In brief
An AI policy defines which AI tools are permitted in the organisation, which data may be entered, how results are checked and labelled and who is responsible. It is the foundation of AI governance and is best combined with AI literacy training.
Checklist: what belongs in an AI policy
| Topic | Key question |
|---|---|
| Scope | Who and which activities does the policy apply to? |
| Permitted tools | Which AI tools are approved, which are explicitly not (e.g. private accounts)? |
| Data | Which data may be entered – and which never (personal data, trade secrets, customer data without approval)? |
| Checking results | Who checks AI results before they are used or passed on? |
| Labelling | When is AI-generated content labelled, for example towards customers? |
| Copyright and usage rights | How are rights to inputs and results handled? |
| New applications | How are new AI tools requested, assessed and approved? |
| Responsibilities | Who is the contact person, who decides, where are incidents reported? |
| Training | Which AI literacy measures exist and how are they documented? |
| Review | When is the policy reviewed – at least annually or when new tools are introduced? |
Typical mistakes
- Blanket ban: Often leads to hidden use of private accounts (“shadow AI”) – worse than clear rules.
- Too long and legalistic: A policy nobody reads protects nobody.
- No tool list: Employees do not know what exactly is permitted.
- Created once and forgotten: AI tools change quickly – the policy needs a review cycle.
We support you
We create your AI policy to match the tools and processes you actually use, align it with data protection and IT and combine it with training and the approval process. The starting point is the free assessment.
Last updated: September 2026 · Author: Dipl.-Ing. (FH) Herbert Schrank