AI policy

AI policy for companies: a template you can adopt

An AI policy answers three questions: which tools are permitted, which data may go into them, and who checks the results? Without one, every employee decides for themselves – usually with a private account. Below you will find a template that you can adopt and adapt to your company. Agree it with your data protection officer and, if you have one, your works council.

Free of chargeReady to adaptAs of October 2026

Template: AI policy of [Company]

Replace the placeholders in square brackets. Shorter is better – a policy that nobody reads protects nobody.

1. Purpose. This policy governs the use of tools based on artificial intelligence (AI) at [Company]. It is intended to enable their use while protecting trade secrets, personal data and the quality of our work.
2. Permitted tools. Only the approved AI tools may be used for work: [e.g. novendix.AI via chat.novendix.ai]. Private accounts and free AI services must not be used for work-related content.
3. Data that does not belong in AI tools. The following must not be entered: login credentials and passwords; special categories of personal data (health, religion, trade union membership, sex life); [others, e.g. design data of certain customers]. Personal data only insofar as it is necessary for the task and only in approved tools.
4. Duty to check. AI results can be wrong, even when they sound convincing. Whoever uses a result is responsible for its accuracy. Figures, references, quotations and legal statements are checked before being passed on.
5. No automated decisions about people. AI may prepare decisions about applicants, employees or customers, but may not make them.
6. Labelling. Content that is published externally and was substantially generated by AI is labelled where required by law or specified internally: [insert rule].
7. Training. Everyone who uses AI tools takes part in an induction (EU AI Act Art. 4). Attendance is documented.
8. Contact person. Questions and incidents (e.g. confidential data entered by mistake) to: [name, email]. Incidents are handled without assigning blame.
9. Validity. This policy applies from [date] and is reviewed at least once a year.

What matters in an AI policy

Permit rather than prohibit

A ban without an alternative drives usage into private accounts. An approved tool plus clear rules is more effective. See Shadow AI.

Short and concrete

One page with examples achieves more than ten pages of legalese.

Respect co-determination

If AI tools are introduced that can record employee behaviour, a works council has co-determination rights.

What the policy does not replace

A data processing agreement with the provider. The policy governs conduct within the company, the agreement governs the provider. The checklist is on GDPR-compliant AI.
Training. Rules only work if people understand them – see AI training for employees.
Legal advice. The template is a starting point, not a vetted template for your individual case.

Frequently asked questions about AI policies

Do companies need an AI policy?

There is no legal obligation to have exactly this document. Without rules, however, neither data protection nor the training obligation under the EU AI Act can be properly met. A short policy is the simplest way to get there.

Can I use this AI policy template?

Yes, free of charge and without attribution. Adapt it to your company and agree it with your data protection officer and works council.

Does the works council have to approve an AI policy?

If AI tools are introduced that are suitable for monitoring performance or behaviour, there is usually a right of co-determination. Involve the works council early.

Which AI tool should we approve for employees?

One with a data processing agreement, a named processing location and a training exclusion. novendix.AI meets these with hosting in Germany – and can be tested free for ten days.