AI policy for business: your template in three steps.
Staff use AI, with or without rules. With this tool you create an AI policy in three steps: which tools are allowed, which data may go in, how results are checked and how you support AI literacy under Art. 4 of the EU AI Act.
Not legal advice · as of 13 October 2026
Your AI policy, ready to edit.
Fill in the three steps above. Your AI policy then appears here, with your inputs and [placeholders] for everything you still need to add.
Email me the result
Optional: we send you the result. Otherwise your answers only stay in your browser.
Why does every company need an AI policy?
Many employees already use AI tools, often with private accounts and without knowing which data they may enter. An AI policy creates clarity: it sets which tools are approved, which data is off-limits and who stays responsible.
It is also a building block for the EU AI Act: under Art. 4, companies that use AI should take measures to support their staff’s AI literacy. A policy with training is the obvious first step.
Without a policy, every person decides for themselves which data goes into which tool. That is the biggest risk for data protection and trade secrets, and a few clear rules avoid it.
What belongs in an AI policy.
Approved tools
Which AI tools are allowed and who approves new ones.
Data rules
Which types of data may go into AI tools, from public to confidential.
Reviewing results
A person reviews before AI results are used.
Labelling
Label AI content and chatbots under Art. 50 of the AI Act.
AI literacy
Training at rollout and regularly after (Art. 4).
Co-determination
Involve the works council, no monitoring of individuals.
From the template to a valid policy.
Create the draft
With this tool in a few minutes, with placeholders for open points.
Agree it
With data protection, IT security and, if there is one, the works council.
Communicate it
Publish, explain and document that staff have read it.
Train and review
Run the training and review the policy at least once a year.
An approved AI that fits your policy.
The best policy helps little if there is no good approved tool. RAGSuite gives your team an AI assistant for your own documents, in the RAGSuite Engine or on your server, with an AI notice, a source on every answer, roles and deletion periods.
Questions about the AI policy.
Is an AI policy mandatory?
No law requires a document with this name. But the EU AI Act requires measures to support AI literacy under Art. 4, and the GDPR requires clear rules for personal data. An AI policy with training is the simplest way to meet both in a way you can prove.
What belongs in an AI policy?
At minimum: approved tools, rules for data types, human review of results, labelling of AI content, AI literacy training, data protection and co-determination, a reporting route for errors and a contact person. This tool’s template contains all these points and adapts them to your inputs.
Must the works council agree?
If AI tools are suitable for monitoring staff performance or behaviour, the works council has a right of co-determination under section 87 of the Works Constitution Act. That applies to many tools. So agree the policy early; it often becomes part of a works agreement.
May staff use private AI accounts?
You decide that in the policy. Many companies ban private accounts for work, because there is no contract with the provider and inputs may be used for training. Others allow them for public information only. The tool offers both options.
Can I adapt the policy?
Yes. The result is a draft with your inputs and marked placeholders. Copy the text into your template, adjust the wording and add company-specific rules. Have data protection and, if applicable, the works council review the draft before it takes effect.
The policy is ready, now the right tool.
Give your team an approved AI assistant for your own documents. Free for 7 days in the RAGSuite Engine.