Skip to content
Menu
EN

AI policy for employees: What should it include?

Policy, training and inventoryLast updated 3 min read

Short answer

An AI policy is your company's rules for using AI. It should say which tools are approved, what they may be used for, which data must never be entered, that people decide matters about people, who is responsible, and how staff learn to use AI. The law doesn't require a policy by that name, but it is the simplest way to show that you take AI literacy (Article 4 AI Act) and GDPR seriously. Review it at least once a year.

Short template

  1. Purpose. We use AI to work better – without compromising the data of our customers, employees and suppliers.
  2. Approved tools. [For example Microsoft 365 Copilot and ChatGPT Business.] Other tools require approval.
  3. Data. Never enter national ID numbers, health data, account numbers, passwords or our secret words. Use GoalCube when AI needs to work on personal data.
  4. Decisions. AI may prepare, but a person decides matters about people.
  5. Checking. Always check the AI's answers. AI can be wrong and make things up.
  6. Prohibited. We don't use AI to read emotions or to score people on their behaviour.
  7. Training. Everyone who uses AI takes our course.
  8. Responsibility. [Role] is responsible for the policy and reviews it at least once a year.

In GoalCube

GoalCube writes a draft policy based on your register and your approved tools. You can add your own sections and adopt it with one click. When the register changes, GoalCube shows that the policy needs a new version.

What to do

  1. Start with your register.The policy must fit the AI you actually use.
  2. List the approved tools.And which subscriptions – for example only business plans with a data processing agreement.
  3. Write down which data must never be shared.National ID numbers, health data, account numbers, passwords – and your secret words.
  4. State that people decide.The AI may prepare; people decide matters about people.
  5. Appoint someone responsible.A role, not a person, so the policy holds when people change jobs.
  6. Adopt it and share it.And review it at least once a year.

What the law says

Article 4 AI Act – AI literacy
A policy is one of the measures that support AI literacy.
Articles 24 and 32 GDPR
Appropriate organisational measures – for example clear rules on which data may be shared.

Questions and answers

Is an AI policy a legal requirement?

Not by that name. But it is the easiest way to document measures for AI literacy and organisational measures under GDPR.

How long should it be?

Short. One or two pages that staff actually read beat 20 pages that nobody reads.

How often should it be updated?

When you start using new AI, when the rules change – and at least once a year.

Sources

Written by The GoalCube editorial team. Last updated 11 October 2026. GoalCube helps you follow the EU AI Act and GDPR. It is not legal advice.

Be among the first.

We expect to launch in November 2026. Join the waitlist and we’ll let you know when you can get started.

Read next