AI policy and AI literacy: clear rules for staff and what the law asks
How to write an AI policy staff actually follow, train people to the level their role needs and keep up with AI rules in the EU, the UK and the US.
In this topic: IT and data 18
Most organisations already have an AI policy. It just is not written down: it is whatever each employee decides when a deadline looms and a chatbot is one click away. In a global survey of more than 48,000 people, almost half of employees admitted using AI in ways that contravene company policy, including uploading sensitive company information into free public AI tools (source: KPMG and University of Melbourne, May 2025).
Only 40% said their workplace has a policy or guidance on generative AI use (source: KPMG and University of Melbourne, May 2025). A written AI policy closes that gap. In the EU the AI Act adds a legal reason: organisations that use AI must take measures for their staff's AI literacy.
Write a short AI policy that names the approved tools, the data that may never go in and who checks the output, then train people to the level their role needs. In the EU, organisations using AI have had to take AI literacy measures since February 2025; elsewhere, check the rules wherever you hire and sell.
- Approved tools
- Data rules
- AI literacy
- Regulation
Why your staff need AI rules now
The risks are ordinary rather than futuristic: data that leaks, output nobody checked and use nobody sees.
Data leakage
Text pasted into a free public chatbot leaves your control and, depending on the provider's terms, may be stored or used to improve the service.
Wrong output
Generative AIGenerative AIAI that produces new text, images, audio or code in response to an instruction, such as a chatbot or an image generator. writes fluent text that can be wrong. In the same survey, 66% said they rely on AI output without evaluating its accuracy (source: KPMG and University of Melbourne, May 2025).
Hidden use
Without rules, use goes underground: 57% said they hide their use of AI and present AI-generated work as their own (source: KPMG and University of Melbourne, May 2025).
A ban rarely helps: people simply move to a personal phone, beyond your control. Approved tools with business accounts, clear data rules and a person to ask work better.
What a workable AI policy contains
Two pages that people read beat twenty that nobody opens. Eight subjects cover what staff need to know.
The policy answers the questions staff actually have: may I use this tool, may I paste this document, must I check the result, and whom do I ask?
Copyright deserves its own line. The US Copyright Office concluded that purely AI-generated material is not protected by copyright and that prompts alone do not give enough control, while human contributions perceptible in the output can be (source: US Copyright Office, January 2025). Other countries take their own view, so do not assume AI output is yours, and never feed in material you have no right to use.
- Approved tools: the list, business accounts only, how to request more.
- Data: what never goes in, and which data may go where.
- Human review: a person checks output before it reaches a customer or affects someone.
- Transparency: when customers are told they are dealing with AI.
- Copyright and confidentiality: no material without rights, no client secrets.
- Bias: AI never decides alone about candidates or staff.
- Records: a register of AI uses and of training.
- Who to ask: the owner, and where to report a mistake or leak.
Traffic lights: which data may go into which AI tool
Staff remember colours better than clauses. One matrix settles most everyday questions.
Green means go: public information in any tool, internal material in an approved business tool. Amber means only under a condition: internal notes in a public tool once names and details are removed, confidential data only in a tool cleared for it, with a processing agreement and settings that keep your data out of model training. Red means never.
Uses need the same treatment. Drafting and summarising are usually green; anything that leaves the building, such as a customer email, is amber and is read by a person first. Using AI to judge people, such as screening candidates, stays red until it has been assessed and approved.
What the EU AI Act asks of employers
Most organisations that use AI tools are deployers: fewer duties than the companies that build AI, but not none.
The AI Act entered into force on 1 August 2024 and has applied since 2 August 2026, with some exceptions (source: European Commission, October 2026). A deployerDeployerUnder the EU AI Act, any person or organisation that uses an AI system under its own authority, except for personal, non-professional use. is anyone using an AI system under its authority other than for personal, non-professional use, and the Act also reaches providers and deployers outside the EU when their system's output is used in the EU (source: European Commission, July 2026).
| Level | Examples | What it means for you |
|---|---|---|
| Prohibited | Emotion recognition at work, social scoring, harmful manipulation (source: European Commission, October 2026). | Banned since 2 February 2025 (source: European Commission, October 2026). |
| High risk | CV sorting in recruitment, managing workers, credit scoring (source: European Commission, October 2026). | From 2 December 2027: inform workers' representatives and affected workers first, and give oversight to people with the competence, training and authority (source: European Commission, July 2026). |
| Transparency | Chatbots, deepfakes, AI text published to inform the public on matters of public interest. | People must be told: for chatbots unless it is obvious, for deepfakes by disclosure, for such text unless a person reviewed it under editorial responsibility (source: European Commission, July 2026). |
| Minimal | Spam filters, AI in video games (source: European Commission, October 2026). | No new rules for the system; your AI literacy duty and data protection law still apply. |
The timetable has changed once already. The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026 and moved the high-risk rules for uses such as recruitment to 2 December 2027, and for AI in regulated products to 2 August 2028 (source: European Commission, October 2026).
It also added bans on AI that generates non-consensual sexual deepfakes or child sexual abuse material, from 2 December 2026 (source: European Commission, July 2026). These are the Commission's dates as of November 2026; check its AI Act pages before you plan around one.
