Writing an AI policy: how to do it

Because your people are already using AI, with or without a policy. Without agreements, customer data ends up in free tools, AI-written texts go out unchecked and nobody knows which tools are actually in use. On top of that, the AI Act asks you to work on the AI literacy of your people.

The risk isn't theoretical. In 2024, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) received several reports of data breaches because employees had entered personal data into an AI chatbot. At a GP practice it involved patients' medical data, at a telecom company customers' addresses (AP, August 2024). According to the AP, dozens of these reports came in during 2024 and 2025, more in 2025 than the year before (AP, December 2025).

This is called shadow AI: AI use the organization has no visibility of. It usually starts the same way. There's no business tool, or it's too complicated, so people reach for their personal account. A ban doesn't solve that. A good alternative and clear agreements do.

An AI policy helps on five fronts:

• Privacy. The GDPR also applies when someone puts personal data into an AI tool.
• Quality. AI can make convincing mistakes. Agreements on checks keep them from reaching a customer.
• Legislation. The AI Act asks for AI literacy and, for some applications, more. Read what the AI Act means for your business.
• Costs. Without agreements, every department soon has its own subscription.
• Speed. People who know what's allowed get on with it instead of hesitating.

A good AI policy answers at least these questions: which tools are allowed, what data can go into them, where a human checks, who is responsible, which AI applications are running, who has had which training and what you do when something goes wrong.

In our AI Quick Scan we record the AI policy before we talk about solutions. That prevents a promising opportunity from failing later because of a rule nobody had mentioned. We ask six questions, and they make a solid backbone for any policy:

1. 01Can company data go to an external AI service? Yes, only anonymized, or no.
2. 02Can personal data go into prompts? Yes, only with a data processing agreement, or no.
3. 03Does the service have to run in the EU? Required, preferred or not important.
4. 04Is a data processing agreement required for each tool? Where personal data is involved, the answer under the GDPR is practically always yes.
5. 05Does a human have to check AI output? Always, only where there's a risk, or no.
6. 06May the vendor use your data for training? Allowed or prohibited.

Around those, a few more parts belong in the policy:

• Approved tools. A short list, with the type of account for each tool (business) and what it's meant for.
• Roles and responsibilities. Who owns the policy, who approves new tools, who you report an incident to.
• An AI register. An overview of the AI applications that are running: what they do, with which data, who owns them.
• Training and AI literacy. Who gets which training, and how you record it.
• Transparency. When you tell customers or candidates that AI is involved.
• Incidents. What you do if something does go wrong, such as a data breach or a mistake that reaches a customer.
• Review. When you look at it again.

Copy this structure and fill it in for your organization. For each section you'll find what belongs in it, with an example sentence. Keep the whole thing to a few pages and put the details in appendices.

1. Purpose and scope

Why this policy exists and who it applies to. Don't forget contractors, interns and freelancers.

This policy applies to everyone who works on our behalf and uses AI tools in doing so, including temporary staff and freelancers.

2. Principles

Three to five principles that everything else comes back to. For example: AI supports, people decide. We're open about our use of AI. Privacy comes before convenience.

AI may make our work faster and better. Responsibility for the result always stays with an employee.

3. Approved tools

Which AI tools are allowed, and with which account. Put the list in an appendix, so you can update it without rewriting the whole policy.

For work, you only use the AI tools listed in Appendix A, with your business account. You request a new tool from the owner of this policy.

4. What data can go where

The core of the policy. Sort your information into three levels: green (public), amber (internal) and red (personal data, confidential information, passwords). See the table below this article.

Never put personal data, customer files or passwords into an AI tool, unless Appendix A lists that tool as suitable for that data.

5. Human review

Where does a human need to check AI output before it's used? At the very least for everything that leaves the organization or affects a decision about a person.

Check texts, calculations and advice made with AI before they go to a customer, candidate or supplier.

6. Roles and responsibilities

Who owns the policy, who assesses new tools, who keeps the AI register up to date and who people can go to with questions.

7. The AI register

A list of the AI applications running in the organization, from the chat tool to an agent that books invoices. For each application: purpose, data, vendor, owner and risk.

8. Training and AI literacy

Who gets which training, and how you keep track of it. More on that in the next part of this article.

Everyone who works with AI completes basic training within three months of starting. We keep a record of who has completed which training.

9. Transparency and incidents

When do you say that AI was used, and what do you do when something goes wrong? Link it to your existing data breach procedure.

