Your company may never have formally authorized the use of ChatGPT.<\/p>\n\n
And yet, it\u2019s very likely that someone is already using it.<\/p>\n\n
An employee copies an email and asks an AI to improve it. The marketing team uses a tool to prepare a campaign. A sales rep enters information about a potential client to draft a proposal. Administration summarizes documents with Copilot. Human Resources experiments with AI to analyze resumes.<\/p>\n\n
The problem isn\u2019t necessarily that employees are using these tools.<\/p>\n\n
The problem arises when each person decides on their own which artificial intelligence to use, what information to enter, and to what extent they can trust the result<\/strong>.<\/p>\n\n That\u2019s why, by 2026, a corporate policy on the use of artificial intelligence<\/strong> will become, for many organizations, a compliance tool just as important as policies on data protection, information security, or the use of corporate devices.<\/p>\n\n But there\u2019s one important point:<\/p>\n\n it\u2019s not enough to simply download an AI policy template from the Internet and send it to employees.<\/strong><\/p>\n\n The policy must address the actual uses of artificial intelligence within each company.<\/p>\n\n It\u2019s best to start by clarifying this point because there is quite a bit of confusion.<\/p>\n\n The AI Act, or European Artificial Intelligence Regulation, does not generally require all companies to have a document titled exactly \u201cInternal Artificial Intelligence Policy.\u201d<\/strong><\/p>\n\n Therefore, it would be incorrect to claim that any small or medium-sized enterprise (SME) that does not have this document is automatically in violation of the Regulation.<\/p>\n\n What does exist, however, are specific obligations related to the use of AI systems<\/strong>.<\/p>\n\n One of the most important areas for businesses is artificial intelligence literacy.<\/p>\n\n Article 4 of the AI Act requires providers and those responsible for deploying AI systems to take measures that support the development of AI knowledge and skills among the people who use these systems on their behalf, taking into account factors such as their knowledge, experience, training, and the context in which the technology is used. This obligation takes effect in February 2025, and oversight began in August 2026. Europe\u2019s Digital Strategy<\/a><\/p>\n\n An internal policy can therefore serve as one of the tools that help a company organize, communicate, and demonstrate how it manages the responsible use of AI<\/strong>.<\/p>\n\n However, it does not replace training or other necessary measures.<\/p>\n\n A good policy answers very simple questions that, in many companies, no one currently knows how to answer with certainty:<\/p>\n\n Can we use ChatGPT?<\/strong><\/p>\n\n Can I enter a customer\u2019s information?<\/strong><\/p>\n\n Can I upload a contract so it can summarize it?<\/strong><\/p>\n\n Can I use Copilot to prepare an employee evaluation?<\/strong><\/p>\n\n Can I generate an image using AI and use it for commercial purposes?<\/strong><\/p>\n\n Do I have to check everything the tool generates?<\/strong><\/p>\n\n What should I do if the AI gives me incorrect information?<\/strong><\/p>\n\n Can I use my personal ChatGPT account for work?<\/strong><\/p>\n\n If each employee answers these questions based on their own judgment, the company has a governance problem.<\/p>\n\n The purpose of the policy is to establish common and understandable rules<\/strong>.<\/p>\n\n There is no one-size-fits-all template that works for every organization.<\/p>\n\n A tech startup that develops AI software does not face the same risks as a consulting firm, a clinic, an industrial company, or an e-commerce business.<\/p>\n\n However, there are a number of factors that should be analyzed in virtually any corporate policy.<\/p>\n\n The first step seems obvious, but many companies have not taken it:<\/p>\n\n decide which tools employees can use.<\/strong><\/p>\n\n It\u2019s not enough to simply say:<\/p>\n\n “The use of artificial intelligence is permitted.”<\/p>\n<\/blockquote>\n\n The company should determine which solutions are authorized and, when necessary, under what conditions.<\/p>\n\n For example, it may decide to use certain corporate accounts for ChatGPT, Microsoft Copilot, or other tools, but not allow employees to use personal accounts to process business information.<\/p>\n\n The Spanish Data Protection Agency specifically recommends restricting the use of generative AI systems to authorized and trained users, as well as prohibiting systems that are not registered in the corporate inventory. AEPD<\/a><\/p>\n\n Because privacy policies, information processing practices, data retention policies, and settings can vary between tools and even between different versions of the same service.