AI has arrived in everyday work; the written rules for it often have not. That is the gap an internal policy fills: it tells your team which tools are approved, which data never belongs in an AI window, and who is responsible when something goes wrong.
Answer the eight questions below. You receive a finished Word document straight away, ready for you to continue writing. Free of charge, no sign-up. Everything runs in your browser — your entries do not leave your device.
Every field already carries a sensible default. Change what differs at your company — you can leave the rest as it stands.
Appears in the title and in every section of the policy.
From when the policy applies within the company.
Name and position. This person decides on new tools and receives reports.
Email or telephone number on which they can be reached day to day.
One tool per line. Do include the small helpers — anything not on the list counts as not approved.
One point per line. The first two lines concern applications the Regulation classifies as high-risk, which is why they must not be introduced in passing.
How your company marks AI content externally. In detail: labelling duty and ready-made labels.
The most important sentence in the whole policy: that a report carries no consequences. Otherwise nobody reports anything.
The policy then gains an additional section on informing and consulting employee representatives, with reference to Directive 2002/14/EC as the European minimum standard.
Please enter your company name first — it appears on every page of the policy.
The file opens in Word and can be edited straight away — headings, paragraphs and lists are preserved. For a PDF, use the second button and choose “Save as PDF” in the print dialogue.
The AI Act is currently being adjusted on several points. If something changes that affects this policy, we will send you a short note on what you should amend. Entirely optional — you already have your document.
Notes on the legal position only, cancellable at any time. No sharing with third parties.
So that you know where you stand after the download. Honesty at this point spares you unpleasant surprises later.
| Question | Does the policy cover it? | Note |
|---|---|---|
| Do your employees know which tools are permitted? | Yes | The list of approved tools is the part that matters most in practice. |
| Is it settled which data must not go into an AI tool? | Yes | Three prohibitions: personal data, trade secrets, third-party data held in confidence. |
| Is a responsible person named? | Yes | With contact details and reporting route, so that nobody has to search when it matters. |
| Is labelling under Article 50 governed? | Yes | As an internal rule. Applying it in the individual case remains your task. |
| Is there evidence that your team knows the rules? | No | A policy sitting in a folder is not evidence. That takes training and acknowledgment. |
| Is AI literacy under Article 4 evidenced? | No | Article 4 requires literacy measures, not just a set of rules. Evidence is kept per person. |
| Is your company conformant as a result? | No | Conformity also depends on which systems you use and which risk tier they fall into. |
Article 4 (AI literacy) has applied since 2 February 2025. Anyone using AI in their business must ensure that the people working with it understand it sufficiently — what the system can do, where it gets things wrong, and what that means for their work.
Article 50 (transparency and labelling) has applied since 2 August 2026. Since then, AI-generated content that could be taken for real must be labelled, and people must be told when they are speaking to an AI.
Both duties apply to small companies too. Both can be met with manageable effort — provided they are written down and known within the company.
Six points decide whether a policy carries in daily work or just sits in a folder. They are the same six the form above asks for.
The most important part in practice, and the one most often missing. Many policies describe principles (“use AI responsibly”) without naming a single tool. Nobody can tell from that whether DeepL is allowed. Write the tools down by name, with the purpose behind each one — and include the small helpers. Anything not on the list counts as not approved; only then is the list worth having.
“Handle data carefully” helps nobody. Three groups belong in there by name: personal data of customers, applicants and staff; trade secrets such as calculations, contracts and source code; and anything someone entrusted to you without knowing it might end up in an AI tool. The third is almost always forgotten, and it is the one that costs trust.
Not “management”, not “IT” — a name and a phone extension. That person decides on new tools and receives reports. Without a name there is nobody to ask when it matters, and the policy becomes a text people ignore when in doubt.
The single most important sentence in the whole policy is this: nobody suffers a disadvantage for reporting a mistake. Leave it out and nobody reports anything — you hear about the incident when it can no longer be fixed. An uncertainty that has been reported is a problem solved; one that was kept quiet is a risk on a timer.
Set out what does not go out without review: anything that leaves the building, anything with numbers in it, anything legal. And set out just as clearly what needs no review — nobody has to approve a spelling correction. Policies that want everything reviewed are worked around by the second day.
Without this point the tool list is out of date in four weeks. Write down how someone proposes a new tool, who decides, and on what grounds. Two sentences will do. Leave it out and you do not get order, you get shadow AI: tools in use that nobody knows about.
What is deliberately missing from this list: penalty amounts, risk classes and declarations of conformity. They do not belong in an internal rule of use but in the assessment of your systems — a different step, with different people involved.
No. A policy is one building block, not compliance. It governs conduct inside the house. Whether your company meets the regulation as a whole additionally depends on which AI systems you use, what risk class they fall into, and whether your staff can evidence the required AI literacy.
No. The generator runs entirely in your browser. Company name, personal names and tools never leave your device. The file is created locally and saved locally.
German, English or Dutch. The language of the page determines the language of the generated document: title, sections, signature line and legal notice all appear in the language you chose. The section on employee co-determination is adapted to the corresponding legal system.
As a Word document. It opens in Microsoft Word, LibreOffice and Google Docs and is directly editable, with headings, paragraphs and bullet lists. Alternatively you can output the policy as a PDF via the print function.
Yes, and it stays that way. No sign-up, no email gate, no trial that turns into a bill. We earn on what comes afterwards: training, records and the evidence file you can hand over. A policy on its own sells badly, so it belongs in the giveaway pile.
No. It writes exactly one document: the internal rules for using AI tools at work. For HR handbooks, vacation policies, workplace rules or general staff regulations this is the wrong tool, and an HR template will serve you better. We would rather say so now than have you answer eight questions and hand you the wrong thing.
No. The template does not constitute legal advice. It is meant as a starting point and has to be adapted to the circumstances of your company. Where co-determination, data protection or high-risk applications are involved, professional review is advisable.
This is the difference most companies fall down on: a document in a folder proves nothing. What gets asked for is the record — who was trained and when, who acknowledged the rules, and can that be produced without three days of searching.
One step before that: the person you named above. They will decide on new tools and take incident reports — and they are the first to be asked whether they can judge any of it. The course is available for one person on its own: five modules, about 40 minutes, a personal certificate with a publicly verifiable ID. €49 one-off, no subscription, no term. That makes one person able to answer; it does not replace the record for your team.
Course for one person — €49 one-off
For the whole team, the KlarComply subscription produces exactly that: training with a verifiable certificate per person, an acknowledgment log for your policy, and a printable evidence file you can put on the table when it counts. You upload the policy you have just generated once — it then appears automatically in every employee’s training.
Start with a free check: where do you stand? · 10 points, 2 minutes, no sign-up
Legal notice: this page and the document it generates give general guidance on implementing Regulation (EU) 2024/1689 and do not constitute legal advice. The template does not replace legal review of the individual case and does not by itself establish conformity. Adapt it to your company before putting it into force. Where employee representatives hold consultation rights, they must be involved.
Sources: Regulation (EU) 2024/1689 — full text on EUR-Lex (Article 4, Article 50)