An AI use policy for employees: generative AI at work

Short answer: Your employees probably already use generative AI — for emails, summaries, code, drafts. Without a policy "shadow AI" arises: unseen use with real risks. A use policy bounds those risks, and the AI literacy duty (Art. 4) also makes it a compliance component, not a luxury.

The four risks you cover

1. Confidentiality and personal data. Text you paste into a public AI service can leave the organisation. Trade secrets and personal data do not belong uncontrolled in external tools — that touches both secrecy and the GDPR.
2. Reliability. Generative AI invents plausible-looking nonsense. Output without human checking leads to errors in decisions, advice or publications.
3. Intellectual property. Who owns the output, and may you use training or source material? Uncertainty can produce claims.
4. Transparency. AI content toward customers or the public can fall under Article 50 (recognisability, labelling).

What a workable policy contains

• Approved tools: which AI services are allowed, which are not — preferably a secure corporate variant.
• Data rules: no confidential or personal data in public tools; what is allowed, and how.
• Human checking: always verify output before using it in decisions or externally.
• Transparency: when to disclose AI use or label content.
• Responsibility: who is the contact point, and how to report incidents.

Keep it short and concrete. A twenty-page policy goes unread; half a page with clear do's and don'ts gets read.

The literacy duty makes it mandatory

Article 4 of the AI Act requires those who work with AI to have an adequate level of knowledge. A use policy plus short training is exactly how you meet it — and how you make it demonstrable in a supervisory request. See AI literacy.

Part of your governance

A use policy does not stand alone; it is a building block of your broader AI governance framework, alongside inventory, classification and oversight.

What to do

• Draft one short, readable guideline with approved tools and data rules.
• Attach short training — that immediately covers the literacy duty.
• Offer a safe alternative so employees don't divert to public tools.
• Review periodically; the tools and risks change fast.

Banning doesn't work — employees use AI anyway. Bounding and facilitating does: a clear policy takes the risk out of the unseen use and keeps the productivity gain in.