AI acceptable use policy for staff

TL;DR: A clear AI acceptable use policy tells staff which tools they may use, what data they must never enter, who approves new tools, and how the policy helps meet the EU AI Act duties on literacy and transparency.

You run an EU SME with 10 to 249 people and you use third party AI tools like chatbots and code assistants. You do not build AI systems. You need a short, practical AI acceptable use policy for staff that protects data and helps you meet new duties under the EU AI Act.

This guide explains what to put in the policy. It also shows who should sign off new tools. It explains how the policy supports the AI Act literacy and transparency duties. This is plain information, not legal advice.

What the EU AI Act expects from deployers like you

The AI Act is a risk based EU regulation that sets harmonised rules on AI. It aims for trustworthy AI and assigns duties to providers and deployers of AI systems. See the EU Commission summary for background at AI Act | Shaping Europe’s digital future.

The Act also requires deployers to support AI literacy for their staff. Article 4 says providers and deployers shall take measures to support development of AI literacy among their staff and other persons dealing with AI systems on their behalf. See the Article 4 text at Article 4: AI literacy. The Commission and Member States will support SMEs in meeting this duty.

The Commission is also encouraging early preparation via the AI Pact. The Pact explains phased application of the Act and invites organisations to make voluntary pledges. See AI Pact | Shaping Europe’s digital future for details.

The European AI Office will play a role in enforcement and in producing codes of practice. See European AI Office | Shaping Europe’s digital future for the Office’s role and powers.

How an AI acceptable use policy helps you now

A short written policy does three things for an SME. First, it limits the ways staff can share company data with third party AI systems. Second, it documents your efforts to develop staff AI literacy. Third, it shows you have a governance process for approving new tools. These support the obligations in the AI Act without creating undue burden.

Keep the policy simple. Use plain language. Make the policy easy to find and easy to update.

The four practical choices your policy must make

1. Which AI tools are approved for business use.

2. What data staff must never enter into AI tools.

3. Who must approve procurement and use of a new tool.

4. How you will train staff and log use for transparency and accountability.

Each of these choices appears in the checklist and sample clauses below.

Approved tools: how to list them and manage exceptions

Have a short approved tools list. Keep it current. The list should specify tools for specific tasks. For example: one list for drafting marketing copy, another for code assistance, and another for customer support.

Things to put beside each approved tool.

• The permitted use case, for example "drafting internal emails" or "first draft for customer replies".

• Any mandatory settings, for example turning off document retention if the provider supports it.

• The minimum level of user competence required.

Create a simple approval flow for exceptions. For example: if staff want to use a non listed tool they must request approval from IT and Data Protection. Make reviewers check data handling and retention before approval.

Data that must never go into third party AI tools

This is the most critical part of the policy. Say it clearly and repeatedly.

List absolute no go categories. These are examples you can adapt. They are not legal advice.

• Personal data that is not strictly required for the task and cannot be anonymised.

• Special category personal data under the GDPR.

• Customer or candidate identifiers that allow re‑identification.

• Confidential business data such as unpublished financials, pricing formulas, or strategic plans.

• Legal privileged material like litigation strategy or confidential legal advice.

Explain how to reduce risk when some data must be used. For example, instruct staff to remove names and replace precise dates with relative timelines. Encourage use of synthetic or anonymised examples. Require review by the data protection officer or the person responsible for compliance before sensitive data is used.

For GDPR specific concerns, consult guidance and enforcement work by data protection bodies. See the European Data Protection Board material, starting with the ChatGPT Taskforce report at Report of the work undertaken by the ChatGPT Taskforce | European Data Protection Board.

Who signs off new tools and why that matters

Designate a small review team. Make responsibilities clear. Typical roles are IT, HR, legal or compliance and a business sponsor.

Suggested sign off steps.

• Initial request. Request from the user with a clear business justification.

• IT security check. Assess vendor security, encryption, and authentication.

• Data protection check. Evaluate what data will be processed and whether it is allowed under the policy and GDPR.

• Business owner sign off. Confirm the tool fits the business need and training will be provided.

Keep approvals short and time bound. For a simple chat tool the review may be a checklist completed within one week. For tools that process customer data allow more scrutiny.

Record approvals. Keep an inventory of approved tools with the date of approval. This inventory helps you meet documentation needs for transparency if required by authorities or auditors.

How the policy supports AI Act literacy and transparency duties

The EU AI Act explicitly asks providers and deployers to take measures to support AI literacy. Article 4 requires measures to ensure, to the deployer’s best extent, a sufficient level of AI literacy among staff and other persons dealing with the AI systems. See the Article 4 text at Article 4: AI literacy.

Your policy should do three simple things to support that duty.

1. Define minimum awareness for each role. For example, all staff must know what cannot be input to AI systems. Technical users must know how to check prompts and outputs.

2. Require role specific training before granting access to higher risk tools.

3. Keep simple documentation of completed training and of tool approvals.

Transparency duties under the Act include obligations for some systems to be documented and for users to be informed about AI driven interactions. Even when your organisation only deploys third party tools, you should keep basic records. These include which tools are used for customer facing situations and what mitigations are in place.

The AI Pact encourages organisations to prepare early and to document voluntary commitments. See AI Pact | Shaping Europe’s digital future for the Pact’s approach and timelines.

Practical training: what to teach every staff member

Training should be short and task focused. Prioritise staff who use AI for customer contact, recruitment, legal, finance or product descriptions.

