Company AI policy: why you need one and what to include

In spring 2023, Samsung engineers fed confidential source code into ChatGPT, three times within just a few weeks. The company then banned AI chatbots on company devices. Three years later, the underlying problem has reached every workplace: according to a survey by the TÜV Association (TÜV-Verband), almost one in two working people uses AI at work, often without clear rules. At the same time, Bitkom's most recent figures show that only 23% of companies had rules for using AI. An AI policy closes this gap.

What is an AI policy?

An AI policy is an internal set of rules that defines who in your company may use which AI tools for what, which data is off-limits and who checks the results. Legally, it is an exercise of your right as an employer to give instructions. It can be a stand-alone document, an annex to the employment contract or part of your IT rules. For small teams, two to four pages are often enough.

Is an AI policy mandatory?

The honest answer: no law literally says you need a document called "AI policy". However, several legal sources together create a de facto obligation to regulate how AI is used. Without documented rules, you will hardly be able to prove that you meet these requirements.

The supervisory authorities see it the same way. In its checklist for AI chatbots, the Hamburg Commissioner for Data Protection recommends creating internal rules as the very first step. Otherwise employees use the tools on their own initiative, and the company is liable for the consequences.

The underestimated argument: protecting your trade secrets

One point is overlooked almost everywhere: the German Trade Secrets Act only protects your pricing calculations, customer lists and processes if you can prove that you have taken appropriate confidentiality measures. If you do not regulate what employees may enter into AI tools, you risk losing that protection altogether in a dispute. You are then in a weak position if a former employee takes your customer list to a competitor. So an AI policy is not just about meeting obligations: it also protects your most valuable assets.

The ten building blocks of an AI policy

For a company with 1 to 50 employees, this structure has proven effective:

1. Scope: Who does the policy apply to? Think of freelancers and student employees too. For external staff, you anchor the rules in a contract clause rather than through your right to give instructions.
2. Approved tools: A concrete list of permitted AI tools, including the accounts to use. Rule of thumb: company accounts with a data processing agreement instead of private free accounts, with training on your own data switched off.
3. Data rules based on a traffic light system: What may go in, what only under certain conditions, and what never? More on this below.
4. Approval process for new tools: Anyone who wants to use a new tool submits a short request. Someone checks data protection, the contract and the server location, then a decision is made and documented. In a small business, this takes half an hour per tool.
5. Output control: AI results are checked for accuracy by someone with the relevant expertise before they are used. German courts show how serious this is: in 2025, several lawyers were caught citing completely made-up judgments in their written submissions, with consequences under professional conduct rules.
6. Labelling: Internally, transparency is the rule. Externally, since 2 August 2026, Article 50 of the EU AI Act has required that customers can tell when they are chatting with an AI. Ordinary company texts that have been editorially reviewed, on the other hand, do not need to be labelled.
7. Responsibilities: In a small business, one named contact person for AI questions is enough.
8. Training: Everyone who uses AI, and everyone who joins, is trained, and the training is documented. This is also your proof for Article 4.
9. Handling breaches: From a reprimand up to dismissal for disclosing trade secrets. Clear consequences make people take the policy seriously.
10. Maintenance: Keep the tool list up to date and review the policy at least once a year. AI law keeps changing, most recently through the Digital Omnibus in July 2026.

The traffic light system for data

At the heart of every AI policy is the question of which data may go into which tools. The traffic light system makes this easy for everyone to understand:

It is important that the amber category matches your tools: more may go into a business environment with a data processing agreement than into a private free account. That is exactly why the tool list and the traffic light system belong together.

Do I need to involve the works council?

If your company has a works council: in 2024, the Hamburg Labour Court (Arbeitsgericht Hamburg) ruled that an employer may introduce AI usage guidelines without the works council's consent, as long as the tools are used via private browser accounts and no usage data is monitored (case no. 24 BVGa 1/24). If, on the other hand, you provide company accounts and analyse how they are used, the works council has a right of co-determination. Most small companies are not affected by this, but it is still good to know.

Isn't a simple ban enough?

No, and for a practical reason: bans do not work. According to Bitkom, employees in around four out of ten companies use private AI tools, in some cases without the company knowing. A complete ban only pushes this use further into the shadows. The smarter way is the opposite: provide good tools officially, set clear rules and keep the hurdles low. You can read more about this in our article on shadow AI.

Your finished policy in five steps

1. Take stock: Ask your team honestly, and without blame, which tools are already in use.
2. Decide on tools: Choose the tools your team really needs and make sure you have business-grade accounts.
3. Set up the traffic light system: Define the three data categories with examples from your day-to-day work.
4. Write and communicate the policy: Short, concrete, easy to understand. A team meeting about it has more impact than an email.
5. Train and document: This way, you cover Article 4 at the same time.

The faster way: Klaus writes your policy with you

You can take the five steps above entirely on your own. Or you can let Klaus guide you through them: in the onboarding chat, Klaus asks you 13 questions in seven blocks, from your company and your role under the AI Act to your AI inventory. For common tools such as ChatGPT, Copilot or Claude, he suggests the typical setup straight away, and you just confirm or correct it. Each tool is given a classification: allowed, allowed with conditions, or prohibited. That is the traffic light system from this article, built directly into your policy.

The most important difference from "just have ChatGPT write you a policy": with Klaus, no AI drafts the legal text freely. The chapters are pre-written by legal experts, and only the facts from your answers are filled in: your inventory, your tool rules, your responsibilities. Chapters also only appear if they apply to you. The section on the duty of confidentiality under Section 203 of the German Criminal Code (StGB), for example, only appears if you state that professional secrecy plays a role.

If something changes, such as a new tool or a new contact person, you simply restart the chat. Klaus only asks about what has changed, and the PDF is regenerated automatically. This turns building block 10, maintenance, from a good intention into a five-minute update.

Conclusion

An AI policy is not a bureaucratic exercise but the foundation for using AI productively: it protects data and trade secrets, meets the obligations to demonstrate compliance under the GDPR and the AI Act, and gives your team the confidence to use AI with a clear conscience. For a small company, it can be done in two working days. The best time to do it was yesterday, the second-best time is this week.