AI policy example: what does a one-page AI policy look like?

What is an AI policy?

An AI policy is a set of agreements about how your business uses AI. It says what is allowed, what is not allowed and who is responsible for what. You can read more about the term under AI policy.

There are two good reasons to put it on paper. The first is privacy. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) received reports of data breaches because employees entered personal data into an AI chatbot. The AP advises businesses to make clear agreements about what is and is not allowed.

The second reason is the EU AI Act. If your team uses AI, you must take measures for the AI literacy of your people. Agreements are part of that. Read more in AI literacy is mandatory: what do you need to arrange as an employer?

Why does a short AI policy work better than a long one?

A short text gets read and remembered. A twenty-page policy disappears into a folder. A page with a few clear rules is something you discuss in a team meeting, and pin up by the coffee machine.

A short policy is also easier to update. AI tools change often. If everything is on one page, you change a rule without going through a whole document.

Short does not mean vague. Every rule must be so clear that a colleague knows what to do. ‘Be careful with AI’ helps no one. ‘Do not put customer names into an AI tool’ does.

What goes into an AI policy?

A usable AI policy answers five questions:

1. Which AI tools may we use, and with which account?
2. Which data does not belong in them?
3. Who checks what AI produces?
4. When do we say that AI has been used?
5. Who can you turn to with a question or a mistake?

Put a date at the bottom, and when you will review the policy again. You keep the overview of the tools themselves in a separate AI register. That keeps the policy short.

What does a one-page AI policy look like?

Like this, for example. Replace the text between [brackets] with your own details, and delete what does not fit.

This example is a template in plain language. It is not a legal document and not legal advice.

AI policy of [company name]

Version of [date]. Owner: [name]. We will review this policy again on [date].

1. Why this policy

We use AI to make our work easier. We want to do that safely, for customers, suppliers and for each other. This policy applies to everyone who works for [company name], including temporary workers and freelancers.

2. Which AI tools are allowed

• We only use the AI tools in our AI register, with the work account of [company name].
• At the moment these are: [for example ChatGPT Business and Copilot Chat with your work account].
• Do not use a personal or free account for work.
• Want to use a new tool? Ask [contact person] first. They will check whether the tool is safe and add it to the register.

3. Which data does not belong in them

• No personal data of customers, suppliers or colleagues, such as names, addresses, phone numbers or email addresses. Remove them first, or replace them with ‘customer A’.
• No sensitive data, such as medical data, a citizen service number (BSN) or data about salary and sick leave.
• No passwords, login codes or API keys.
• No confidential documents, such as contracts, supplier prices or figures that are not public.

In doubt? Then leave it out, and ask [contact person].

4. A person checks

• AI makes a draft. You are responsible for what you do with it.
• Check facts, amounts, names and sources before you use anything. AI can make up things that sound convincing.
• AI does not make decisions about people, such as about job applicants or customers. A colleague does that.

5. Open about AI

• A text that a customer reads, you have checked yourself. Then it is your text, even if AI helped.
• Is a customer talking to a chatbot that uses AI? Then we say so.

6. Questions and mistakes

• Questions about AI go to [contact person, name and phone number].
• Have you accidentally put personal data into an AI tool? Report it straight away to [contact person]. Then we will look together at whether it is a data breach. The sooner we know, the better we can resolve it.

7. Updating

[Contact person] reviews this policy and the AI register at least once a year. And sooner if a new tool arrives, or if the rules change.

As you can see: no legal language, and every rule can be understood in one go. Why a business account and a data processing agreement are needed, you can read in Is ChatGPT safe for businesses? And what to do if it does go wrong, you can read under data breach.

What is an AI register?

An AI register is an overview of the AI tools your business uses. For each tool it states what you use it for, who the owner is, which data goes into it and whether it has been approved.

Such an overview is also the first step the AP mentions in its guidance on AI literacy: map out which AI systems you use. Do you already have an overview of your processing of personal data for the GDPR? Then, according to the AP, you can build on that.

A spreadsheet or a table in a shared document is enough. It is about the overview, not the software.

What does an AI register look like?

With five columns: tool, purpose, owner, data and approved. Below is a made-up example. More columns are fine, but start with these.

For each tool, also note whether there is a data processing agreement, and where you keep it. Do you see a tool that is being used, but is not in the register? Then you know straight away where to start.

How do you draw up an AI policy?

In five steps:

1. Ask what your team uses now. Do it without judgement. You want to know what is there, not who did something wrong.
2. Choose the tools and accounts. Preferably a business account with a data processing agreement. Which tool fits, you can read in ChatGPT, Copilot or Claude: which AI suits your business?
3. Write the page. Use the example above and adapt it to your own work.
4. Fill in the AI register. Include every tool that is allowed, and also the tools that are not.
5. Appoint a contact person. One person who answers questions and keeps the register up to date.

How do you introduce the AI policy to your team?

By talking about it, not just by emailing it. A few tips:

• Discuss the policy in a team meeting, with examples from your own work.
• Show how to remove a name from a text before you put that text into an AI tool.
• Put the policy somewhere everyone can find it, such as the intranet or the shared folder.
• Include it when onboarding new colleagues.
• Record who has received the policy, and when. That also fits with the AI literacy obligation.
• Do you have a works council? Then involve it in good time.

Without explanation, a policy stays on paper. That is why an AI policy and a short training belong together. Do you recognise that your team already uses AI without agreements? Then read Your team uses ChatGPT without agreements.

When do you update the AI policy?

Update it when something changes, and look at it at least once a year. Good moments to review it again:

• a new AI tool is added, or a tool gets new features;
• your team starts using AI for other work, for example for customer contact;
• something went wrong, such as personal data in an AI tool;
• the rules change, as in July 2026, when Article 4 of the EU AI Act was amended.

Then also update the date and the AI register.

How I help you with this

In the AI policy & training session, we create the AI policy for your business together in half a day. Your team gets an explanation of what AI can do, where it goes wrong and how to use it safely. And we make an overview of the AI tools your team uses. What the training costs, we discuss in the first conversation. That way you know in advance where you stand. I come to your business, anywhere in the Netherlands. Read more on AI training, or book a conversation.

Frequently asked questions

Sources: AP: Beware, using an AI chatbot can lead to data breaches (in Dutch, 6 August 2024), AP: Getting started with AI literacy (in Dutch, 30 January 2025) and Regulation (EU) 2026/1744 (in Dutch), which amended Article 4 of the EU AI Act. Consulted on 7 October 2026.