AI policy for Demo Company Ltd
Version 1, 22/10/2026. Current How to
The policy has been adopted. Next: Upload your data. Upload data
Send the policy to employees
Save the policy as a PDF and send it with this message. It takes 2 minutes.
Adopted
Adopted by CB on 22/10/2026, 17:30:27.
View proof
Audit log entry no. 13 · fingerprint 1cdc6f19b7fd6c5a…
✓ The policy matches the audit log and has not been changed. View the audit log
Applies to all employees at Demo Company Ltd who use AI. Responsible: Managing Director. Approved tools: Microsoft 365 Copilot, ChatGPT Business.
1. Purpose and scope
The policy applies to all employees of Demo Company Ltd who use AI at work.
It makes sure we use AI lawfully and responsibly, in line with the EU AI Act and GDPR.
Basis: Art. 4 and 26 AI Act; Art. 5 and 24 GDPR
2. Approved AI tools
These AI tools may be used at work: Microsoft 365 Copilot, ChatGPT Business.
Other AI tools may only be used with the approval of the person responsible.
Basis: Art. 26(1) AI Act
3. Recorded uses of AI
Every use of AI on the company's data must be recorded in GoalCube's AI inventory before it is started.
Summary of customer enquiries: Minimal risk.
Overview of supplier contracts: Minimal risk.
Assessment of applicants for controller: High risk.
Basis: Art. 6 and 26 AI Act
4. Prohibited use
AI must never be used for: emotion recognition in the workplace or in education; social scoring of people; biometric categorisation by, for example, race, political opinion, religion or sexuality; manipulation or exploitation of vulnerabilities that can harm people.
Basis: Art. 5 AI Act
5. Personal data and confidential data
Personal data and confidential business data must not be typed or pasted directly into an AI tool.
Such data is only used through GoalCube Personal data, where the AI only sees pseudonyms, and the real personal data stays in the EU.
Basis: Art. 5, 25 and 44 GDPR
6. Human control of decisions about people
AI must not make decisions about people. The AI can recommend; a person decides each case in GoalCube and gives the reason for the decision.
High-risk uses that require human oversight and a log for at least 6 months: Assessment of applicants for controller.
Affected people are told that AI is involved and can get an explanation of the decision.
Basis: Art. 22 GDPR; Art. 14, 26 and 86 AI Act
7. AI literacy
Everyone who uses AI at work completes GoalCube's AI literacy course before they start using AI, and again after significant changes.
Basis: Art. 4 AI Act
8. Responsibility and follow-up
Person responsible for the policy and the AI inventory: Managing Director.
The policy is reviewed at least once a year, and whenever a new use of AI is recorded.
Errors, incidents and questions are reported to the person responsible.
Basis: Art. 24 GDPR; Art. 26(5) AI Act
Your own sections
The policy has no sections of your own. An adopted policy is locked. If you want to add or correct a section, make a new version; the current policy applies until the new one is adopted.
The template is simplified and is not legal advice.