AI Policy for Companies: What Needs to Be Included

Is an AI policy mandatory?

No, in our assessment neither the GDPR nor the EU AI Act explicitly requires you to write an AI policy. An AI policy is an internal set of rules that defines which AI tools are permitted, which data may be entered, how AI output is reviewed and who is responsible. It does help with obligations that do exist: Art. 4 AI Act requires measures to support AI literacy, and Art. 32 GDPR requires appropriate technical and organisational measures. Status: 2 November 2026.

Without rules, employees can use any AI tool, and confidential customer, applicant or internal data ends up in unvetted systems. The policy is an organisational means of reducing this risk. More on technical and organisational measures.

What does Art. 4 AI Act really require?

Art. 4 AI Act obliges providers and deployers of AI systems to take measures to support the development of AI literacy. You do not have to guarantee a specific level of literacy. The rule has applied since 2 February 2025. Your policy can define how employees are trained in the use of AI, see AI literacy and our compliance trainings.

What needs to be included in an AI policy?

Build the policy in modules. These building blocks usually belong in it:

Which AI tools may employees use?

• Whitelisting: A clear list of approved AI applications (e.g. ChatGPT Enterprise, Microsoft Copilot with an active business license).
• Shadow IT ban: Personal accounts or unvetted tools are off-limits for business purposes.
• Approval process: A defined process for how employees submit new tools for review.

Which data may be entered into AI tools?

Define which data categories may be entered and which are off-limits (e.g. health data, source code for core products, passwords, sensitive customer files). Require data to be anonymised or pseudonymised before entry (pseudonymisation: Art. 4(5) GDPR) if the context needs to be preserved. For personal data, the following applies:

1. Clarify the legal basis: You need a legal basis under Art. 6 GDPR – for example a contract, legitimate interest or consent. For special categories such as health data, the rules of Art. 9 GDPR also apply.
2. Sign a DPA: If an AI tool processes personal data on your behalf, a DPA under Art. 28 GDPR is required. Your policy should state: No personal data may flow into the tool without a valid DPA.
3. Secure third-country transfers: Many AI services are based in the US. The EU-US Data Privacy Framework (DPF) can be the basis for transfers to certified providers; alternatively, standard contractual clauses (SCC) with additional measures come into consideration. The General Court dismissed the action against the DPF on 3 September 2025; the appeal of 31 October 2025 is pending before the Court of Justice (according to WilmerHale, as of 1 December 2025). Keep SCCs ready as an alternative. More on plans and transfers: ChatGPT and data protection.

Practical tip: Reviewing new AI tools from a data protection standpoint and signing DPAs requires expertise. Companies without an internal legal department can rely on heyData’s external data protection officer to review software and internal policies efficiently.

How do you handle AI output?

• Verification: Prohibit adopting text, code or decision recommendations without review.
• Terms of use: Depending on the plan, inputs may be used for training and commercial use may be restricted. Check the terms of every approved tool.
• Copyright: Have copyright questions about AI output reviewed by a lawyer in case of doubt.

Does AI-generated content have to be labelled (Art. 50 AI Act)?

It depends on your role. Art. 50 AI Act has applied since 2 August 2026. Providers make AI interaction recognisable and mark synthetic content in a machine-readable format (paras. 1 and 2); for systems placed on the market before 2 August 2026, para. 2 applies only from 2 December 2026. As a deployer, you disclose deepfakes and label AI-generated text published to inform the public on matters of public interest, unless it has undergone human review and editorial responsibility is held (para. 4). Define in the policy when you disclose the use of AI. Regulation (EU) 2026/1744 (“Digital Omnibus on AI”) has been in force since 27 July 2026 and postponed the high-risk deadlines (Annex III to 2 December 2027). Details in our article on the Digital Omnibus; whether your tool falls under the high-risk rules, you can check with the checklist for classifying AI tools.

Does the works council have to be involved?

That depends on the individual case. Under Section 90(1) no. 3 BetrVG, the employer must inform the works council in good time, with the necessary documents, about the planning of work procedures and workflows, including the use of artificial intelligence. A co-determination right under Section 87(1) no. 6 BetrVG concerns technical devices intended to monitor the behaviour or performance of employees; whether an AI tool falls under it is, in our assessment, a question of the individual case and not legal advice. Where the works council has to assess the introduction or use of AI, calling in an expert is deemed necessary to that extent under Section 80(3) sentence 2 BetrVG. Involve the works council and data protection early. More on AI in HR: AI in HR.

Who is responsible for AI output?

AI systems can hallucinate (invent facts), output outdated data or deliver biased results. Your policy therefore needs clear controls:

• Human final responsibility (human-in-the-loop): AI is an assistant, not a final decision-maker. A human reviews every work product.
• Plausibility check: For factual statements, statistics, legal assessments or decisions with external impact, cross-check against primary sources.
• Responsibilities: Assign fixed roles. Who maintains the list of approved tools? Who is the contact for errors or security incidents? Typically, this is a task force made up of IT, data protection and legal.

How do you roll out the AI policy?

1. Involve stakeholders early: Management, IT, data protection, HR and the works council.
2. Write in plain language: Clear wording and examples from everyday work instead of legalese.
3. Train: Short workshops show how to follow the policy in day-to-day work with AI tools.
4. Make it available centrally: Intranet or employee handbook, plus a one-pager.
5. Embed it: Onboarding and an “AI check” when procuring new software.
6. Update regularly: Review the policy at least once a year.

Checklist: your AI policy at a glance

Fundamentals and scope

• Scope (who, which tools) and purpose are defined.
• Key terms such as “AI system” are clearly delimited.

Data protection

• Permitted and prohibited data categories for inputs are defined.
• Legal basis (Art. 6 GDPR), DPA process and third-country transfers are regulated.
• A contact person for data protection questions is named.

Output and tools

• Human review of AI output is regulated in a binding way.
• The tools’ terms of use have been reviewed and documented.
• There is a list of approved tools and a traceable approval process.
• The use of unapproved tools or personal accounts is excluded.

Legal and involvement

• Measures for AI literacy (Art. 4 AI Act) and labelling (Art. 50 AI Act) are defined.
• The involvement of the works council has been checked.

Conclusion

An AI policy is not a bureaucratic hurdle but a building block of your compliance and risk strategy. It gives employees orientation on how to use AI tools productively with data protection and the EU AI Act in mind. In case of doubt, have the contents reviewed by legal or data protection.

With heyData’s AI compliance, you create your AI policy based on vetted templates, train your team in AI literacy and keep track of all the AI tools in use.

Take the first step: Book a free demo now