If you've accidentally put data into an AI tool that doesn't belong there, report it straight away to the privacy officer. Reporting is good, keeping quiet isn't.

10. Review

When do you look at it again? Our advice: every six months, and also whenever there's a major change in tools or legislation.

A policy only works if people understand it. AI literacy means that everyone who works with AI knows enough to use it responsibly: what it can do, where it goes wrong and what the agreements are. Since 2 February 2025, Article 4 of the AI Act has asked for this too.

The AI Act asks organizations that use AI to work on the AI literacy of their staff, and of others who work with AI on their behalf. Since an amendment in July 2026 (Regulation (EU) 2026/1744), the text says that you take measures that support AI literacy. A certificate isn't mandatory, the European Commission writes in its questions and answers on AI literacy (2025). It is smart, though, to record who had which training.

The law doesn't prescribe a fixed format. Tailor it to the role:

• Everyone: what AI is, what it isn't, why it sometimes tells convincing nonsense and what the house rules are.
• Employees who work with it every day: good prompting on their own tasks, checking output, and knowing which data can go where.
• Team leaders and management: where AI adds value, what the risks are and how to organize it.
• People who build: connecting systems safely, testing, logging and when a human has to approve.

The policy and the training reinforce each other. The policy says what the agreements are, the training shows how to work with them. An AI workshop of half a day on your team's own work costs € 4,500 with us, excluding VAT. What the law asks per role is explained on AI literacy.

Start by looking at what's already being used, classify your data, choose your tools, write a short draft with a small group, explain it to everyone and schedule a review. Expect a few days of work, spread over a month.

1. 01Take stock. Ask anonymously who uses which AI tools, and what for. You'll probably get a shock, and that's a good thing: now you know where you stand.
2. 02Classify your data. Green, amber, red. What's public, what's internal, and what must never go into an AI tool.
3. 03Choose your tools. At least one business AI tool with a data processing agreement, so people have a good alternative to their personal account. Not sure which one? Read ChatGPT, Copilot or Claude.
4. 04Write a draft with a small group. IT, HR, the privacy officer or a lawyer, and above all someone from the shop floor who uses AI every day. That last person stops you writing rules that don't work in practice.
5. 05Explain it and train people. Emailing round a PDF isn't a rollout. A short slot in the team meeting, a training session and a fixed point of contact are.
6. 06Review every six months. New tools, new applications, new rules. Update the register and the list of tools.

A small business? Then it may fit on two pages, and the managing director can write it in an afternoon with this structure alongside. That's fine. Better a short policy that people live by than a long one that sits in a drawer.

The most common mistake is a ban without an alternative. After that come: too long and too legal, written by IT alone, no owner and never updated. Each of these leads to the same result: people ignore the policy.

• A ban without an alternative. 'AI is not allowed' means in practice that AI gets used in secret, with personal accounts. Provide a business tool and clear rules.
• Too long and too legal. Nobody reads forty pages full of references to articles of law. Write in plain language, with examples.
• Written by IT alone. Then it's technically correct, but doesn't fit how people work. Involve the people who do the work.
• No owner. Who decides whether that new tool is allowed? If nobody does, everybody decides for themselves.
• Never updated. A policy from 2024 names tools that no longer exist and misses the tools everyone uses now.
• Forgetting freelancers and temporary staff. They also work with AI on your behalf.
• No examples. 'Use AI responsibly' says nothing. 'Summarizing a customer email is fine, with the name taken out' does.

In the AI Quick Scan we record your AI policy as part of the day, and we score governance as one of the seven dimensions of the baseline. In a workshop we bring your team up to the same level. And within the AI Partnership we keep the policy, the register and the training up to date.

• AI Quick Scan: one day on site, € 6,000. We start with management: the ambition, the boundaries and the AI policy. Then a baseline on seven dimensions, including governance, and a business case per opportunity.
• AI workshop: half a day hands-on with your team's own work, € 4,500. A strong measure for AI literacy.
• AI Partnership: a dedicated team that builds, trains and keeps the whole thing up to date, from € 4,500 per month.

All prices exclude VAT. Want to give your team something to practise with straight away? Our freebies page has free prompts, Claude material and n8n workflows, to use within the agreements you have just made.

This article is an explanation, not legal advice. Have your policy checked by your privacy officer or a lawyer, especially if you work with special categories of personal data.