AI usage policy for employees: what to include, plus a template

What an AI usage policy should cover

Before drafting, answer these questions. Any you can’t answer is the conversation to have with leadership, IT and data protection:

• Which AI tools are approved, and with which accounts (company, not personal)?
• Which data must never go into AI, and which may go only into approved tools?
• What must a person review before anything leaves the company?
• When do you disclose that text or analysis was produced with AI?
• Who approves a new tool, and how fast do they respond?
• Who do you report a mistake to (data that shouldn’t have gone out, a wrong answer that was sent)?

Template (1/2): purpose, tools and data

Copy and adapt. Replace the text in brackets. It’s a starting point, not a finished legal document:

• 1. Purpose. This policy explains how we use artificial intelligence at [Company] to work better without putting client, colleague or supplier data at risk. It applies to all staff, contractors and interns.
• 2. Approved tools. For work, use only these tools with your company account: [list]. Free personal accounts are not used with company information. To propose a new tool, contact [person or channel]; we reply within [timeframe].
• 3. Data that never goes into a non-approved AI tool: client, employee or candidate data; contracts, proposals and non-public pricing; credentials and keys; code or internal documents marked confidential.
• 4. Special category data (health, union membership, beliefs, children’s data): never entered into any AI tool without explicit approval from [data protection lead].
• 5. Minimisation. Even in an approved tool, enter only what the task needs. If a person’s name isn’t necessary, leave it out.

Template (2/2): human review, transparency and questions

• 6. Human review. AI suggests, a person decides. Anything sent outside the company on behalf of [Company] is reviewed first by whoever sends it. Decisions about people (hiring, evaluating, disciplining, granting or refusing something) are never made by AI alone.
• 7. Accountability. Whoever uses AI owns the result as if they had done it by hand: check figures, names, dates and quotes before using them.
• 8. Transparency. Say that AI was used when the recipient could reasonably expect work done by a person, or when a client or regulation requires it.
• 9. No surveillance. [Company] does not use AI to measure anyone’s individual activity or productivity.
• 10. Incidents. If data leaks by mistake or AI produces something harmful, tell [person or channel] the same day. Reporting promptly is never penalised.
• 11. Training and review. Everyone who uses AI gets a short training session. This policy is reviewed every [6 or 12] months. Owner: [name and role].

GDPR: what the policy can’t leave out

When an AI tool processes personal data on your company’s behalf, the provider is a processor, and Article 28 of the GDPR requires a data processing agreement. That’s why the list of approved tools is the heart of the policy: it should only include tools that offer one, with data stored in the EU or under valid transfer safeguards.

Add the processing to your records of processing activities, inform staff and check with your DPO or adviser whether you need an impact assessment. The EU AI Act also expects people who use these systems to have sufficient AI literacy, so the training in clause 11 is not decoration.

How to make it stick

A policy nobody knows about protects nobody. What actually helps:

• Walk people through it in 15 minutes, with real examples from each team’s work.
• Offer an approved alternative that is as convenient as a personal account.
• Build rules into the tool where you can (prior approval, data masking) rather than relying on memory.
• Publish an FAQ and update it with the questions that come in.

Where Tessa fits

Tessa can be one of the approved tools in your policy for daily work across email, Slack, meetings and documents. She comes with a published DPA, sub-processor list and security policy; stores data encrypted in the EU; masks email addresses and phone numbers before they reach the model; and, on request, runs analysis on a European AI model. Anything leaving the company waits for approval, and the control panel logs everything she does. This guide is still for information only: review your policy with your adviser.