<\/p>\n\n The company must know to whom it is providing its information<\/strong>.<\/p>\n\n Authorizing a tool does not mean authorizing any and all uses.<\/p>\n\n We can imagine three simple levels.<\/p>\n\n For example:<\/p>\n\n For example:<\/p>\n\n This section should clearly list the actions that the company has determined are unacceptable.<\/p>\n\n For example, entering trade secrets into public tools or allowing an AI to make certain decisions without human supervision.<\/p>\n\n The key is that an employee shouldn\u2019t have to become a lawyer to know what they\u2019re allowed to do<\/strong>.<\/p>\n\n This is probably one of the most important sections.<\/p>\n\n Let\u2019s imagine a sales representative wants to prepare a proposal.<\/p>\n\n Instead of explaining the context in general terms, they copy it directly into ChatGPT:<\/p>\n\n You might receive an excellent proposal.<\/p>\n\n But the company must first ask itself whether that information could be entered into that tool under those conditions<\/strong>.<\/p>\n\n The AEPD recommends explicitly informing users that they should not share confidential information or enter private data, non-public information, or personal data into generative AI systems when the processing of such data is not authorized and controlled. AEPD<\/a><\/p>\n\n The policy should establish specific rules for:<\/p>\n\n Personal data.<\/strong> Confidential information.<\/strong> Trade secrets.<\/strong> Highly sensitive information.<\/strong> A simple rule that can help employees is:<\/p>\n\n If you wouldn’t voluntarily send that information to an outside company you don’t know, don’t enter it into an AI tool without first verifying that it’s authorized.<\/strong><\/p>\n<\/blockquote>\n\n Artificial intelligence can write something completely incorrect with great confidence.<\/p>\n\n It can make up data.<\/p>\n\n It can confuse concepts.<\/p>\n\n It can generate nonexistent references.<\/p>\n\n It can misinterpret a document.<\/p>\n\n It can provide outdated information.<\/p>\n\n Therefore, a corporate policy should make it clear that using AI does not eliminate the responsibility to review the results<\/strong>.<\/p>\n\n The AEPD expressly recommends manually reviewing and validating the generated results before using or publishing them and warns that information produced by AI should not be assumed to be correct without verification. AEPD<\/a><\/p>\n\n This is particularly important when the content may:<\/p>\n\n The rule should be simple:<\/p>\n\n AI can help prepare the work; the ultimate responsibility remains with humans.<\/strong><\/p>\n\n One common mistake is that everyone uses artificial intelligence, but no one is accountable for how it\u2019s used.<\/p>\n\n This doesn\u2019t mean that all small and medium-sized businesses need to immediately hire a \u201cChief AI Officer.\u201d<\/p>\n\n In fact, the European Commission clarifies that Article 4 of the AI Act does not require the appointment of an AI officer or the creation of a specific governance committee<\/strong>. Europe\u2019s Digital Strategy<\/a><\/p>\n\n In an SME, it may be enough to assign clear roles.<\/p>\n\n For example:<\/p>\n\n Management approves the tools.<\/p>\n\n IT or the technology provider reviews security issues.<\/p>\n\n The data protection officer intervenes when necessary.<\/p>\n\n Human Resources manages training.<\/p>\n\n And each department head oversees how their team uses the tools.<\/p>\n\n What matters isn\u2019t the job title.<\/p>\n\n What matters is that, when a question or an issue arises, it\u2019s clear who should make a decision<\/strong>.<\/p>\n\n This section deserves special attention.<\/p>\n\n The use of artificial intelligence for:<\/p>\n\n It may have much more significant implications than using ChatGPT to draft a LinkedIn post.<\/p>\n\n The AI Act classifies certain systems used in the workplace as high-risk. According to the currently valid timeline, the rules applicable to certain high-risk systems listed in Annex III\u2014including certain workplace uses\u2014will take effect on December 2, 2027<\/strong>. Digital Strategy for Europe<\/a><\/p>\n\n But that doesn\u2019t mean companies can ignore this issue until then.<\/p>\n\n Spain now recognizes information rights related to algorithms that affect employment decisions. Since 2021, workers\u2019 legal representatives have had the right to be informed about certain parameters, rules, and instructions of algorithms or AI systems that affect working conditions, access to employment, or job retention. BOE<\/a><\/p>\n\n And there is one particularly significant development.