Skip to content
SSyntalith
PLEN
Book a review

Template to copy · legal status as of October 14, 2026

AI policy in the company: a template to copy

Ten paragraphs, a tool register, a data table and a one-page team version. You complete the fields in square brackets, give the text to the managers to read and accept it by order. The entire pattern is on this website, without a form and without providing an e-mail address.

Go to patternDownload DOCX
  • 10 paragraphs and 3 annexes
  • AI Act after changes from Regulation (EU) 2026/1744
  • GDPR: art. 28, 32 and 33
  • To be read by a lawyer before being accepted

Development: Artem Lisovtsov, engineer, Syntalith · Legal status:

What should a company's AI policy include?

Short answer

The company's AI policy describes what AI tools the team uses, what data can be entered into them, who approves the new tool and how the company documents employee competences under Art. 4 AI Act. Our template has 10 paragraphs and 3 attachments: tool register, data classes and team version. Takes into account changes from Regulation (EU) 2026/1744. The pattern is free.

Statistics

AI policy and data in companies: statistics 2026

Figures checked: October 22, 2026

What applies today

Terms that the policy organizes in one document

The AI Act does not require a document called an “AI policy.” It requires actions that can be most easily demonstrated by written rules, a register of tools and a list of trained people. Below are the terms important for a typical company that uses ready-made AI tools.

  1. 2 lutego 2025

    Art. 5 AI Act: prohibited practices, including systems that recognize people's emotions in the workplace.

    Pattern paragraph: § 5
  2. 2 lutego 2025

    Art. 4 AI Act: activities supporting AI competences of people who use AI in the company. From July 27, 2026, the regulation does not require guaranteeing a specific level of knowledge.

    Pattern paragraph: § 8
  3. 2 sierpnia 2026

    Art. 50 AI Act: information that the customer is talking to AI, and marking realistic images and recordings, as well as texts about public affairs.

    Pattern paragraph: § 6
  4. 28 October 2026

    Act on artificial intelligence systems (Journal of Laws 2026, item 1003): provisions on inspections and penalties come into force in Poland. The supervisory body is the Commission for the Development and Security of Artificial Intelligence.

    Pattern paragraph: entire document
  5. 2 grudnia 2027

    Obligations for high-risk Annex III systems, including AI in staff recruitment and assessment. The deadline was extended by Regulation (EU) 2026/1744.

    Pattern paragraph: § 5
  6. in force

    GDPR: data processing agreement with the tool supplier (Article 28), security measures (Article 32) and reporting the violation to the President of the Personal Data Protection Office within 72 hours (Article 33).

    Pattern paragraph: § 2, § 3, § 9

As of October 14, 2026. The content is for informational purposes only and does not replace legal advice.

Formula

Full text of the policy

Fill in the fields in square brackets with your company data. The comment next to each paragraph suggests what to enter. You do not transfer comments to the accepted document.

Download DOCX

Version [1.0] as of [date]. Adopted by [order/resolution] by [management board/owner].

Policy on the use of artificial intelligence tools at [company name]

  1. § 1Purpose and scope

    1. The policy sets out the rules for using artificial intelligence tools (hereinafter: AI tools) when working for [company name].
    2. The policy applies to employees, collaborators under civil law and B2B contracts, apprentices and interns (hereinafter: people working for the company), regardless of whether they use company or private equipment.
    3. An AI tool is any program or function that creates text, image, sound, code or a summary or suggests a decision, including when it is part of another program, such as an office suite, email or CRM.

  2. § 2Approved tools and accounts

    1. To work for the company, we only use tools entered in the AI Tools Register (Appendix No. 1) on company accounts.
    2. We do not use private accounts in AI tools, including paid ones, for company matters.
    3. The new tool reports to [person or address]. We will respond within [5] business days. Until the decision is made, we do not use the tool with company data.
    4. The tool is entered into the register after checking: the contract with the supplier, including the data processing contract if the tool is to process personal data; settings for training models on our data; places of data processing; how to delete history.

  3. § 3Data

    1. We divide the data into three classes described in Annex 2: public, internal and protected.
    2. Public data can be entered into any tool from the register.
    3. We only enter internal data into tools from the register, on the company account.
    4. We enter protected data only into tools that the register explicitly allows for a given category of data. In other cases, we remove identifying information before entering it or perform the task without AI.
    5. If in doubt, we treat the data as protected and ask [the person].

  4. § 4Performance review and accountability

    1. The person who uses them is responsible for the text, code, analysis or decision prepared with the help of AI.
    2. Before sending externally or using in a decision, we check the result in the source, in particular numbers, names, quotes and recipes.
    3. Content for a client, office or partner, and any content that creates a company commitment, is approved by a human.

