Skip to main content
Praxikon
Agent check

Free template · Word · English and Dutch

AI policy template for the EU AI Act and GDPR

An AI policy is the document in which an organisation records how it develops, procures and uses AI systems: who decides, which uses are prohibited, how applications are classified and registered, and which obligations under the EU AI Act and the GDPR apply to it as provider or deployer.

Last checked against the law
Editor
, jurist, privacy and AI
Version and template ID
2.0 · praxikon:template:ai-policy
Legal basis
Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744; Regulation (EU) 2016/679 (GDPR)

Who is this template for?

  • Board or management adopting the policyDecisions on high-risk applications and doubts about a prohibition (Article 5)
  • AI governance owner or compliance officerDetermining the role (Article 3(3) and (4), Article 25(1)) and the internal AI register
  • Data protection officer or privacy officerLawful basis, DPIA and automated decisions (Articles 6, 22 and 35 GDPR)
  • HR and employee representativesAI literacy (Article 4) and informing workers (Article 26(7))
  • Procurement and legalContract requirements for AI suppliers and the information under Article 13
  • Communications and chatbot ownersTransparency for chatbots, deep fakes and AI-generated text (Article 50)

What is inside

  • Decision box: provider or deployer, for each application (chapter 2)
  • Governance with roles, approval of new applications and an adoption block (chapter 3)
  • Every prohibition in Article 5, including the new prohibitions that apply from 2 December 2026 (chapter 4)
  • Seven-step classification, a table of application dates per obligation and the internal AI register (chapter 5)
  • Rules for AI assistants, AI note-takers and AI agents, with a table of which information may go where (chapter 6)
  • Article 26 obligations paragraph by paragraph and a decision box for the Article 27 FRIA (chapter 7)
  • Article 50 transparency per paragraph and role, with model texts (chapter 8)
  • AI literacy as measures per target group (chapter 9)
  • A GDPR chapter and one incident route for data breaches and AI incidents (chapters 10 and 11)
  • Minimum supplier contract requirements, an ethics check and a national context annex with the Netherlands as worked example (chapter 12, Annexes A and B)

How to use the template

  1. First map which AI your organisation uses or builds, for example with the AI register and classification workbook.
  2. Determine your role for each application with the decision box in chapter 2: provider or deployer.
  3. Fill in the fields in square brackets and delete provisions that do not apply, such as chapter 7 if you use no high-risk AI. Keep the numbering intact.
  4. Complete Annex B for your country: market surveillance authority, data protection authority, employee participation and public-sector rules.
  5. Remove the 'Note for the drafter' boxes, submit the draft to your data protection officer, information security and employee representatives, and have it adopted by the board.
  6. Review the policy at least annually, and sooner after a change in the law, a serious incident or your first high-risk system.

Common mistakes

  • Requiring a FRIA from every deployer of high-risk AI. From 2 December 2027, Article 27 only covers deployers that are bodies governed by public law or private entities providing public services, and deployers using AI for creditworthiness or for life and health insurance pricing.
  • Overlooking that you become the provider when you use a general-purpose chat assistant for an Annex III purpose, such as ranking job applicants (Article 25(1)(c)), with the obligations of the provider from 2 December 2027.
  • Confusing the internal AI register with the EU database. The AI Act does not require your own public register; registration in the EU database (Article 49) is mainly a duty of providers of Annex III systems and of public authorities that deploy them.
  • Describing Article 50 as a future obligation. It has applied since 2 August 2026; only the machine-readable marking in paragraph 2 has a transitional period until 2 December 2026, for systems placed on the market before 2 August 2026.
  • Looking only at the AI Act. When an application processes personal data, the lawful basis, DPIA and Article 22 GDPR apply too, and the GDPR often demands the most work.

Prefer to work online? AI policy generator

When do you need legal advice?

  • Your role is not clear-cut. You modify an AI system, put your name on it or use a general-purpose AI system for a purpose listed in Annex III. You may then become the provider, with the obligations of Article 16.
  • You want to rely on an exception. An application may fall under Annex III and you want to rely on Article 6(3), or the application comes close to a prohibition in Article 5, such as inferring the emotions of employees.
  • The AI helps decide about people. The application takes or supports decisions about individuals based on personal data: automated decision-making (Article 22 GDPR), special categories of personal data, or monitoring of staff that needs the consent or consultation of the works council or other employee representatives under national law.

Frequently asked questions

Is an AI policy mandatory under the EU AI Act?

The AI Act does not prescribe a document called an AI policy. You must, however, meet and be able to demonstrate the obligations of your role, such as measures for AI literacy (Article 4), transparency (Article 50) and, for high-risk AI, the deployer obligations of Article 26. An adopted policy is a practical way to organise and record this.

Does every organisation using high-risk AI need a fundamental rights impact assessment?

No. From 2 December 2027, Article 27 applies to deployers that are bodies governed by public law or private entities providing public services, and to deployers of systems for creditworthiness or credit scoring and for risk assessment and pricing in life and health insurance (Annex III, point 5(b) and (c)). Critical infrastructure (point 2) is excluded.

What did the Digital Omnibus change about AI literacy?

Since 27 July 2026 (Regulation (EU) 2026/1744), providers and deployers take measures to support the development of AI literacy of their staff and others who operate or use AI systems on their behalf. They do not have to guarantee a specific level for any individual. No course, test or certificate is prescribed; record which measures you take.

Since when does Article 50 apply to chatbots and deep fakes?

Since 2 August 2026, including existing systems. The provider ensures people know they are interacting with AI (paragraph 1) and marks generated content in a machine-readable format (paragraph 2). The deployer discloses deep fakes and certain AI-generated text (paragraph 4). Only paragraph 2 has a period until 2 December 2026, for systems placed on the market before 2 August 2026.

Can I use this template outside the Netherlands?

Yes. The policy follows the EU AI Act and the GDPR, which apply in every Member State. Supervision, penalties and employee participation are partly national, so Annex B asks you to fill in your own country. The Netherlands is included as a worked example; replace it with the rules of your own country.

May I adapt the template and share it within my organisation?

Yes. You may use, adapt and share this template freely, including within your organisation, provided the credit 'Source: Praxikon' with the link to this template stays in place.

Use and credit

You may use, adapt and share this template freely, including within your organisation, provided the credit 'Source: Praxikon' with the link to this template stays in place.

How to cite this template: Source: Praxikon, AI policy template for the EU AI Act and GDPR, version 2.0, as of 6 October 2026, https://www.praxikon.com/en/templates/ai-policy-template

This template is a tool, not legal advice for your situation. It reflects the law as of 6 October 2026. Legislation, guidance and supervisory practice may change after that date. Using this template does not guarantee compliance: applying it in your organisation remains your own responsibility.

Praxikon is a trade name of Embed AI · Chamber of Commerce 90283597