<\/p>\n\n As of September 2026, Spanish regulations also require that employees be informed in writing of the existence of algorithmic or automated decision-making systems<\/strong> when such systems are used for certain decisions regarding their working conditions, including aspects such as working hours, task assignments, wages, career advancement, workplace, or termination of employment. BOE<\/a><\/p>\n\n Therefore, the AI policy should be aligned with the company\u2019s labor obligations.<\/p>\n\n AI does not always operate internally.<\/p>\n\n Many companies already have systems that interact directly with customers<\/strong>.<\/p>\n\n For example, a chatbot that answers questions on a website.<\/p>\n\n As of August 2, 2026,<\/strong> certain transparency obligations under Article 50 of the AI Act will apply. The Commission has also published specific guidelines to help providers and those responsible for deployment comply with these obligations. Europe\u2019s Digital Strategy<\/a><\/p>\n\n Therefore, a company should review, among other issues, whether individuals interacting with certain systems should be informed that they are speaking with an artificial intelligence.<\/p>\n\n Internal policy should also specify who is allowed to use AI to generate external content and what kind of review such content requires before publication.<\/p>\n\n The company must monitor both ends of the process.<\/p>\n\n What it inputs into the AI.<\/strong><\/p>\n\n An employee should not provide protected content or third-party documentation without first verifying that they have the right to do so.<\/p>\n\n And what it obtains from the AI<\/strong>.<\/p>\n\n Generating text, an image, code, or a design using artificial intelligence does not mean it can automatically be used for any purpose without review.<\/p>\n\n The policy should require that the following types of content, in particular, be reviewed:<\/p>\n\n This isn’t about banning creative AI.<\/p>\n\n It\u2019s about avoiding the idea that:<\/p>\n\n “Since it was generated by a machine, we can do whatever we want with it.”<\/p>\n<\/blockquote>\n\n What happens if an employee accidentally enters confidential information?<\/p>\n\n What if they discover that a tool has generated false information that has already been sent to a client?<\/p>\n\n What if personal data appears that should not have been processed?<\/p>\n\n What if an unauthorized tool is used?<\/p>\n\n The policy should specify who to notify immediately in the event of an incident<\/strong>.<\/p>\n\n The goal should not be to create a culture of fear.<\/p>\n\n If employees believe that reporting a mistake will only result in disciplinary action, there is a risk that they will try to cover it up.<\/p>\n\n From a compliance perspective, it\u2019s usually much more helpful to learn about an incident quickly and be able to respond.<\/p>\n\n This is a crucial point.<\/p>\n\n A company can draft an excellent policy and still face the exact same problem if no one understands it.<\/p>\n\n The European Commission notes that training measures must be tailored to people\u2019s knowledge, experience, and education, as well as to the context in which they use AI. No specific certification or uniform level of knowledge is required for all employees. Digital Strategy for Europe<\/a><\/p>\n\n Therefore, not everyone needs the same training<\/strong>.<\/p>\n\n The marketing department may need training on content creation and intellectual property.<\/p>\n\n Human Resources may need training on biases, employment decisions, and high-risk systems.<\/p>\n\n Management may need training on governance and accountability.<\/p>\n\n IT may need training on security and vendors.<\/p>\n\n Customer Service may need training on chatbots, personal data, and oversight.<\/p>\n\n The European Commission itself uses different training tracks for general staff, managers, and technical roles. This is a good example of why AI literacy must be tailored to each person\u2019s actual job responsibilities. Europe\u2019s Digital Strategy<\/a><\/p>\n\n In most companies, this is probably the wrong question to ask.<\/p>\n\n An outright ban may seem like the safest option, but it can create another problem: employees may continue to use AI tools without informing the company<\/strong>.<\/p>\n\n The goal should be to ensure that employees know:<\/p>\n\n which tools they can use + what they can use them for + what information they can enter + what they should check before using the results.<\/strong><\/p>\n\n A company can set much stricter restrictions in certain departments and allow broader use in others.