  5. § 5Uses requiring consent and prohibited

    1. Without the consent of [the management/person], we do not use AI to select and evaluate candidates and employees, make decisions about remuneration, promotion or termination of cooperation, assess the financial credibility of customers or other decisions that significantly affect people. The tool's result cannot be the sole basis for such a decision.
    2. We do not use practices prohibited in Art. 5 AI Act, including systems that recognize the emotions of people in the workplace.

  6. § 6Tagging content and conversations with AI

    1. A customer who talks to our chat or voicebot learns at the beginning of the conversation that he or she is talking to an AI system.
    2. We mark an image, recording or audio generated or altered by AI that could be mistaken for real upon publication.
    3. We mark a text about public affairs prepared by AI, unless it was edited by the person responsible for the content before publication.

  7. § 7Content and image rights

    1. Before publishing materials prepared with the help of AI, we check whether they do not duplicate other people's works, trademarks or people's images.
    2. We do not generate the image or voice of real people without their consent.
    3. We do not introduce materials into AI tools that the contract or license does not allow for processing in this way.

  8. § 8Competencies and training

    1. Everyone using AI receives onboarding training within [30] days of starting work or gaining access to the tool, followed by a refresher [once a year].
    2. At a minimum, the training covers: how the tool works, common errors, data that should not be shared, and how to report a problem. People who configure or are responsible for the tools go through a broader program.
    3. [The person] keeps a register of training: who, when and to what extent.

  9. § 9Incidents

    1. We immediately report to [person or address] and supervisor: entering protected data into an unauthorized tool, a significant error in the AI result used externally or in a decision, suspected data leakage and unusual operation of the tool.
    2. Reporting in good faith is not grounds for punishment. Concealing an incident is a violation of policy.
    3. If the incident concerns personal data, [person / data protection officer] assesses whether it is necessary to report the breach to the President of the Personal Data Protection Office. You have 72 hours to report a violation.

  10. § 10Policy guardian, review and violations

    1. [position, name and surname] (Policy Supervisor) is responsible for the policy and the register of tools.
    2. The custodian reviews the policy and register every [6] months and after a significant change in regulations, changes to the plan or terms of the utility and after any incident.
    3. Violation of the policy may result in consequences provided for in the contract or labor law.

Appendix No. 1. Register of AI tools

One line is one tool on one plan. The lines below are examples and replaceable.

Appendix No. 1. Register of AI tools
Tool and planTo whatAllowed dataEntrustment agreementTraining on our dataGuardianReview
[chat assistant, company plan]sketches, translations, summariespublic, internal[signed / not applicable][disabled][person][date]
[AI functions in the office suite]meeting notes, document summariespublic, internal, [protected: indicate categories][signed][disabled][person][date]
[chat for customers on the website]answers to questions about the offerpublic[signed][disabled][person][date]

Training settings and plan conditions change several times a year. Therefore, each row has a review date.

Appendix No. 2. Data classes

Appendix No. 2. Data classes
ClassExamplesWhere can I enter?
Publiccontent from our website, published offers and price lists, general questions without company detailsevery tool in the registry
Internalinternal sketches and notes, procedures without personal data, reports without customer namestools from the registry, company account only
Protectedpersonal data of customers and employees, health data, content of contracts, non-public financial data, code and configurations, passwords, keys and tokens, data entrusted by customersonly a tool that the registry allows for this category

Annex No. 3. Confirmation of reading

I confirm that I have read the Policy on the use of artificial intelligence tools at [company name] version [1.0] and will comply with it.

Name
Date
Signature

Team version

The same policy on one page

The full document is approved by the management board. The team only needs seven rules that can be pinned on the company channel or printed out.

Principles of working with AI at [company name]

  1. 01Use the tools from the list: [registry link]. Always on your business account.
  2. 02Do not enter personal details, contracts, passwords or customer details unless the list specifically allows it.
  3. 03Check the result before it goes out to the client. Verify numbers, names and recipes from the source.
  4. 04You are responsible for the text sent. The tool prepares a sketch.
  5. 05AI in decisions about people, such as recruiting or job evaluation, requires [the person's] consent.
  6. 06Need a new tool? Write to [person]. You will receive a response within [5] business days.
  7. 07Something went wrong? Report it immediately to [person]. There is no penalty for reporting.

Questions: [person], [contact]. Full policy: [link].

Admission in 4 weeks

How to adopt a policy so that the team follows it

  1. Week 1

    An inventory of what already works

    Ask the team anonymously what AI tools they use, on which accounts and for what. Enter the results into the working version of the register.

