Act work side by side.
Read on