<\/p>\n\n There doesn\u2019t have to be a single rule for the entire organization.<\/p>\n\n Yes, we can.<\/p>\n\n Whether that\u2019s enough is another matter.<\/p>\n\n Let\u2019s imagine we download a template that says:<\/p>\n\n “It is prohibited to enter confidential information into artificial intelligence tools.”<\/p>\n<\/blockquote>\n\n That sounds reasonable.<\/p>\n\n But questions immediately arise:<\/p>\n\n What does the company consider confidential information?<\/p>\n\n Do employees know this?<\/p>\n\n Can they enter personal data?<\/p>\n\n What about an anonymized contract?<\/p>\n\n Can they use a business account but not a personal one?<\/p>\n\n Who authorizes a new tool?<\/p>\n\n What about Copilot integrated into programs the company already uses?<\/p>\n\n What are Human Resources\u2019 policies?<\/p>\n\n Who reviews the results?<\/p>\n\n Where do you report an issue?<\/p>\n\n If the policy doesn\u2019t address the company\u2019s actual practices, it can become a document that exists but doesn\u2019t govern anything<\/strong>.<\/p>\n\n Let’s imagine a professional services firm with 30 employees.<\/p>\n\n After reviewing actual usage, they discover the following:<\/p>\n\n Marketing uses ChatGPT.<\/p>\n\n Administration uses Copilot.<\/p>\n\n The Sales department uses AI tools to draft proposals.<\/p>\n\n Some employees have personal accounts on various platforms.<\/p>\n\n Human Resources is considering purchasing a tool to screen resumes.<\/p>\n\n A reasonable policy could stipulate:<\/p>\n\n Authorized tools:<\/strong> only approved corporate accounts.<\/p>\n\n Permitted general uses:<\/strong> drafts, ideas, translations, and summaries of non-confidential information.<\/p>\n\n Prohibited data:<\/strong> personal data or confidential information unless authorization has been granted and the tool has been validated for such processing.<\/p>\n\n Moderation:<\/strong> No relevant external content may be published or automatically submitted without human review.<\/p>\n\n Human Resources:<\/strong> Any tool intended for the selection, evaluation, or management of employees requires prior review.<\/p>\n\n New Tools:<\/strong> Employees must request authorization before incorporating a new AI into their work.<\/p>\n\n Incidents:<\/strong> Any accidental disclosure of sensitive information must be reported immediately.<\/p>\n\n Training:<\/strong> Authorized users receive training tailored to their specific use of the tool.<\/p>\n\n That\u2019s starting to look like a policy an employee can apply in their daily work.<\/p>\n\n The order matters.<\/p>\n\n Before drafting any guidelines, talk to the departments.<\/p>\n\n It\u2019s very likely that tools will come to light that management wasn\u2019t aware of.<\/p>\n\n For each tool, identify:<\/p>\n\n Don\u2019t allocate the same resources to a tool that helps proofread text as you would to one that evaluates candidates.<\/p>\n\n Analyze the contractual terms, privacy policies, data retention, subsequent uses of the data, and features available in the enterprise version.<\/p>\n\n The AEPD recommends evaluating aspects such as metadata, logs, telemetry, data reuse, localization, retention periods, and privacy settings before contracting generative AI systems. AEPD<\/a><\/p>\n\n The policy should be based on the findings from the previous steps.<\/p>\n\n Not the other way around.<\/p>\n\n Explain the rules using examples.<\/p>\n\n An employee understands better:<\/p>\n\n “Don’t copy a customer database into ChatGPT”<\/p>\n<\/blockquote>\n\n than a whole page on abstract principles of data governance.<\/p>\n\n The Commission notes that it is not necessary to obtain a specific certificate to demonstrate AI literacy. Internal records of training sessions and other initiatives undertaken may be kept. Digital Europe Strategy<\/a><\/p>\n\n Keep evidence of:<\/p>\n\n An AI policy drafted in 2026 will likely need to be updated.<\/p>\n\n Tools evolve rapidly, new use cases emerge, and the regulatory framework continues to develop.<\/p>\n\n 1. Copying a template without analyzing the company.<\/strong><\/p>\n\n 2. Regulating only ChatGPT.<\/strong> In six months, there will likely be other tools.<\/p>\n\n 3. Banning \u201csensitive data\u201d without explaining what that means.<\/strong><\/p>\n\n 4. Forgetting about employees\u2019 personal accounts.<\/strong><\/p>\n\n 5. Failing to differentiate between departments and risk levels.<\/strong><\/p>\n\n 6. Failing to regulate human review.<\/strong><\/p>\n\n 7. Ignoring Human Resources.<\/strong><\/p>\n\n 8. Failing to establish who authorizes new tools.<\/strong><\/p>\n\n 9. Distributing the document without training anyone.<\/strong><\/p>\n\n 10. Failing to update it.