On this page
Five agreements on two pages
An AI policy template gives your company five agreements: which AI tools are approved, which data never goes in, who decides, how people learn to work with AI, and what gets reviewed and disclosed before it leaves the building. Two pages are enough for most companies.
This one is written for the EU AI Act, which reaches further than many companies outside the EU expect. It comes in Word with a blank policy and two filled-in examples, a construction company and an accounting firm, both fictional, plus an Excel register of tools and training.
Does the EU AI Act apply to your company?
The AI Act is an EU regulation, but it does not stop at the border. It applies to a company established in the EU that uses AI at work, which the Act calls a deployer, and to a company outside the EU whose AI output is used in the EU. A UK agency with clients in Belgium, or a US software firm with a team in Amsterdam, can fall under it for that part of its work.
| Your situation | What the AI Act asks of you | What this template covers |
|---|---|---|
| Company in the EU using ChatGPT, Copilot or similar | AI literacy since 2 February 2025; transparency rules since 2 August 2026 | All five blocks |
| UK or US company with staff in the EU | The same, for the EU team | All five blocks, applied to that team |
| UK or US company whose AI output reaches EU clients | Transparency when a chatbot talks to EU users or content looks real | Block 5 |
| Company using AI to screen applicants or assess staff | High-risk rules from 2 December 2027 | Not enough on its own: get specific advice |
In the UK itself the AI Act does not apply; UK GDPR and the ICO's guidance on AI and data protection still govern any personal data you put into a tool. For the full picture, read the guide to the EU AI Act for business, and check in five minutes what it asks of you with the EU AI Act checker. Whether you need a written policy at all is answered in do I need an AI policy.
AI literacyBlock 4 of your policy: training and register
Disclose chatbots and deepfakesBlock 5: say when something is AI
Marking by providersExisting tools until 2 December 2026
High risk, Annex IIIHiring, decisions about staff
- Literacy applies
- Transparency applies
- Marking transition ends
- High risk applies
If you use AI to screen applicants or assess staff, the Act asks more than this policy from December 2027.
Block 1: approved tools, and on which plan
The difference that matters is not ChatGPT against Copilot, Claude or Gemini. It is free against business. Free and personal plans can train on what you type; the business plans of the four large providers do not by default, and their own terms say so.
| Tool | Business plan | Trains on your data | Watch out |
|---|---|---|---|
| ChatGPT | Business or Enterprise | No, unless you opt in | Pick the data region at purchase where offered |
| Microsoft 365 Copilot | With your Microsoft 365 licence | No | It shows whatever the user can open, so clean up permissions first |
| Claude | Team or Enterprise | No, the commercial terms forbid it | Check the storage region in your contract |
| Gemini | In Google Workspace | No, without your permission | Stays inside your organisation |
Start where you already work: Microsoft 365 points to Copilot, Google Workspace to Gemini. The comparison sits in ChatGPT or Copilot, the data question in is ChatGPT safe for business, and if you want a provider with European servers, read is there a European chatbot.
Blocks 2 and 3: data and who decides
A business plan solves training, not everything. Personal data stays under the GDPR: with a provider that processes it for you, you need a data processing agreement. And some data belongs in no tool at all: national ID numbers, health data, passwords, and clients' confidential documents without their consent.
Name who decides. In a small company that is the managing director for tools, and the person who knows the client for anything sent to that client. An AI tool can be wrong with great confidence, an AI hallucination, and "a person reviews it" is the only safeguard that works.
Block 4: proving AI literacy without a certificate
Since 2 February 2025, the AI Act asks companies to take measures so that people who work with AI know enough about what the tool can and cannot do. The European Commission's FAQ is clear that there is no fixed level and no certificate: it has to fit what each person does. An accountant summarising new rules needs something different from a marketer generating images.
The Excel register makes this visible. The Training tab lists everyone who works with AI with their training date; it computes when each refresher is due and the share of the team already trained. That register is your evidence if anyone asks. A first training starts with what a prompt is and why prompt injection is a risk once a tool reads your email.
Before you publish the policy internally
- Every AI tool in use is on the list, including AI inside other software
- Each approved tool runs on a business plan that does not train on your data
- A data processing agreement is in place where personal data goes in
- The never list names your real sensitive data, not generic words
- One person approves new tools, and everyone knows who
- A training date is set and the register is started
- Staff were told before a tool that changes their work goes live
Block 5: what you review and when you say it is AI
Not every AI-assisted text needs a label. Since 2 August 2026, the AI Act's transparency rules apply: a chatbot must say it is AI, realistic images and video must be disclosed, and so must text on matters of public interest unless a person reviewed it and takes responsibility. Providers of generative AI already on the market must mark their output by 2 December 2026; what the December labelling rule means for you has the detail.
| What you produce | Disclose it is AI | What your policy says |
|---|---|---|
| A quote or email you reviewed | No | Always review before sending |
| A chatbot on your site | Yes, in the conversation | The chatbot says so at once |
| A realistic image or video | Yes | Disclose on publication |
| A reviewed blog post on a general topic | No | A person signs off |
| AI ranking job applicants | High-risk from 2 December 2027 | Not without specific advice |
The high-risk date moved with the omnibus; the high-risk delay explains why. If you plan AI in hiring, have that part reviewed by a lawyer.
The two examples: construction and accounting
The construction company uses AI for quote texts, site reports and email, on ChatGPT Business and Copilot. What it never does: put clients' drawings and bills of quantities into a tool without consent, or health data after an accident on site. The accounting firm runs Copilot, Claude Team and the AI in its accounting package, with a stricter rule: no advice leaves unreviewed, and the file manager stays responsible. Both fit on two pages; yours should too.