Skip to main content
Praxikon
Free check

Free template · Word · English and Dutch

AI acceptable use policy template for employees (Word)

An AI acceptable use policy sets out which AI tools staff may use for work, which information may go into them and what staff do when publishing or when something goes wrong. It turns the organisation's obligations as provider or deployer under the AI Act (Articles 4, 5 and 50) and as controller under the GDPR into everyday rules.

Last checked against the law
Editor
, jurist, privacy and AI
Version and template ID
2.0 · praxikon:template:acceptable-ai-use-policy
Legal basis
Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744; Regulation (EU) 2016/679 (GDPR)

Who is this template for?

  • Management board and HRAdopt the policy as employer and as deployer (Article 4 AI Act, and Article 26 for high-risk AI systems from 2 December 2027)
  • Owner of AI governanceLinks the list of approved tools to the AI register and records the AI literacy measures (Article 4 AI Act)
  • Data protection officer or privacy officerOversees the lawful basis, information to staff and DPIA for the organisation as controller (Articles 6, 13 and 35 GDPR)
  • IT and information securityConfigures tools, access rights and retention using the checklist in Annex A (Articles 28 and 32 GDPR)
  • CommunicationsLabels deep fakes and AI text for the public on behalf of the organisation as deployer (Article 50(4) AI Act)
  • Employee representativesAre informed, consulted or asked for consent on monitoring, as national law requires (in the Netherlands Article 27(1)(k) and (l) WOR)

What is inside

  • The rules at a glance: ten rules on one page that you can circulate on their own
  • Section 2: list of approved tools with purpose, permitted information and owner, plus the rule that a new purpose needs permission first (Article 25(1)(c))
  • Section 3: table per type of information and type of tool, including special category data and national identification numbers (Articles 9, 10 and 87 GDPR)
  • Section 4: personal accounts and own devices, with a fictional personal data breach (Article 33 GDPR)
  • Section 5: AI note-takers and recordings, with the prohibition on emotion recognition of employees (Article 5(1)(f))
  • Sections 6 and 7: AI agents and the AI assistant in the office suite, with the notice for AI interaction (Article 50(1))
  • Section 8: checking and publishing AI outputs, with a labelling table for Article 50(4)
  • Section 9: what is never allowed (Article 5) and what needs prior permission (Annex III, Article 22 GDPR)
  • Sections 10 and 11: AI literacy measures (Article 4) and reporting
  • Sections 12 to 14: monitoring and employee representatives, consequences of breaches, review and acknowledgement by staff
  • Annex A: checklist before rollout for IT, information security and the drafter

How to use the template

  1. Fill in the list of approved tools from your AI register. If a tool is not in the register, it does not go on the list.
  2. Align the categories of information with the classification in your information security policy.
  3. Decide whether and how you monitor compliance, and take that to your employee representatives and DPO before the rollout.
  4. Go through the checklist in Annex A with IT and information security so the rules work in practice.
  5. Have the policy approved, announce it to all staff and contractors, and keep the read acknowledgements as evidence of your measures under Article 4.

Common mistakes

  • A blanket ban on personal data in AI tools while the business assistant works with it every day. Set rules per type of information and per tool.
  • Labelling every AI output. Article 50(4) requires a label for deep fakes and for text published to inform the public on matters of public interest, not for every email or product description.
  • Introducing logging or prompt review without involving employee representatives and without a DPIA.
  • Making staff sign for 'compliance' or demanding a certificate. Article 4 requires measures from the organisation, not a specific level per person.
  • Forgetting AI features that a supplier adds to existing software. Those need approval too.

Prefer to work online? AI disclosure texts to copy, per channel

When do you need legal advice?

  • You want to monitor how staff use AI. For example, reading prompts or logging use per employee. As controller you need a lawful basis and often a DPIA (Articles 6 and 35 GDPR). As employer you usually have to involve employee representatives under national law; in the Netherlands the works council must consent (Article 27(1)(k) and (l) of the Works Councils Act, WOR).
  • A tool is going to select or assess people. That often falls under Annex III, point 4: the organisation is then the deployer of a high-risk AI system (Article 26, from 2 December 2027), and Article 22 GDPR already applies to decisions based solely on automated processing. Inferring the emotions of employees or job applicants is prohibited, except for medical or safety reasons (Article 5(1)(f)).
  • An agent will act on your behalf towards the outside world. If you have an agent built that communicates with customers or the public under your own name, you may be the provider yourself for Article 50(1). That determines who arranges the AI notice and what you agree with the supplier.

Frequently asked questions

Does the AI Act require an AI acceptable use policy?

Not as a separate document. The obligations rest on the organisation as provider or deployer: the Article 5 prohibitions and the Article 4 AI literacy obligation (now a duty to take measures) have applied since 2 February 2025, and the Article 50 transparency obligations since 2 August 2026. An acceptable use policy is a practical way to carry out and evidence those obligations in everyday work.

May staff use a free AI chatbot with a personal account?

Not for non-public work information. Without a contract with the supplier, the organisation as controller cannot meet its GDPR obligations, such as a data processing agreement (Article 28 GDPR). If personal data are entered, it may be a personal data breach that the organisation must notify to the supervisory authority without undue delay and, where feasible, within 72 hours, unless it is unlikely to result in a risk (Article 33 GDPR).

Does all AI-generated text need a label?

No. Since 2 August 2026 the deployer must disclose deep fakes, and text published to inform the public on matters of public interest, unless that text has undergone human review or editorial control and someone holds editorial responsibility (Article 50(4)). Machine-readable marking is an obligation of the provider of the tool (Article 50(2)).

Do employee representatives have a say?

Often, when the organisation monitors how staff use AI. National law decides whether that means information, consultation or consent; in the Netherlands the works council must consent (Article 27(1)(k) and (l) WOR). From 2 December 2027, a deployer that is an employer informs workers' representatives and affected workers before using a high-risk AI system at the workplace (Article 26(7)).

May a meeting tool measure the mood of participants?

Not for employees, interns or job applicants. Inferring emotions in the workplace has been prohibited since 2 February 2025, except for medical or safety reasons (Article 5(1)(f)). For customers it is not prohibited, but it is a high-risk AI system (Annex III, point 1(c)) and the deployer must inform the people exposed to it (Article 50(3)).

Do staff need an AI certificate?

No. Since the amendment of 27 July 2026, the organisation takes measures to support the AI literacy of its staff, taking into account their knowledge, the context and the people on whom the AI is used. The law does not require a specific level per person and prescribes no course, test or certificate (Article 4).

Use and credit

You may use, adapt and share this template freely, including within your organisation, provided the credit 'Source: Praxikon' with the link to this template stays in place.

How to cite this template: Source: Praxikon, AI acceptable use policy template for employees (Word), version 2.0, as of 6 October 2026, https://www.praxikon.com/en/templates/acceptable-ai-use-policy

This template is a tool, not legal advice for your situation. It reflects the law as of 6 October 2026. Legislation, guidance and supervisory practice may change after that date. Using this template does not guarantee compliance: applying it in your organisation remains your own responsibility.

Praxikon is a trade name of Embed AI · Chamber of Commerce 90283597