Guide

AI policy for employees: a template to adapt

An AI policy sets out which tools employees may use and which data has no place there. Below is a complete template you adapt to your company.

Last updated: 28 October 2026

In short

What belongs in an AI policy for employees? At a minimum: who it applies to, which AI tools are approved, which data must not be entered, that every result is checked by a person, when AI content is labelled, how to deal with copyright, which training is mandatory, who the contact person is and what happens in case of violations. The template below contains all of these points and is also available as a file to download.

Why an AI policy?

Without rules, employees use what they know privately — with private accounts and without a contract with the provider. Customer data and internal documents end up with third parties without anyone knowing.

A policy makes clear what is allowed. It supports accountability under the GDPR, is one of the reasonable confidentiality measures without which information is not protected under the German Trade Secrets Act, and is a building block of AI literacy under Art. 4 AI Act.

→ Guide: the AI literacy obligation under Art. 4 AI Act

How to adapt the template

Replace all placeholders in square brackets, such as [Company] and [Contact person]
Keep the list of approved tools as an annex so it can change without a new policy
Coordinate with your data protection officer, IT and — if there is one — the works council; the policy often becomes part of a works agreement
Announce it and document acknowledgement
Review it at least once a year and when new tools arrive

→ Guide: introducing GDPR-compliant AI step by step

The template

Template without warranty — adapt it to your company and have it legally reviewed before use.

Policy on the use of AI tools at [Company]

1. Scope

This policy applies to all employees, trainees and interns of [Company] and to external persons working on its behalf (together “staff”). It governs the use of AI tools, in particular generative AI such as chat assistants and text, image and code generators, for business purposes — regardless of whether business or private devices are used.

2. Approved tools

Only AI tools approved by [approving body, e.g. IT and data protection] may be used for business purposes. The current list is in Annex 1 or at [location, e.g. intranet]. Use is only via business accounts. Private accounts and non-approved tools are not permitted for business content. New tools can be submitted to [Contact person] for review.

3. Prohibited inputs

The following must not be entered into AI tools that are not expressly approved for it:

personal data of third parties, such as customers, colleagues, applicants or patients
special categories of personal data such as health data
trade secrets and documents classified as confidential or internal
content that must be kept confidential towards third parties, for example under a non-disclosure agreement
credentials, passwords and keys

If in doubt: do not enter it and ask [Contact person] first.

4. Review obligation and human oversight

AI results can be wrong, incomplete or outdated. Staff check every result for accuracy and appropriateness before using or passing it on. Responsibility for the result remains with the person who uses it. Decisions about people, such as on applications or performance reviews, are not made solely on the basis of AI results.

5. Labelling AI-generated content

Content substantially generated by AI that goes outside the company is labelled when [criteria, e.g. publications without editorial review, images, audio and video that appear real]. Statutory labelling obligations, in particular under Art. 50 of the AI Act, remain unaffected. Internally, documents note when substantial parts are AI-generated.

6. Copyright and third-party rights

Protected works of third parties are only entered if [Company] holds the necessary rights. Before publication, results are checked for whether they reproduce protected texts, images, trademarks or logos of third parties. Purely AI-generated content is usually not protected by copyright under German law.

7. Training

Before first use, staff attend the training [name, format]; a refresher takes place [annually] and when new tools are introduced. Attendance is documented (Art. 4 AI Act).

8. Contacts

Questions about tools and approvals: [name, contact]
Data protection: [data protection officer, contact]
Incidents, such as confidential data entered by mistake: immediately to [contact]

9. Violations

Violations of this policy may have employment law consequences. Accidental mistakes must be reported immediately; timely reporting is taken into account in the assessment.

10. Entry into force and review

This policy enters into force on [date]. It is reviewed at least [annually]; changes are announced to staff.

[Place, date] — [signature management] — [signature works council, if applicable]

Downloads

No sign-up and no email address: as a PDF to print and tick off, as Markdown to keep editing in any editor, in Word or in your wiki. The documents are in German.

Template: AI policy for employees

Ten sections from scope to entry into force, with placeholders such as [Company] to adapt.

Checklist: GDPR-compliant AI rollout

Every step from purpose and legal basis to rollout to tick off — from DPA and DPIA to the works council.

Frequently asked questions

Is an AI policy mandatory for companies?

No law expressly requires an AI policy. In practice, you can hardly do without one: Art. 4 AI Act requires AI literacy, the GDPR requires accountability for processing, and trade secrets are only protected if reasonable confidentiality measures are taken. A policy covers all three.

Does the works council have to approve an AI policy?

Often yes. Rules on conduct in the company (Section 87(1) No. 1 BetrVG) and the introduction of technical equipment suitable for monitoring (Section 87(1) No. 6 BetrVG) are subject to co-determination. Many companies therefore regulate AI use in a works agreement.

May employees use ChatGPT with a private account for work?

Only if the policy allows it — for business content it is not advisable. With a private account there is no data processing agreement between company and provider, and entered data may be used for training depending on the settings.

How often should an AI policy be updated?

At least once a year, and also with new tools, new use cases and changes in the law. That is why the list of approved tools belongs in an annex that can change without a new policy.

What to do if confidential data was entered into an AI tool by mistake?

Report it immediately to the designated contact. They check whether personal data is affected and whether notification to the supervisory authority within 72 hours is required (Art. 33 GDPR), and arrange deletion at the provider where possible.

Not legal advice: this guide gives a general overview as of the date stated and does not replace a review of your individual case by your data protection officer or a lawyer.

Introduce AI without handing over your data

Vryne answers questions from your own documents, backs every statement with its source and runs application, data and language models in Germany. Getting started is free.