  2. Week 2

    Decisions about tools and data

    Select company tools and establish data classes. If people are working on private accounts because the company tool is missing, plan to purchase it before adopting the policy.

  3. Week 3

    First version

    Complete the template and give it to three or four managers to read. Ask which provision is blocking their work. When it comes to personal data and HR, ask for the opinion of a lawyer or data protection inspector.

  4. Week 4

    Reception and training

    Adopt the policy in the form used in the company, publish it in a well-known place, collect confirmation of reading it and conduct the first training. Write down who participated.

When the pattern itself is not enough

Four situations that require separate analysis

  • AI in recruitment or employee assessment

    These are high-risk systems. From December 2, 2027, separate requirements apply to them, including informing employees before launching the system.

  • Chat or voicebot for customers

    In addition to marking the conversation, you need to determine what the bot can promise, when it hands over the matter to a human, and how long it stores conversations.

  • Professional secrecy and health data

    Law firms, medical facilities, accounting offices and insurers have industry-specific regulations. Data classes must be agreed with your lawyer.

  • Your own AI system shared with others

    A company that builds an AI system and offers it to customers may be its supplier within the meaning of the AI Act. There are more responsibilities than when using ready-made tools.

Policy and training

The policy works when the team knows how to work with AI

During team training, we work on your team's tasks and tools from your backlog. After the training, you receive a list of participants and a description of the scope for the training register from § 8. If you first want to determine where to start, arrange a free analysis: 30 minutes with an engineer and a written summary within 2 business days.

AI training from €1,150 net per day

Book a free process review (30 min)Team training program

Questions about AI policy

  • Does the AI Act require a company to have an AI policy?

    Not directly. The AI Act does not contain a provision that mandates a document by that name. It requires actions to support AI competences (Article 4), reporting on conversations with AI and marking certain content (Article 50), and compliance with prohibitions (Article 5). GDPR requires organizational measures to protect data. A written policy with a register of tools and training is the easiest way to demonstrate these activities.

  • Does a small company also need an AI policy?

    If your team uses AI at work, yes. In a company with a dozen or so people, two pages are enough: a list of tools, three data classes, checking results and a contact person. The template can be shortened to paragraphs 2, 3, 4, 9 and 10.

  • Can an employee use a private ChatGPT account for work?

    According to this formula, no. A private account means there is no company contract with the provider and no control over your conversation history. Such a ban works when the company gives the team a tool on the company account. Without this, work is transferred to private accounts outside the company's knowledge.

  • Who adopts the policy and do work regulations need to be changed?

    The policy is adopted by the management or owner, in the form used in the company, for example by ordinance. It is not necessary to change the work regulations, but a brief mention of the obligation to comply with the policy clarifies the issue of violations. The regulations are changed according to the procedure applicable in the company.

  • How often should you update your AI policy?

    Every six months and after changes in regulations, changes in the tool plan and after each incident. AI tools change privacy terms and settings more frequently than typical software.

  • Is this template legal advice?

    No. This is a working template prepared by the implementation team, with the legal status as of October 14, 2026. Before accepting it, have it read by a lawyer or data protection inspector, especially if AI has access to personal data, HR matters or information covered by professional secrecy.

Sources

Tell us what your team is already using AI for.

In 30 minutes we will determine which tools are worth approving, what the training should cover and what can be automated. You will receive a written summary within 2 business days, regardless of your decision.

  • A 30-minute call with the engineer who would lead the work.
  • A review of the processes that cost you the most time and money.
  • A written summary: what the process costs you per year, what to automate first and from what price.
€030 minutes · written takeaway within 2 business days
Book a free process review (30 min)

Times are shown in your own time zone. We work with clients across time zones.

The review chooses one process to assess, and within 2 business days you receive a recommendation, including when a simpler route is the better fit.

AI training for teams

What our OpenAI and Anthropic partnerships mean for you.

OpenAI makes ChatGPT and Anthropic makes Claude. We belong to the partnership programs of both companies, so we work with their tools every day and learn from the creators themselves.

OpenAI Select PartnerClaude Partner Network
01We will select a tool for the task
We implement both ChatGPT and Claude. We check both on your documents, and you choose the one that makes fewer corrections and saves more time.
02Knowledge straight from the creators
We learn from official OpenAI and Anthropic courses and materials. Your team learns about the features and settings that work today.
03Licenses without our margin
You buy accounts directly from OpenAI or Anthropic and receive an invoice from them. We do not add anything to the license.
04Certified engineers
On the team, we have an AWS certification in machine learning and an Anthropic certification in systems architecture on Claude.

Participation in programs does not mean that OpenAI or Anthropic endorses our services.