AI acceptable use policy template for EU companies

As of 13 November 2026. General information, not legal advice.

What should an AI acceptable use policy contain?

An AI policy needs seven parts: scope, approved tools, data classes, duties when using the tools, a way to report incidents, a process to approve new tools, and training with a regular review. More text rarely helps, because staff read two pages but not twelve.

The German data protection authorities (the DSK, their joint conference) state that without clear rules, staff use AI on their own initiative. They recommend documented instructions with examples of permitted and prohibited use.^[1] That is what the template below provides. It sits inside the wider rollout described in Use AI at work without leaking company or personal data, which gives the twelve everyday rules the policy turns into obligations.

The authorities also name points that belong in a policy: employers provide work devices and work accounts, staff do not have to use private accounts, and account names carry a functional address instead of an individual employee's name.^[1] Hamburg's data protection commissioner adds to its checklist: check the results, let humans decide, train staff, use the training opt-out and switch off chat history on shared accounts.^[2] The template builds all of these in.

How do you adapt the template?

1. Replace every placeholder. Anything in square brackets is a decision your organisation has to make: company name, tools, contact person, dates. Do not delete a bracket before you have made the decision behind it.
2. Fill the tool list honestly. List only tools whose plan and contract terms you have checked. An empty list is better than one that is wrong. ChatGPT, Copilot, Claude and Gemini compared and Is ChatGPT GDPR compliant? show what to look at for each plan.
3. Tailor the data classes to your sector. If you handle professional secrets (law, tax advice, medicine) or work under strict client confidentiality clauses, move more material into the prohibited class.
4. Involve your data protection officer and employee representatives. See the section below. Show them the draft before you circulate it.
5. Circulate, train and confirm. A policy nobody has been briefed on will not be read. Ask staff to confirm they have read it and schedule the briefing (see the AI literacy section below).

Which data may go into AI tools: allowed, pseudonymised or prohibited?

The data classes are the core of the policy, because the question at the moment of pasting is always: may I put this in? The table shows an example for an approved tool on a business plan. Adjust it to your own contracts.

Four notes on the table. First, pseudonymised data remains personal data where a person can be identified with additional information; what counts is the means reasonably likely to be used.^[10] Whoever holds the key keeps processing personal data. Second, the DSK writes that removing names and addresses is regularly not enough, because the context can still make a person identifiable.^[1] Dates, amounts and unusual job titles can be enough on their own. Third, special categories under Article 9(1) GDPR, such as health data, may in principle be processed only if an exception in Article 9(2) applies.^[8] The template therefore prohibits them as the default. Fourth, in Germany, anyone bound by professional secrecy can face criminal liability under section 203 of the Criminal Code for unauthorised disclosure of another person's secret; a GDPR assessment does not replace that second layer.^[9] If you work in another EU country, check the equivalent rules locally. The method for replacing identifying details is explained in Anonymise data before ChatGPT, and the legal difference in Pseudonymisation vs anonymisation.

The classes are strict because the rule has to apply before sending. Once an input has reached an external provider, you cannot see where it is processed and cannot recall it; deleting the chat or switching a setting off acts on the future. The control a company has with its own means is therefore what employees enter. See where your data goes when you use an AI assistant for the background.

The policy text (copy it)

The text below can be selected and copied. There is deliberately no download file: you see the full content and paste it into your own document. It is a starting point, not a legally reviewed text.

When do employee representatives have to be involved?

Where a works council exists, involve it before the rollout, because both the policy and the tools touch several of its rights. The DSK recommends considering a service or works agreement and notes that co-determination rights exist in some cases.^[1] This section describes Germany; other EU countries have their own rules on informing and consulting employees, so check locally.

Two provisions of the German Works Constitution Act (BetrVG) are relevant. Under section 87(1) no. 6, the works council has a right of co-determination when technical systems are introduced and used that are designed to monitor the behaviour or performance of employees.^[3] Whether a particular AI tool falls under it depends on what it logs and who can see the logs; that has to be assessed case by case. Under section 90(1) no. 3, the employer must inform the works council when planning work procedures and workflows, including the use of artificial intelligence.^[4]

Without a works council these provisions do not apply. Involving staff is still sensible, because rules only work if they fit daily work. How far you may go in checking use is covered in Shadow AI: detect, reduce and replace unsanctioned use.

How does the policy support the AI literacy duty in Article 4 of the AI Act?

The policy is one building block, not proof on its own. Article 4(1) of the AI Act, as amended by the Digital Omnibus on AI, says providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in.^[5] The duty has applied since 2 February 2025.^[6] Recital 8 of the amending regulation explains that the earlier wording, a duty to ensure a sufficient level of AI literacy, was considered unsuitable as a strict obligation.^[5]

As a practical suggestion, not a legal requirement: the policy records the rules, the training in section 6 teaches them, and the attendance list shows that you took measures. The softer wording does not make the duty optional, so keep records of what you did. For a wider look at what else the AI Act asks of companies that use AI tools, the glossary explains deployer, AI literacy and high-risk systems in a few lines each.

Next step

Copy the template into your own document and start with the tool list and the data classes, because that is where the policy either works in daily life or does not. Have your data protection officer and, if there is one, the works council read the draft before you circulate it. If your staff need to work with texts that contain personal data, pseudonymising before sending can make the class B rule practical; Ainym, for example, is a browser extension in closed beta with pilot teams that detects personal data on the user's own device, lets the user confirm every match before anything is sent, and replaces details with realistic pseudonyms.

This article is general information and not legal advice. It does not replace an assessment of your own case by your data protection officer or a lawyer. Last updated: 13 November 2026.