Guide
AI policy template with examples for your team
Can this customer email go into the chat? What about that job application? An AI policy only helps day to day if it answers questions like these. Here is a template with example cases.
Many AI policies open with principles like “responsible use” and “respect data protection”. Nobody asks about principles during the working day. They ask whether they can copy this customer email into the chat, and what about the job application that just came in.
This template answers those questions directly. It has a table of example cases and five rules. Adapt both to your company, and have management, IT and your data protection lead review your version. A template doesn’t replace legal advice.
In short
- Cover cases, not attitudes. The table below is the most important part.
- State which tool is allowed, and with which account.
- Name a person for questions and a way to report mistakes.
Can this go into the AI tool?
These ratings are an example for a smaller company that has rolled out a vetted company account. Yours may be stricter or more relaxed.
| Case | Example rating |
|---|---|
| Rewrite product copy from a published data sheet | Yes, in the approved tool |
| Translate a quote or customer letter | Yes, in the approved translator |
| Draft a reply to a customer enquiry | Yes, in the company account. Only the details the reply needs |
| Summarise a customer’s draft contract | Only after checking with [responsible team] |
| Screen or compare job applications | No, until a separate review has been done |
| Health data, salary data, personnel files | No |
| Passwords, credentials, API keys | Never |
| Work content in a private AI account | Never |
Job applications are a deliberate no. The EU AI Act lists AI systems for recruitment as high-risk in Annex III, so they need a review of their own.
The five rules
AI usage rules, [Company], version [no.], valid from [date]
Tools. For work tasks, use [tool] with your company account. Other AI tools, and AI features in other software, need approval from [responsible team] first.
Data. The table above shows what you may enter. Enter only what the task needs. Removing names isn’t enough if a customer number or free text still identifies the person. If in doubt, ask before you enter anything.
Checking. You’re responsible for every result you pass on. Check numbers, names, dates and commitments against the source before anything leaves the company.
Questions and mistakes. Send questions to [name, contact], or to [name] as deputy. If you accidentally enter something that shouldn’t be there, report it immediately to [reporting channel]. Say which tool, when, and what type of data, but don’t copy the data into the report.
Learning and updates. New employees get a short introduction before they receive access. [Responsible person] reviews these rules by [date] and whenever a new tool is added.
What the law requires
EU. The GDPR applies to personal data, including when you use AI. Article 4 of the AI Act requires companies to take measures on their staff’s AI literacy. Since the Digital Omnibus amendment in summer 2026, it no longer mandates a specific level. According to the European Commission, you don’t need a certificate, and you can keep an internal record of training. Rule 5 and an attendance list for the introduction are a simple start.
Switzerland. According to the FDPIC, the Swiss data protection regulator, the Data Protection Act applies directly to AI-supported processing of personal data. The EU AI Act can also affect Swiss companies, for example when they use AI output in the EU. Have this checked for your situation.
UK. The UK GDPR applies to personal data here too. If you do plan to use AI in hiring, read the ICO’s work on automation in recruitment first. As with Switzerland, the EU AI Act can reach UK companies whose AI output is used in the EU.
Next step
Go through the table at your next team meeting and ask which case is missing. The answers show you which rows your policy still needs. In onAI, admins decide which models and features each group can use, so the tool can match rule 1.