<\/strong><\/p>\n\n The policy should not be written just so you can say:<\/p>\n\n “We have an AI policy.”<\/p>\n<\/blockquote>\n\n It should be drafted in such a way that artificial intelligence is used more effectively after its implementation than before<\/strong>.<\/p>\n\n Ask yourself these questions:<\/p>\n\n If you answered “I don’t know”<\/strong> to several questions, that is precisely the first problem the company should address.<\/p>\n\n There is no general requirement under the AI Act that mandates all companies to have a document by that name. However, there are obligations related to the use of AI\u2014such as those regarding AI literacy\u2014and a policy can be an important tool for properly implementing and documenting them. Europe\u2019s Digital Strategy<\/a><\/p>\n\n A company may establish rules regarding the tools that may be used for work purposes, provided they fall within the applicable employment framework. However, from a practical standpoint, it may be more effective to specify authorized tools and uses rather than simply imposing a blanket ban.<\/p>\n\n It is recommended that the company evaluate this use and establish an explicit policy. Using personal accounts can make it difficult for the company to maintain control over information, settings, access, and the tools used.<\/p>\n\n This should not be done automatically. It is necessary to analyze the tool, the type of contract, the purpose, the data being processed, the configuration, and the obligations arising from the GDPR and other regulations. The AEPD recommends preventing the entry of private, non-public, confidential, or personal data when its processing is not properly authorized and controlled. AEPD<\/a><\/p>\n\n Digital literacy measures must be tailored to those who operate or use AI systems on behalf of the organization and to the relevant context. There is no one-size-fits-all course or mandatory certification for the entire workforce. Europe\u2019s Digital Strategy<\/a><\/p>\n\n Section 4 of the AI Act does not require the creation of a position called \u201cAI Officer\u201d or a specific committee. The company should, however, clearly define internal responsibilities. Europe\u2019s Digital Strategy<\/a><\/p>\n\n It can be part of compliance measures, but a policy alone does not guarantee compliance with the AI Act<\/strong>. It must align with the systems used, their risks, and the measures actually implemented.<\/p>\n\n A good artificial intelligence policy shouldn’t start by imposing bans.<\/p>\n\nIs it mandatory for a company to have an artificial intelligence policy?<\/h2>\n\n
So, what is the purpose of an AI policy?<\/h2>\n\n
What should an AI usage policy include in a company?<\/h1>\n\n
1. Which AI tools are authorized<\/h2>\n\n
\n
Why is this important?<\/h3>\n\n
2. What AI Can Be Used For<\/h2>\n\n
Generally Permitted Uses<\/h3>\n\n
\n
Uses That Require Authorization or Additional Controls<\/h3>\n\n
\n
Prohibited Uses<\/h3>\n\n
3. What Information Should Never Be Entered Into an AI<\/h2>\n\n
\n
\n
4. The Need to Review AI-Generated Responses<\/h2>\n\n
\n
5. Determine who is responsible for each use<\/h2>\n\n
6. Specifically Regulate the Use of AI in Human Resources<\/h1>\n\n
\n
7. Regulate the use of chatbots and AI-generated content<\/h2>\n\n
8. Intellectual Property: Be Careful About What Comes In and What Goes Out<\/h2>\n\n
\n
\n
9. Establish an incident response procedure<\/h2>\n\n
10. Train employees: simply sending out the policy isn\u2019t enough<\/h2>\n\n
Do I have to ban ChatGPT for my employees?<\/h1>\n\n
Can we just copy an AI policy template?<\/h1>\n\n
\n
Practical example of an AI policy for an SME<\/h1>\n\n
How to implement an artificial intelligence policy step by step?<\/h1>\n\n
Step 1. Find out what AI the company is already using<\/h2>\n\n
Step 2. Create an inventory<\/h2>\n\n
\n
Step 3. Classify uses according to their risk<\/h2>\n\n
Step 4. Review providers and configurations<\/h2>\n\n
Step 5. Draft the policy<\/h2>\n\n
Step 6. Communicate and Train<\/h2>\n\n
\n
Step 7. Document<\/h2>\n\n
\n
Step 8. Review it periodically<\/h2>\n\n
The 10 Mistakes an AI Policy Should Avoid<\/h1>\n\n
\n
Checklist: Does your company need an AI usage policy?<\/h1>\n\n
\n
Frequently Asked Questions About AI Policies in Companies<\/h1>\n\n
Will it be mandatory to have an AI policy by 2026?<\/h2>\n\n
Can I prohibit my employees from using ChatGPT?<\/h2>\n\n
Can employees use personal ChatGPT accounts for work?<\/h2>\n\n
Can an employee enter customer data into ChatGPT?<\/h2>\n\n
Do we have to train all employees?<\/h2>\n\n
Do we need to appoint an AI officer?<\/h2>\n\n
Does an AI policy suffice to comply with the AI Act?<\/h2>\n\n
From a Written Policy to the Responsible Use of AI<\/h1>\n\n