AI Policy Template for Companies: 12 Clauses, Works Council, Training Duty [2026]

An AI policy for companies is the internal rulebook that says which AI tools employees may use, which data may go into them, who checks the output, and who decides in case of doubt. No law forces you to have one. Three laws make it very hard to be compliant without one: the GDPR (personal data in prompts), Article 4 of the EU AI Act (documented AI literacy, in force since February 2025) and, in Germany, section 87 of the Works Constitution Act (co-determination as soon as a system could monitor performance).

The reason to write it this year is not the regulator. It is that more than 60% of employees in Germany already use AI at work, most of them with tools the employer never introduced. A policy is how you turn that shadow use into sanctioned use without banning it. This article gives you the twelve clauses a working policy needs, with sample wording, the difference between a policy, a works agreement and a training programme, and the seven steps to get it signed off.

An AI policy is a unilateral instruction from the employer. It is not mandatory as a document, but it is the cheapest way to meet three obligations that are: proving AI literacy under Article 4, keeping personal data out of unapproved processors under the GDPR, and documenting what your systems do for the works council. The Bitkom implementation guide to the AI Act and the VDAA employment-law association both frame AI competence as an organisational duty: an AI inventory, a role and risk assessment per use, targeted training, and clear usage rules. The policy is where the usage rules live.

One correction to what many consultancies write: a breach of Article 4 does not carry a fixed fine. The AI Act's penalty catalogue does not list Article 4, and Germany has not added one. What starts in August 2026 is supervision by the market surveillance authorities, which means orders, audits, complaints from employees and civil liability when an unreviewed AI output causes damage. That is enough reason to have the paperwork, and no reason for the panic marketing. Our Article 4 training duty guide covers the training side; this article covers the rules.

Three documents get confused constantly, and the confusion costs months. The policy is written by the employer and binds employees through the right to issue instructions. The works agreement is negotiated with the works council and is required, not optional, once a system can monitor behaviour or performance in the abstract, which every AI platform with a usage log can. The training programme is the evidence for Article 4. The table shows who writes each, when it is required and what belongs in it. Our works agreement template covers the second document in detail; the policy is the one that most companies can finish in two weeks.

Copy the clauses, keep the numbering, and delete what does not apply. The wording is deliberately plain: a policy that needs a lawyer to read it will not be read. Each clause names the rule first and the reason second, because people follow rules they understand. The sample wording is neutral so it can go into your document as it stands.

Clause 3 is the one people actually need at their desk, so it deserves its own table. The categories follow what the GDPR and most data processing agreements already distinguish; the tool columns follow the three account types most companies have. The GDPR and AI Act compliance checklist explains the legal basis per category; the DPIA template is what you need when Amber data flows systematically.

If you have a works council, the policy alone does not carry an AI rollout. Section 87(1) no. 6 of the Works Constitution Act gives the council co-determination over technical systems that are suited to monitor behaviour or performance, and the Federal Labour Court holds that the abstract capability suffices. An AI platform that logs who asked what is such a system. From August 2026, Article 26(7) of the AI Act adds a duty to inform worker representatives before a high-risk system is put into service.

The practical sequence that works: write the policy first, because it forces you to answer the questions the council will ask (which tools, which data, which logs, which purposes). Then negotiate the works agreement on that basis; the Bitkom guide to AI and co-determination recommends a framework agreement with an annex per tool, so that adding a tool does not reopen the whole negotiation. Clause 9 of the template, no performance monitoring, is the sentence that shortens the negotiation most. What employees actually fear is covered in why employees do not trust workplace AI.

The policy is not for the employees who wait for permission. It is for the majority who already paste customer e-mails into a private chatbot because it helps them. A ban does not stop them, it moves them to their phone. The policy that works offers them an approved tool that is at least as good, on a company account, and tells them plainly what the private account may still be used for (nothing with company data).

Before writing Annex A, find out what is actually in use. An anonymous survey usually surfaces eight to fifteen tools, half of them unknown to IT. That list is the whitelist candidate list and the risk register in one; the shadow AI audit describes the full procedure.

A policy that depends on people remembering it fails at the first deadline. The clauses that matter most, data rules, no performance monitoring, approved tools only, can be enforced by the platform instead: a permission model that only lets the AI read what the user may read, a whitelist that is the actual list of connected tools, and an audit log that records what the AI accessed without being a monitoring instrument for managers. Microsoft tenants learned the alternative through Copilot oversharing: a policy said only your own data, the index said otherwise.

Teamo AI implements the template's hard clauses structurally: the 7-ring permission architecture enforces clause 3 per row, integrations are the whitelist (installed from the chat, visible to the admin), three separate audit logs give the works council the evidence for clause 9 while keeping per-person evaluation out of scope, and the platform is EU-hosted with a data processing agreement. It is one way to run an AI operating system for the company where the policy is a configuration, not a poster.

The regulation will keep moving: Article 50 labelling from August 2026, high-risk obligations in 2027, national supervision settling in. A policy written as a two-page frame plus an annex survives all of that with an annex update. A policy written as a twelve-page treaty is renegotiated each time. Write the frame once, keep Annex A alive, and let the platform do the enforcing. The small-business playbook for the AI Act and GDPR shows the same principle for the rest of the compliance stack.

An AI policy for employees is one document in a set, and it only works when the rest of the set exists. Before the policy comes the platform decision, after it comes the enforcement. The policy names which tools are allowed; the AI operating system for companies is the layer that makes the allowed tools the easy ones, with company context, permissions and audit logs the policy can point to. If your shortlist is really ChatGPT Enterprise or Microsoft 365 Copilot, the ChatGPT Enterprise vs Copilot comparison shows what each one enforces on its own and what the policy has to cover instead. Below 500 people, the AI platform decision guide for small business sorts the options by seat floors and EU hosting.

Two further decisions shape the clauses. Whether you build or buy the assistant changes clause 3 and clause 9: a self-built stack has no per-row permissions and no audit trail unless you write them, as the internal AI assistant build vs buy guide shows. And once agents act inside your tools rather than only answering, the policy needs an approval clause, explained in what an agentic operating system is. The technical basis for all of it, the layer that knows your company, is the AI context layer; the legal frame around it is our AI governance and compliance guide for the EU, and the co-determination side is in works council and AI.