Training modules to consider.

• What AI can and cannot do in your workplace.

• The absolute no go data list.

• How to anonymise or redact data.

• How to escalate suspicious outputs or data exposures.

• Record keeping and how to log approvals and exceptions.

Record completion of training. Keep the records with the tool inventory so you can show you acted to support AI literacy if regulators ask.

Logging, monitoring and incident handling

Require users to log use of high risk or customer facing AI tools. The log can be a short form that captures tool name, dataset type used, purpose and date.

Monitor for misuse. IT should run periodic spot checks. HR should handle misuse under existing disciplinary policies.

Decide the incident response steps. Ensure incidents are escalated to IT and the person responsible for data protection. Keep simple timing targets for response and review.

Policy language to avoid legal pitfalls

Do not claim compliance with the AI Act in the policy. Do not promise absolute safety. These are regulatory or legal matters. Instead, state clear rules for staff and the approval process.

Use plain, operational statements. Example sentence: "Do not enter names, national identifiers, health data or other sensitive information into public chat systems." This is clear without making legal claims.

Sample clause bank you can adapt

Below are short clauses you can adapt to your policy. These are examples not legal advice.

• Purpose. "This policy sets rules for staff use of third party AI tools in the course of their work."

• Approved tools. "The list of approved AI tools is published by IT and updated monthly."

• Prohibited inputs. "Do not input personal data, special category data, confidential pricing, legal privileged documents, or any data that is not anonymised."

• Approval process. "Requests for new tools must follow the procurement checklist and be approved by IT and Data Protection."

• Training. "All staff must complete the AI awareness module before using approved AI tools for business tasks."

• Logging. "Users must record each use of AI when it involves customer or candidate data."

• Monitoring and sanctions. "IT will run periodic audits. Misuse may result in disciplinary action."

Checklist table of policy sections

Example workflows for common tasks

1. Approving a new chatbot for customer support.

• Business owner requests tool with a clear use case.

• IT checks vendor security and retention.

• Data Protection checks what customer data will be processed and documents mitigations.

• HR ensures support staff complete required training.

• Approval recorded in the tool inventory.

2. A developer wants to use an LLM for code suggestions.

• Developer requests access to the approved coding assistant.

• IT confirms account provisioning and required settings.

• Developer completes coding assistant safety checklist.

• Use logged when proprietary snippets are involved.

Record keeping that helps with AI Act scrutiny

Keep a short tool inventory. The inventory should record: tool name, vendor, permitted uses, approval date, business owner, training status, and link to the logged approvals. Keep the inventory in a central place that is backed up and access controlled.

The European AI Office will publish codes of practice and may request information to assess systems. Keeping this inventory will make those requests easier to answer. For the Office’s role and resources see European AI Office | Shaping Europe’s digital future.

Common questions HR and managers ask

Q. Do we need a separate policy for recruitment AI?
A. Recruitment tools raise special risks such as discrimination. Consider a specific addendum for recruitment tools. Article 26 of the AI Act addresses recruitment and selection. See our HR guide at /blog/comply/recruitment-ai-eu-ai-act-article-26-hr for more practical pointers.

Q. How often should we update the approved tools list?
A. Update whenever you add a new tool and do a formal review at least annually. Keep ad hoc reviews for security issues.

Q. Can staff use AI in private chats for work related tasks?
A. The policy should clearly prohibit use of unauthorised consumer accounts for business tasks. Require use of company accounts where possible.

Q. Who enforces the policy?
A. HR enforces behavioural rules. IT enforces technical controls. Data Protection oversees sensitive inputs and escalations.

Rolling out the policy in four steps

1. Draft a one page policy and the approved tools list.

2. Run a 30 minute consultation with IT, HR and the data protection person to test the controls.

3. Publish the policy and assign training.

4. Start logging approvals and run your first audit at three months.

If you want a short method to build a tool inventory quickly, see our 30 minute inventory post at /blog/comply/eu-ai-act-ai-system-inventory-30-minutes or the implementation checklist at /blog/comply/ai-inventarisatie-mkb-30-minuten.

When you should get external help

Get external help when the tool will process large amounts of personal data, when you think the system might be high risk under Annex III, or when you lack an internal data protection resource. The EU AI Act sets out obligations that depend on risk categories and some high risk rules are phased in over time. For timelines and the staged application of the Act, consult the implementation timeline at Implementation Timeline | EU Artificial Intelligence Act.

Final checklist before you publish the policy

• Short approved tools list is published.

• Plain language no go data list is included.

• A named small review team is assigned.

• Template approval record and tool inventory exist.

• Short role based training is ready and scheduled.

• Logging and incident steps are defined and owned.

Closing notes and resources

The AI Act makes literacy and governance part of what deployers must do. Article 4 requires measures to support AI literacy among staff. See the text at Article 4: AI literacy. The Commission also encourages early preparation through the AI Pact. See AI Pact | Shaping Europe’s digital future. Practical privacy and data protection concerns have featured in recent work by supervisory authorities. See the EDPB ChatGPT Taskforce report at Report of the work undertaken by the ChatGPT Taskforce | European Data Protection Board.

A short, focused AI acceptable use policy protects your data and helps you meet the AI Act literacy and transparency expectations. It is a governance document and a staff safety tool. Keep it short, keep it live and keep the approvals simple.

For a practical compliance review and help turning this checklist into an operational policy, start here. Take the free EU AI Act check