Sample AI Policy & Risk Pack: European Union
Excerpts from all 8 documents of a real pack, generated for a fictional online retailer in Germany with 80 staff that uses Shopify Magic, Google Gemini, DeepL, an AI customer-service chatbot and a demand forecasting tool.
The excerpts are copied word for word from the generated pack. We've left parts out for length, but haven't reworded anything. Your pack is written from your own answers, so it will differ.
Generated on 30 October 2026. A starting point for your organisation to review and adopt, not legal advice.
1. AI Acceptable Use Policy
Which tools staff may use, for what, and with which data.
Approved AI tools and how they may be used
Only the tools below are approved. Each entry states what the tool may be used for, what it must not be used for, and what information it may and must never receive. The data rules here are the same as those in the AI Tool Inventory and MUST NOT be applied more loosely in practice.
Shopify Magic
- May be used for: drafting and editing product descriptions inside the store platform, using product data supplied by the Product Content Lead.
- Must not be used for: stating materials, dimensions, weather resistance, load ratings or care instructions that do not appear in the product data.
- May receive: product data.
- Must never receive: customer names, customer addresses, order history, customer orders or sales history.
Google Gemini
- May be used for: drafting marketing copy, and summarising internal material for the marketing and product content teams.
- Must not be used for: drafting replies to individual customers, or producing any text that contains a customer identifier.
- May receive: product data and aggregated sales history with no customer identifiers.
- Must never receive: customer names, customer addresses, order history or customer orders.
Prohibited uses
- Making any final decision that affects a customer's money, account or access on the basis of AI output alone. A refusal of a refund, a refund amount that departs from the published policy, or a decision not to honour a customer's order MUST have documented human review.
- Entering customer names, customer addresses or order history into any tool outside the data rules above. Pasting customer details into Google Gemini to draft a complaint reply is a breach of this policy, even where the intention is to save time.
- Publishing a product claim that is not supported by product data, such as describing a garden tool as weatherproof without a test or specification on file.
Excerpt. Other parts of this document are left out.
2. AI Risk Checklist
Yes/no questions across ten risk areas, each with the action to take if the answer is no.
Data privacy
- Are customer names and addresses kept out of Google Gemini, including when staff draft complaint replies? If no: the staff member MUST stop the session and delete the content, and the incident is reported to the Operations Manager within one business day (Marketing Manager to brief the team).
- Does the AI customer-service chatbot receive only product data and the logged-in customer's own order status, with no other customers' names, addresses or order history? If no: the IT and Systems Lead restricts the chatbot's data feed to that set and confirms the change in writing to the Operations Manager.
- Has the IT and Systems Lead completed the quarterly access review of every account with Shopify admin or chatbot access? If no: the review is carried out now, removing any account no longer needed, and the result is recorded for the Data Protection Lead.
Excerpt. Other parts of this document are left out.
3. AI Risk Register
15 risks in this pack, drawn from the organisation's own AI use. Three are shown. Also downloadable as an Excel file.
| Risk description | Context / Relevance | Potential impact | Likelihood | Existing or recommended controls | Owner |
|---|---|---|---|---|---|
| R1: Chatbot states a return window that differs from the published returns policy, so customers expect refunds that are not due. | The AI customer-service chatbot answers first-line website enquiries and may draw on outdated returns wording. | Unplanned refunds, customer disputes and loss of trust in the returns policy. | Medium | Customer Service Lead samples 20 chatbot transcripts monthly, checks return-window statements against the published returns policy and corrects the chatbot source text. | Customer Service Lead |
| R2: Shopify Magic describes a garden tool as weatherproof or durable without supporting product data. | Shopify Magic drafts product descriptions inside the store platform, and feature claims may be inferred rather than taken from supplier specifications. | Inaccurate product pages, returns for unmet expectations and damage to customer trust. | Medium | Product Content Lead checks every new or changed Shopify Magic product page before publication, 100% per page; unsupported claims **MUST** be removed. | Product Content Lead |
| R3: DeepL mistranslates a material or dimension on a French product page, so the customer receives incorrect product information. | DeepL translates product pages and customer-facing text, and technical terms and units can change meaning in translation. | Wrong product expectations, returns and complaints in the affected language market. | Medium | Marketing Manager checks 10 DeepL-translated product pages per language against source text monthly, with materials and dimensions checked first. | Marketing Manager |
Excerpt. Other parts of this document are left out.
