This article is for managing directors and team leads whose employees use ChatGPT, Copilot or similar tools. It shows what belongs in an AI policy, when to involve the works council and how to introduce the rules in your team. The full template is further down in the text and available as a Word file to edit.
An AI policy is the written answer to the questions every team asks as soon as the first colleagues start working with AI: Can I enter this here? With which account? Does someone still need to read this? Without an answer, everyone decides for themselves, and that is exactly the risk.
Is an AI policy mandatory?
No. No law requires companies to have an AI policy. Three sets of rules still make it worth writing down the key points:
- Article 4 of the EU AI Act: Since the AI Omnibus, anyone who uses AI must take measures that support the AI literacy of their staff. Written rules are one such measure, and they make it traceable what you have done. More in the guide AI literacy under Article 4
- Data protection: Personal data may only go into tools whose provider has a data processing agreement with you under Article 28 GDPR. Your team needs to know this.
- Trade secrets: Under the German Trade Secrets Act, information is only protected if its owner takes appropriate confidentiality measures. Clear rules on what does not belong in AI tools can contribute to this.
What belongs in an AI policy
A good policy is short enough to be read. It answers five questions:
- Which tools are approved, and with which account?
- Which data may go in, and which never?
- Who checks results before they leave the organisation?
- When do we disclose that AI was involved?
- Who is the contact person for questions, new tools and mishaps?
Three points are often missing: who the policy applies to, how the team learns and from when the rules apply. The template covers all eight points, plus a ninth section with the date and signature.
Article 50 of the EU AI Act has applied since 2 August 2026: Deceptively realistic images, videos or audio recordings generated with AI must be labelled. The same applies to texts that inform the public on matters of public interest, unless a person has reviewed them and holds editorial responsibility. Section 5 of the template covers this.
The template
This is what the template looks like. Replace the parts in square brackets and delete anything that does not fit your organisation.
AI policy for [company]
Rules for working with AI tools such as ChatGPT, Copilot or Gemini. Updated: [date]
1. Who this policy applies to
This policy applies to everyone who works with AI tools on behalf of [company]: employees, trainees, interns and freelancers. It applies to all work content, on company and personal devices.
We want our team to use AI where it makes work easier. These rules make sure that no confidential data leaves the company and that every result is checked.
2. Which tools are approved
| Tool | Account | Used for |
|---|---|---|
| [e.g. ChatGPT Team] | Company account | [Drafting, summarising, translating texts] |
| [e.g. Microsoft Copilot] | Company account | [Emails, documents and meetings in Microsoft 365] |
| [other tool] | [account] | [task] |
For work content, we use only these tools with the company account. Private accounts are not permitted for this. A new tool is used only once [role] has approved it.
3. Which data may go into a prompt
- No concerns: Content without any reference to people and without internal information, such as an outline, a general text or a translation.
- Only with placeholders: We replace names, contact details and other personal details with [name], [customer] or [amount]. If that is not possible, only in an approved tool with a data processing agreement and only as much as necessary.
- Only after approval by [role]: Quotes, calculations, contracts and internal figures.
- Never: Health information, personnel files, bank details, passwords and login details, and [other confidential content, such as client or patient data].
4. Who checks and who is responsible
AI writes convincingly even when something is wrong. A person therefore checks every result that goes to customers, partners or the public for accuracy, sources and tone. Whoever sends it is responsible for it.
Decisions about people, such as on applications or performance, are always made by a person.
5. When we disclose AI
We label images, videos and audio recordings that were generated or altered with AI and appear authentic. [Further rule, for example: We also label texts we publish that have not been checked by a person.]
6. What we may upload
We upload third-party texts, images and documents only if we are allowed to use them for this. Contracts with customers may require confidentiality. If in doubt, we ask [role].
7. How we learn
Everyone who works with AI takes part in [training or briefing]. New colleagues do so within their first [four weeks]. [Role] records who took part and when.
8. Who to contact
Questions about this policy and requests for new tools go to [name, contact]. If confidential data has accidentally been entered into a tool, report it immediately to [name or data protection officer].
9. When it applies
This policy applies from [date]. We review it every year and whenever we introduce a new tool. [The works council was informed on [date].]
At a glance
- We use only [tool] with the company account.
- We replace names and contact details with placeholders.
- Health information, personnel files, bank details and passwords never go in.
- A person checks everything before it leaves the company.
- Questions and mishaps go to [name].
How to introduce the policy
- Ask who uses what. Ask your team which tools are already in use, including privately. This gives you the list for section 2.
- Approve tools. Check the data processing agreement for each tool and set up company accounts. Which tool suits which task is compared in ChatGPT, Copilot or your own AI?.
- Adapt the template. Fill in the placeholders. For most companies, an hour is enough.
- Involve the works council. If you have one, inform it in good time. If a tool is capable of monitoring behaviour or performance, it also has a right of co-determination.
- Present it to the team. Explain the rules in a short meeting and put up the short version. Record who took part.
- Review it every year. New tools and features arrive quickly. Set a fixed date to go through the policy.
Template as a Word file and PDF
The template to edit, with a short version for the workplace. You get it as a Word file and as a PDF when you subscribe to the lindenbrook newsletter with new articles and worksheets. The newsletter is in German.
Frequently asked questions
Is an AI policy mandatory?
No, no law requires it. Written rules are, however, one of the measures you can use to support AI literacy under Article 4 of the EU AI Act, and they make it traceable what you have done.
How long should an AI policy be?
Short enough to be read. Two pages are enough for most companies, plus a five-sentence short version for the workplace.
Does the works council have to agree?
If you have a works council, you must inform it in good time about the planned use of AI. If a tool is capable of monitoring behaviour or performance, it also has a right of co-determination. Involve it early.
Do small companies need an AI policy too?
That is where it helps most, because there is rarely a separate IT or data protection department. One page with tools, data rules and a contact person is often enough.
Is a policy enough for Article 4?
It is one building block. Article 4 requires measures that suit your team's tasks and prior knowledge, such as training or a briefing. The policy sets out who takes part.
How often should we update the policy?
At least once a year, and whenever you introduce a new tool or the legal situation changes.
Sources
- EU AI Act, Regulation (EU) 2024/1689, Articles 4 and 50, consolidated version of 27 July 2026, EUR-Lex
- Regulation (EU) 2026/1744 (AI Omnibus), EUR-Lex
- GDPR, Article 28, EUR-Lex
- § 2 GeschGehG, German Trade Secrets Act (in German)
- § 87 BetrVG, German Works Constitution Act (in German)
- § 90 BetrVG, German Works Constitution Act (in German)
Updated: . This article is not legal advice.
