AI has arrived in everyday work; the written rules for it often have not. That is the gap an internal policy fills: it tells your team which tools are approved, which data never belongs in an AI window, and who is responsible when something goes wrong.
Answer the eight questions below. You receive a finished Word document straight away, ready for you to continue writing. Free of charge, no sign-up. Everything runs in your browser — your entries do not leave your device.
Every field already carries a sensible default. Change what differs at your company — you can leave the rest as it stands.
Appears in the title and in every section of the policy.
From when the policy applies within the company.
Name and position. This person decides on new tools and receives reports.
Email or telephone number on which they can be reached day to day.
One tool per line. Do include the small helpers — anything not on the list counts as not approved.
One point per line. The first two lines concern applications the Regulation classifies as high-risk, which is why they must not be introduced in passing.
How your company marks AI content externally. In detail: labelling duty and ready-made labels.
The most important sentence in the whole policy: that a report carries no consequences. Otherwise nobody reports anything.
The policy then gains an additional section on informing and consulting employee representatives, with reference to Directive 2002/14/EC as the European minimum standard.
Please enter your company name first — it appears on every page of the policy.
The file opens in Word and can be edited straight away — headings, paragraphs and lists are preserved. For a PDF, use the second button and choose “Save as PDF” in the print dialogue.
The AI Act is currently being adjusted on several points. If something changes that affects this policy, we will send you a short note on what you should amend. Entirely optional — you already have your document.
Notes on the legal position only, cancellable at any time. No sharing with third parties.
So that you know where you stand after the download. Honesty at this point spares you unpleasant surprises later.
| Question | Does the policy cover it? | Note |
|---|---|---|
| Do your employees know which tools are permitted? | Yes | The list of approved tools is the part that matters most in practice. |
| Is it settled which data must not go into an AI tool? | Yes | Three prohibitions: personal data, trade secrets, third-party data held in confidence. |
| Is a responsible person named? | Yes | With contact details and reporting route, so that nobody has to search when it matters. |
| Is labelling under Article 50 governed? | Yes | As an internal rule. Applying it in the individual case remains your task. |
| Is there evidence that your team knows the rules? | No | A policy sitting in a folder is not evidence. That takes training and acknowledgment. |
| Is AI literacy under Article 4 evidenced? | No | Article 4 requires literacy measures, not just a set of rules. Evidence is kept per person. |
| Is your company conformant as a result? | No | Conformity also depends on which systems you use and which risk tier they fall into. |
Article 4 (AI literacy) has applied since 2 February 2025. Anyone using AI in their business must ensure that the people working with it understand it sufficiently — what the system can do, where it gets things wrong, and what that means for their work.
Article 50 (transparency and labelling) has applied since 2 August 2026. Since then, AI-generated content that could be taken for real must be labelled, and people must be told when they are speaking to an AI.
Both duties apply to small companies too. Both can be met with manageable effort — provided they are written down and known within the company.
No. A policy is one building block, not compliance. It governs conduct inside the house. Whether your company meets the regulation as a whole additionally depends on which AI systems you use, what risk class they fall into, and whether your staff can evidence the required AI literacy.
No. The generator runs entirely in your browser. Company name, personal names and tools never leave your device. The file is created locally and saved locally.
German, English or Dutch. The language of the page determines the language of the generated document: title, sections, signature line and legal notice all appear in the language you chose. The section on employee co-determination is adapted to the corresponding legal system.
As a Word document. It opens in Microsoft Word, LibreOffice and Google Docs and is directly editable, with headings, paragraphs and bullet lists. Alternatively you can output the policy as a PDF via the print function.
No. The template does not constitute legal advice. It is meant as a starting point and has to be adapted to the circumstances of your company. Where co-determination, data protection or high-risk applications are involved, professional review is advisable.
This is the difference most companies fall down on: a document in a folder proves nothing. What gets asked for is the record — who was trained and when, who acknowledged the rules, and can that be produced without three days of searching.
That is exactly what the KlarComply subscription produces: training with a verifiable certificate per person, an acknowledgment log for your policy, and a printable evidence file you can put on the table when it counts. You upload the policy you have just generated once — it then appears automatically in every employee’s training.
Start with a free check: where do you stand? · 10 questions, 2 minutes, no sign-up
Legal notice: this page and the document it generates give general guidance on implementing Regulation (EU) 2024/1689 and do not constitute legal advice. The template does not replace legal review of the individual case and does not by itself establish conformity. Adapt it to your company before putting it into force. Where employee representatives hold consultation rights, they must be involved.
Sources: Regulation (EU) 2024/1689 — full text on EUR-Lex (Article 4, Article 50)