Term · AI
AI policy
An AI policy sets out how your business uses AI: which tools are allowed, which data may go into them and who checks the result.
In short
An AI policy is a short set of agreements about the use of AI in your business. It states which AI tools are allowed, which data you do not put into them, who checks the outcome and who you can go to with questions. The law does not prescribe a fixed model, but clear agreements help with AI literacy and reduce the risk of data breaches.
What is an AI policy?
An AI policy is a document with the agreements about AI in your business. It says what is allowed, what is not allowed and who is responsible for what. For an SME, that can fit on one or two pages.
You also hear other names, such as AI guideline, AI protocol or rules of use for AI. The idea is the same.
Why do you need an AI policy?
The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) sees that many people use AI tools at work, sometimes against the agreements. The AP received reports of data breaches because employees put customer or patient data into an AI chatbot. That is why the AP recommends making clear agreements: is it allowed, and if so, with which data?
In addition, the EU AI Act requires measures for AI literacy. The law does not say which ones. So an AI policy is not a mandatory document, but clear agreements are a logical measure.
What goes into an AI policy?
- Purpose. What do you use AI for, and what not?
- Permitted tools. Which tools are allowed, with a business account. Keep track of them in an AI register.
- Data. What must not go into a prompt, such as personal data, confidential documents and passwords.
- Checking. A person reads AI text before it goes out.
- Openness. When do you tell customers that AI is involved, for example with a chatbot?
- Knowledge. What explanation or training does your team get?
- Point of contact. Who do you report a mistake, a doubt or a data breach to?
- Review. When do you look at the agreements again?
Example in an SME
A made-up example
An accountancy firm agrees: AI may be used for draft emails and for summaries of public documents. Client files do not go into it. Only the business version of one tool is allowed. Every AI text to a client is read through. One colleague keeps the list of tools and is the point of contact.
You can find a worked example on one page in AI policy on one page. Is your team already using AI without agreements? Then read Your team uses ChatGPT without agreements.
In AI policy & training, I spend half a day with your team drawing up the rules for AI use and an overview of your AI tools. Read more about the AI training.
Frequently asked questions
Is an AI policy mandatory?
The law does not prescribe a separate AI policy. However, the EU AI Act requires measures for AI literacy, and the GDPR requires you to handle personal data carefully. Agreements on paper help with both.
How long is an AI policy?
As short as possible. A short text in plain language is easier to remember and apply than a long document.
Who writes the AI policy?
Management adopts it. But write it together with the people who use AI. They know which tools and tasks are involved.
Sources: the Dutch Data Protection Authority (Autoriteit Persoonsgegevens): using an AI chatbot can lead to data breaches (in Dutch), AP: AI literacy (in Dutch) and AP: Getting started with AI literacy (in Dutch). Consulted on 7 October 2026.
Written by Bart van Engelenhoven Founder of Uniekaiconsultancy in Ede, the Netherlands. Bart analyses how SMEs work and builds software, integrations and AI applications himself. Last updated: 7 October 2026
Read more
Term
AI register
An AI register is an overview of the AI tools in your business: what, for what, by whom and with which data. What goes in it and whether it is mandatory.
Read moreTerm
AI literacy
AI literacy is knowing how AI works, where it goes wrong and how to use it well. What it means and what Article 4 of the EU AI Act requires.
Read moreArticle · 9 min read
AI policy example: what does a one-page AI policy look like?
A one-page AI policy you can adopt: which tools are allowed, which data stays out and who checks. With an example of an AI register.
Read moreNext step
Curious what could work for you?
- The first conversation is free and without obligation
- By phone or at your premises
- You speak directly with me
Bart van Engelenhoven You tell me what takes up your time, I tell you honestly whether I can help.