AI München
DEEN
Free AI Scan
Menu
ServicesInsightsAboutFAQContactFree AI Scan

AI policy for employees: what to include and how to introduce it

Which rules a company AI policy should contain, how it fits the AI literacy duty under Art. 4 AI Act and how to embed it in your team.

Compliance3 min readBy AI München

Key points
  • Many employees already use AI tools, often without rules.
  • A policy covers tools, data, review, transparency and accountability.
  • Together with training, it helps implement the duty under Art. 4 AI Act.

An AI policy defines which AI tools your employees may use for what, which data is off-limits and how results are checked. It creates certainty for the team and the company, and together with training it is the usual way to implement the AI literacy duty under Art. 4 AI Act, which has applied since February 2025.

Why you need a policy

In many companies, employees already use AI tools on their own: to draft emails, summarise documents or translate. Without rules, confidential information quickly ends up in tools whose data processing no one has checked. According to Bitkom, 66 percent of companies also rate their employees' AI skills as low.

What belongs in an AI policy

  1. Approved tools: which AI applications may be used, and which may not?
  2. Purposes: what is AI allowed for, such as drafts, summaries and research, and what not?
  3. Data: which information must never go into an AI tool, such as customer data, HR data or trade secrets?
  4. Review duty: AI output is checked by a person before use.
  5. Transparency: when is AI use disclosed to customers, for example with chatbots?
  6. Accountability: who is the contact for AI questions and for approving new tools?
  7. Training: who must complete which training, and how is it documented?

How to introduce the policy

  1. Inventory: ask anonymously which tools are used today.
  2. Draft: keep the policy short and concrete; two to three pages are often enough.
  3. Alignment: involve data protection and, where applicable, the works council.
  4. Training: explain the rules with examples from daily work.
  5. Review: update the policy when new tools or rules arrive.
Tip: Bans alone rarely work. Provide an approved, secure tool at the same time, so the team doesn't fall back on private accounts.

We draft your AI policy and train your team: more on AI training & AI Act compliance. Also read AI Act 2026 or request the free AI Scan.

This article is general information and not legal advice.

Frequently asked questions

Does every company need an AI policy?

It is not explicitly required by law, but together with training it is the usual way to implement the AI literacy duty under Art. 4 AI Act and reduce risk.

What belongs in an AI policy?

Approved tools, permitted purposes, data rules, review duty, transparency, responsibilities and training.

Does the works council need to be involved?

If AI tools are capable of monitoring behaviour or performance, the works council usually has co-determination rights in Germany. Involve it early.

Where does AI deliver the most for your company?

Request the free AI Scan: describe your processes in the form and we reply with a written assessment by email. No appointment, no phone call.

Request AI Scan
Free AI Scan