AI policy

Write it after you look, not before

The common mistake is drafting a policy for a hypothetical situation. In almost every organisation staff are already using AI tools before any policy exists, usually on personal accounts. A policy written without knowing what is actually in use regulates a company that does not exist.

So the order is: find out what is being used, then write the rules.

What a workable policy contains

• Which tools are allowed, by name, and how a new one gets approved
• What must never be entered: customer data, personnel files, anything under confidentiality, pricing that is not public
• Who decides, by role, when something falls outside the list
• Where a human must remain in control, and for which decisions that is non-negotiable
• What gets recorded, because obligations under the AI Act rest on the measures you can show you took

What makes it fail

Length. A ten-page policy is a policy nobody reads, and an unread policy changes nothing about what gets pasted into a chat window on a Friday afternoon. Two pages that people actually know beats a thorough document in a folder.

The second failure is a ban without an alternative. Prohibiting AI tools without offering an approved route pushes usage underground, where you can no longer see it.

The relationship with the AI Act

A policy is not the same as compliance. The AI Act sets specific obligations, including a duty since 2 February 2025 to ensure a sufficient level of AI literacy among people operating AI systems on your behalf. A policy is one of the measures through which you meet that duty, and it is the one that makes the rest visible.