AI policy template
Template: a one-page AI policy
A template for a department or a smaller company. Adapt it with IT, your data protection officer (DPO) and a lawyer – it is not legal advice.
Valid from: ………… Owner: ………… Review: every 6 months
1. Why we use AI
To have more time for work that needs people – customers, problem solving, quality. AI is a helper; a human is always responsible for the result.
2. Approved tools
| Tool | For what | Who |
|---|---|---|
| Microsoft 365 Copilot / Copilot Chat (work account) | everyday work with documents, mail, meetings | everyone licensed / everyone |
| Approved agents (list on the intranet) | company knowledge, policies | per agent |
| Copilot Cowork | longer multi-step tasks | pilot group, with a spending limit |
| Other tools | only after approval by the policy owner | – |
Public AI tools without a business contract (personal accounts) are not used for company data.
3. Which data where
| Data class | Public AI chat | Copilot Chat | M365 Copilot / Cowork | Approved custom solution |
|---|---|---|---|---|
| Public | yes | yes | yes | yes |
| Internal | no | yes | yes | yes |
| Confidential, trade secrets | no | with conditions | yes | yes |
| Personal data | no | with conditions | with conditions | with conditions |
| Special-category, safety-critical | no | no | with conditions | with conditions |
4. Duty to verify – the review ladder
- Internal drafts – the author reads and fixes the output.
- Decision support – verify numbers and sources, state “prepared with AI”.
- External outputs (customers, authorities, bids) – checked by a second person and approved.
- Legal, financial, safety – AI only prepares, a human decides, four-eyes principle.
5. Labelling
We label AI-generated images, videos and texts for the public. Customers must know when they’re talking to a chatbot.
6. Prohibited
- purely automated decisions about people (hiring, evaluation, dismissal, rewards),
- emotion recognition of employees,
- bypassing permissions, pasting passwords and access keys into AI,
- rating individuals by AI usage metrics.
7. Agents
A new agent or a use case with access to systems is approved by the policy owner / AI board. Agents get least privilege, a human confirms irreversible steps (sending, deleting, paying), and a spending limit is set.
8. Incidents
If an AI mistake has gone out or data has leaked, I report it within 24 hours to: …………
9. Training
Every user completes an introductory training. Branch champions help and collect good examples.