4. Transparency & Disclosure Notices
When to tell customers, staff and suppliers about AI use, with wording to adapt.
Ready-to-use notice wording
Website chatbot notice:
You are chatting with an automated AI assistant. It can answer questions about our products, delivery and returns, and shows the status of your own order. It cannot access other customers' details. If it cannot resolve your question, it passes your enquiry to a member of our Customer Service team. Information about returns is guidance only, and our published Returns Policy applies.
Customer-service email footer:
This reply was prepared with AI assistance and sent by a member of our Customer Service team.
Excerpt. Other parts of this document are left out.
5. Rollout Plan and Adoption Guide
Why the pack exists, who owns it, and what to do in the first 30 days, within 90 days and ongoing.
Purpose of this pack
Product pages, customer replies and refund decisions in this business now draw on AI. Shopify Magic drafts product descriptions, DeepL translates product pages, Google Gemini supports marketing and internal summaries, the AI customer-service chatbot answers first-line enquiries, and a demand forecasting and refund and stock suggestion tool proposes stock levels and refunds. This pack sets out which tools may be used for which work, what information each may receive, who checks the output, and how problems are reported and corrected.
First 30 days
- Confirm the name of the demand forecasting and refund and stock suggestion tool and record it in the AI Tool Inventory (Owner: Operations Manager)
- Create and maintain an inventory of all AI tools in use, starting with Shopify Magic, Google Gemini, the AI customer-service chatbot, DeepL and the forecasting tool (Owner: Operations Manager)
- Assign ownership for each AI tool and its associated risks, as set out in the AI Tool Inventory (Owner: Operations Manager)
- Check every new or changed Shopify Magic product page before publication, 100% per page (Owner: Product Content Lead)
- Document chatbot escalation triggers and confirm that each escalation is passed to staff (Owner: Customer Service Lead)
Excerpt. Other parts of this document are left out.
6. AI Tool Inventory
Each approved tool with its uses, owner, data rules and review frequency.
| Tool | Approved uses | Business owner | Data rules | Review |
|---|---|---|---|---|
| Shopify Magic | Drafting and editing product descriptions inside the store platform. | Product Content Lead | May: product data; Never: customer names, customer addresses, order history, customer orders or sales history. | Every new or changed product page checked before publication (100%, per page); vendor review annually (IT and Systems Lead). |
| Google Gemini | Drafting marketing copy; summarising internal material for the marketing and product content teams. | Marketing Manager | May: product data and aggregated sales history with no customer identifiers; Never: customer names, customer addresses, order history or customer orders. | Every marketing draft checked before publication (100%, per draft); vendor review annually (IT and Systems Lead). |
Excerpt. Other parts of this document are left out.
7. Staff Acknowledgement Form
Signed by each person before they first use an AI tool.
I confirm that I have read the AI Acceptable Use Policy and that:
- I will use only Shopify Magic, Google Gemini, the AI customer-service chatbot, DeepL and the demand forecasting and refund and stock suggestion tool, and no other AI tool, unless the Operations Manager has approved it first.
- I will never enter customer names, customer addresses, order history or customer orders into any AI tool.
- I will not enter sales history into Shopify Magic or DeepL, and I will enter sales history into Google Gemini only in aggregated form with no customer identifiers.
- I will enter product data only into the tools the AI Acceptable Use Policy permits, and I will not use product data from outside the approved product records.
Name: ____ Role: ____ Signature: ____ Date: ____
Excerpt. Other parts of this document are left out.
8. Management Summary
One page for leaders: the main risks, the decisions needed and the review dates.
The most significant risks in the AI Risk Register are:
Leadership needs to decide the following now:
- Adopt this pack and approve the tool list: Managing Director.
- Confirm the name of the demand forecasting and refund and stock suggestion tool: Operations Manager.
- Approve any new use that affects refunds or customer personal data: Managing Director.
Excerpt. Other parts of this document are left out.