An AI policy sets the rules for how people in your organisation use AI tools: which tools, for what, with which information, and who checks the results. Here's what it should cover in the EU, and how AI is regulated there.
The EU AI Act applies in stages. Since 2 February 2025, some AI practices have been banned, and organisations that provide or use AI systems must take measures to support their staff's AI literacy.
Since 2 August 2026, people must be told when they interact with AI such as a chatbot, and AI-generated content such as deepfakes must be disclosed. Obligations for high-risk AI, such as AI used in hiring or credit, apply from 2 December 2027.
GDPR continues to apply to personal data used with AI tools.
A general summary, checked on 27 October 2026 against the sources in the regulations tracker. It isn't legal advice.
Practical training for staff who use AI, suited to their role, and a record of it.
Notices for chatbots and labels for AI-generated content that could be mistaken for real.
Whether any AI you use falls in a high-risk area, such as hiring or credit, and what that will mean from December 2027.
Which AI tools may process personal data, and what must never be entered.
Why the policy exists and who it applies to: staff, contractors, any device used for work.
Which AI tools are approved, what each may be used for, and who owns each one.
What information may go into each tool, what never may, and what must be removed first.
Uses that are off limits, with examples from your own work.
Who checks AI output before it's used, and how much, scaled to the risk.
When customers, staff or others are told that AI was used.
How to report a mistake or misuse, to whom, and how quickly.
Training before first use, a signed acknowledgement, and when the policy is reviewed.
Answer a few questions and get a short AI use policy for your organisation, free to copy or download as a Word document. No account needed.
The AI Policy & Risk Pack is written from your answers about how your organisation uses AI, for the EU. Preview every section free before you pay. It's a starting point to review and adopt, not legal advice.
Launch price for the first 20 packs sold: 13 of 20 left. Then €179.
Prices in euros. For businesses: a VAT number is needed at checkout.
High-risk AI systems listed in Annex III, such as those used in employment, credit, education and access to essential services, will have to meet requirements including risk management, human oversight and documentation. Deployers have their own duties, such as following instructions for use and monitoring the system.
People must be told when they interact with an AI system such as a chatbot, unless it's obvious, and AI-generated content such as deepfakes must be disclosed. Providers of generative AI already on the market before 2 August 2026 have until 2 December 2026 to mark its outputs.
Regulation (EU) 2026/1744 amended the AI Act. Obligations for high-risk AI listed in Annex III (such as AI in hiring or credit) now apply from 2 December 2027, and for AI in regulated products (Annex I) from 2 August 2028. It also adds a ban on AI that creates non-consensual intimate images or child sexual abuse material, from 2 December 2026.
Certain AI practices, such as manipulative techniques and some uses of biometric categorisation, have been banned since 2 February 2025. Providers and deployers of AI systems must also take measures to support AI literacy among their staff (Article 4, as amended by the 2026 Digital Omnibus).
It doesn't require a document called an AI policy. But organisations that use AI systems must take measures to support their staff's AI literacy, and a written policy with training records is a common, practical way to organise those measures.
From 2 December 2027 for high-risk AI listed in Annex III (such as AI used in hiring or credit), and from 2 August 2028 for AI in regulated products, after the 2026 Digital Omnibus postponed the original dates.
Yes. Packs for EU organisations use English with UK spelling, and prices are shown in euros. EU checkout is for businesses, with a VAT number.
