AI policy for Demo Company Ltd
Version 1, 22/10/2026. Draft How to
Applies to all employees at Demo Company Ltd who use AI. Responsible: Managing Director. Approved tools: Microsoft 365 Copilot, ChatGPT Business.
1. Purpose and scope
The policy applies to all employees of Demo Company Ltd who use AI at work.
It makes sure we use AI lawfully and responsibly, in line with the EU AI Act and GDPR.
Basis: Art. 4 and 26 AI Act; Art. 5 and 24 GDPR
2. Approved AI tools
These AI tools may be used at work: Microsoft 365 Copilot, ChatGPT Business.
Other AI tools may only be used with the approval of the person responsible.
Basis: Art. 26(1) AI Act
3. Recorded uses of AI
Every use of AI on the company's data must be recorded in GoalCube's AI inventory before it is started.
Summary of customer enquiries: Minimal risk.
Overview of supplier contracts: Minimal risk.
Assessment of applicants for controller: High risk.
Basis: Art. 6 and 26 AI Act
4. Prohibited use
AI must never be used for: emotion recognition in the workplace or in education; social scoring of people; biometric categorisation by, for example, race, political opinion, religion or sexuality; manipulation or exploitation of vulnerabilities that can harm people.
Basis: Art. 5 AI Act
5. Personal data and confidential data
Personal data and confidential business data must not be typed or pasted directly into an AI tool.
Such data is only used through GoalCube Personal data, where the AI only sees pseudonyms, and the real personal data stays in the EU.
Basis: Art. 5, 25 and 44 GDPR
6. Human control of decisions about people
AI must not make decisions about people. The AI can recommend; a person decides each case in GoalCube and gives the reason for the decision.
High-risk uses that require human oversight and a log for at least 6 months: Assessment of applicants for controller.
Affected people are told that AI is involved and can get an explanation of the decision.
Basis: Art. 22 GDPR; Art. 14, 26 and 86 AI Act
7. AI literacy
Everyone who uses AI at work completes GoalCube's AI literacy course before they start using AI, and again after significant changes.
Basis: Art. 4 AI Act
8. Responsibility and follow-up
Person responsible for the policy and the AI inventory: Managing Director.
The policy is reviewed at least once a year, and whenever a new use of AI is recorded.
Errors, incidents and questions are reported to the person responsible.
Basis: Art. 24 GDPR; Art. 26(5) AI Act
Add your own sections
E.g. rules for your industry, examples of good use or whom to ask. The sections come before "Responsibility and follow-up" and carry over to new versions. Write roles, not names.
No sections of your own yet.
The template is simplified and is not legal advice.