Staff already paste customer data, contracts and code into personal AI accounts. A short, clear policy that names the approved tools and the data that never goes in does more than a ban. Fill in the form and get a ready-to-edit policy in English or Romanian.
Short answer: a useful AI use policy names the approved tools and accounts, bans personal accounts for company data, lists the data that must never be entered (personal data, credentials, card data, confidential business information), makes people responsible for checking AI output, sets a request process for new tools, and tells staff to report mistakes quickly.
Free, runs in your browser. Nothing you enter is sent or stored. Updated: .
Your company
Used only to fill in the policy text.
Approved AI tools
Only tools you have a business contract for. Leave all unticked if none are approved yet.
Data that must never go into AI tools
Rules that apply to you
Your AI use policy
A starting point written for small and mid-sized companies, not legal advice. Have it reviewed against your contracts, your DPO's guidance and the tools' actual settings before you publish it.
Questions
Does the EU AI Act require an AI policy?
Not by name, but article 4 has required since 2 February 2025 that organisations using AI systems take measures to ensure sufficient AI literacy among their staff. A written policy plus short training is the simplest way to show that.
Should we just block ChatGPT and similar tools?
Blocking alone tends to push use onto personal phones and accounts where you have no visibility. Approving one business-grade tool with training disabled, and blocking the rest, usually reduces the risk more.
Is this policy enough for GDPR?
It covers the staff rules. You still need a data processing agreement with each approved AI provider, a documented legal basis for any personal data you process with it, and a DPIA where the processing is high risk.
We set up the guardrails before the licences: data classification and labels, oversharing checks in SharePoint, retention and training settings, and short training for staff.