How to write an AI policy for employees

Step 2: Which tools are allowed?

Keep an approved tools list with tool, plan, permitted purpose and owner. Only listed tools may be used for company work, and only with a company account. Check the contract before adding a tool: who processes the data, in which country, under which data processing agreement, and are inputs used for training? Our guide on AI email and the GDPR shows what that review looks like for AI mail tools. In its notice on DeepSeek, the CNPD generally advises favouring tools that comply with the GDPR and the AI Act and offer clear security and privacy guarantees. Provide a simple request route for new tools, otherwise shadow AI follows.

Add-on features belong on the list too. A company that claims its profile in ChatGPT, for example, accepts separate terms; see our guide on claiming your business in ChatGPT.

Step 3: What must never go into ChatGPT and similar tools?

This is the heart of the policy. Ban the following inputs into any tool without a contract and approval:

• Personal data of customers, staff and applicants: names, addresses, phone numbers, emails, payroll or health data.
• Customer data and content from contracts, quotes or tickets that concerns people or confidential terms.
• Trade secrets: prices, cost calculations, source code, plans, passwords.
• Special categories under Article 9 GDPR, such as health, religion or trade union membership, which need a separate review even in approved tools.

The CNPD puts it bluntly in the DeepSeek notice: never enter personal or confidential data into tools that lack adequate guarantees. Require anonymisation before input, and recall Article 22 GDPR: decisions with significant effects on people, for example on job applications, must not be made solely by automated means. The CNPD explains this on its page on GDPR obligations when using AI.

Step 4: When must AI content be labelled?

Article 50 of the AI Act has applied since 02.08.2026, as the CNPD confirms in an event notice. According to the article text, it affects deployers, meaning your business, in two cases:

• Deep fakes: image, audio or video content generated or manipulated by AI that appears authentic must be disclosed as such.
• Text on matters of public interest published to inform the public. Exception: the text has undergone human review or editorial control and a person holds editorial responsibility.

The legal labelling duty is therefore narrower than many assume. An internal report or an edited advertising text usually falls outside it. Machine-readable marking is the tool providers' job; for systems placed on the market before 02.08.2026, Article 111 gives them until 02.12.2026. Your policy may go further than the law, for example with a house label for AI images on social media or for a chatbot on your website. What matters is that everyone knows the rule.

Step 5: Who is responsible, and how do you train people?

Name one person responsible for the policy, often the managing director or whoever handles data protection. That person maintains the approved list, answers questions and documents training. The Commission allows training at different depths depending on prior knowledge; the CNPD observes that companies often differentiate by role, with dedicated formats for managers and deeper content for AI contact persons. Minimum content: how the tools work and where they fail, hallucinations, data protection and your own rules. Keep a simple training register with date, content and participants. The AI Office's Repository of AI literacy practices collects more than 40 initiatives for inspiration, but the Commission notes that copying them does not create a presumption of compliance.

If you need outside support for a larger AI project, our guide on SME Packages AI covers the funding route.

Step 6: How do you keep control and keep the policy current?

Review the policy at least once a year and whenever a new tool arrives. The CNPD suggests tracking the effect of literacy measures with indicators such as participation rate or knowledge gained. Set out how breaches and incidents are reported, for instance customer data entered by mistake, and link this to your GDPR data breach procedure. In Luxembourg, bill No. 8476 would make the CNPD the general market surveillance authority for the AI Act, alongside sector authorities such as the CSSF and the CAA. On 12.11.2026 the Chamber of Deputies listed the bill as still "en commission".

Checklist: is your policy complete?

• Inventory of AI tools in use done?
• Approved tools list with plan, purpose and owner?
• Clear list of prohibited inputs?
• Labelling rule under Article 50 plus house rules?
• Responsible person named?
• Training register in place?
• Incident reporting route and next review date set?

Template: outline of an AI usage policy

Copy this outline and fill in each point for your business.

1. Purpose and scope: who the policy covers (employees, interns, apprentices, freelancers, service providers), date and version.
2. Definitions: AI system, generative AI, personal data, confidential information.
3. Principles: a human decides, outputs are checked, responsibility stays with the user.
4. Approved tools: table with tool, plan, account, permitted purpose, contact person; request route for new tools.
5. Prohibited inputs: personal data, customer data, trade secrets, credentials, special categories of data; anonymisation duty.
6. Prohibited uses: automated decisions about people without human review, any prohibited practice under Article 5 of the AI Act.
7. Quality and review: check facts and figures, name sources, respect copyright.
8. Labelling: legal cases under Article 50 (deep fakes, public interest texts without editorial control) and internal house rules.
9. Roles: policy owner, data protection contact, line managers.
10. Training: mandatory onboarding training, refreshers, register.
11. Incidents: reporting route, deadline, link to the data breach procedure.
12. Review and updates: annual review, review for new tools, version history.
13. Acknowledgement: signature or digital confirmation by staff.

How long should an AI policy be?

An AI policy does not need to be long. For an SME, two or three pages, an approved tools list and a training register are often enough. What counts is that it is applied: vet tools, name prohibited inputs clearly, document training and update the rules every year. That gives the business a traceable way to meet the Article 4 literacy duty and lowers the risk of data breaches.

What is still open?

• We could not retrieve the original text of Regulation (EU) 2026/1744 from EUR-Lex for technical reasons; we rely on the consolidated version on the AI Act Service Desk (as at 27.07.2026) and Commission pages.
• Whether and when bill No. 8476 is passed, and how the CNPD will check Article 4 in practice, is open.
• The AI Board's recommendations under Article 4(3) and the Commission's compliance examples on the single information platform have not yet been published.
• This guide is not legal advice; we have not reviewed employment law aspects such as the role of the staff delegation.