AI literacy: the duty and proportionate training by role
The duty asks for reasonable measures that fit each role, not a diploma for everyone.
Article 4 of the AI Act has applied since 2 February 2025, with supervision and enforcement since 2 August 2026 (source: European Commission, October 2026). As amended in July 2026, it requires providers and deployers to take measures to support the AI literacy of their staff and others using AI on their behalf, taking into account their knowledge, experience, education and training and the context of use, without guaranteeing any specific level for any individual (source: EUR-Lex, July 2026). The Commission stresses that it remains an obligation (source: European Commission, October 2026).
AI literacy means the skills and understanding to use AI in an informed way and to be aware of its opportunities, risks and possible harm (source: European Commission, July 2026). No certificate or mandatory training is required, and an internal record of trainings is an option (source: European Commission, October 2026). Even staff who only use a chatbot for advertising text or translations should know about risks such as hallucinationHallucinationAn AI answer that sounds convincing but is made up, such as a source that does not exist or a wrong figure. (source: European Commission, October 2026).
- 1EveryoneWhat AI can and cannot do, the policy and traffic lights, reporting mistakes.
- 2Frequent usersClear instructions, checking facts and sources, the limits of each tool.
- 3SpecialistsHR, IT, managers and approvers: risk levels, oversight, supplier checks.
Start, the Commission suggests, from a general understanding of AI, your role as provider or deployer, and the risk of your systems (source: European Commission, October 2026).
AI rules outside the EU: examples from the UK and the US
Approaches range from voluntary principles to local laws on hiring. Check every country where you hire or sell.
| Where | Approach | What it means for an employer |
|---|---|---|
| United Kingdom | Existing regulators interpret and apply five principles within their remit: safety, security and robustness; appropriate transparency and explainability; fairness; accountability and governance; contestability and redress (source: GOV.UK, February 2024). | Your sector regulator and data protection rules set the bar; the principles make a sound backbone for a policy. |
| United States, federal | The NIST AI Risk Management Framework of January 2023 is for voluntary use and, as of August 2026, under revision as part of the White House AI Action Plan (source: NIST, August 2026). | A reference for managing AI risk, not a legal duty. |
| New York City | An automated employment decision tool may only be used after a bias auditBias auditAn independent check of whether a tool's outcomes differ between groups of people, for example by sex or ethnicity. within one year before use, with the audit information public and candidates or employees notified; enforced since 5 July 2023 (source: NYC DCWP, June 2023). | Notice is due 10 business days before use (source: NYC DCWP, June 2023). |
| Colorado | The 2024 AI Act was postponed to 30 June 2026 (source: Colorado General Assembly, August 2025), then repealed and re-enacted in May 2026 as rules on automated decision-making technology in consequential decisions, effective 1 January 2027 (source: Colorado Attorney General, October 2026). | Employment is a covered area (source: Colorado Legislative Council Staff, May 2026); the Attorney General must adopt rules before 1 January 2027 (source: Colorado Attorney General, October 2026). |
Elsewhere, data protection rules on automated decisions often do the work. Ask an adviser which rules apply where you operate; the IT and data guides cover privacy and security.
How to keep an AI policy alive
Tools change faster than policies. Without an owner and a rhythm, the policy is out of date within a year.
- 1Name one ownerOften from IT, legal or operations, with a deputy, to keep the tool list and answer questions.
- 2Keep a register of AI usesOwner, purpose, tool, data, risk level and approval date per use.
- 3Offer a route for new toolsA short request and a check of data, contract, settings and risk before a tool joins the list.
- 4Review on triggersYearly, and after a new tool, an incident or a change in the law where you operate.
- 5Learn from mistakesMake reporting a leak or wrong output easy and blame-free, then improve the rules.
Assistants built into office, CRM or accounting software count as AI use too. Put them in the register and check their data settings.
How well do your AI rules work?
Answer for your own organisation and see where to start.
- 1We know which AI tools staff actually use, including free ones.
- 2There is a written AI policy that staff have read and can find.
- 3Staff know which data may never be entered into a public AI tool.
- 4Output that goes to customers or affects a person is checked by a person first.
- 5We know whether any of our AI uses count as high-risk or carry transparency duties.
- 6Every employee has had basic AI training, and we record who completed it.
- 7We have checked the AI rules for hiring in each country where we recruit.
- 8The policy has a named owner and is reviewed at least once a year.
Related guides
AI policy example and AI literacy plan by role
Below you will find an example AI policy to adapt, section by section, an AI literacy plan by role and a check for each new AI tool.
Frequently asked questions
Does the EU AI Act apply if we only use ChatGPT or Copilot?
Does the AI Act matter for companies outside the EU?
Is it safer to ban AI tools altogether?
Do we need a certificate to prove AI literacy?
- EUR-Lex: Regulation (EU) 2026/1744, Digital Omnibus on AI (July 2026)
- European Commission: AI Literacy, Questions and Answers (October 2026)
- European Commission: AI Act (October 2026)
- GOV.UK: Implementing the UK's AI regulatory principles (February 2024)
- NYC DCWP: Automated Employment Decision Tools (June 2023)
- Colorado Attorney General: Automated decision-making technology rulemaking (October 2026)