Company AI policy: what the AI Act requires, what to put in the document and a template to adapt

Not directly. The AI Act, the EU regulation on artificial intelligence, contains no provision saying “every company must have an AI policy” or “every company must keep a register of AI tools”. Such claims circulate online, but they have no basis in the text of the regulation.

What the regulation does impose are specific obligations on companies that use AI. For a typical company the most important is Article 4: the company must take steps that help employees understand how AI works, where it makes mistakes and what data they should not give it. Written rules and training are the simplest evidence that the company meets this obligation.

The obligations come into force in stages. The table below shows the position after the Digital Omnibus package (Regulation (EU) 2026/1744), which moved the deadlines for high-risk systems.

Employees are already using AI, whatever the management board has decided. If the company does not give them a safe tool, they turn to personal accounts. This is called “shadow AI”: using AI tools without the company’s knowledge or control.

The problem is not the use itself but the data. A customer contract pasted into a free personal account goes to a provider with which the company has no agreement at all. If it contains personal data, this may be a GDPR breach, which sometimes has to be reported to UODO.

A policy also settles practical matters. The purchasing department knows who approves a new tool. Managers know what to do when an employee makes a mistake. The management board knows how many licences it is buying and who is using them.

Finally, there is the regulatory argument. The Polish Act on Artificial Intelligence Systems established KRiBSI, which from 28 October 2026 can carry out inspections and impose penalties. For SMEs, AI Act fines are calculated using the lower of two amounts: a fixed sum or a percentage of turnover.

In a mid-sized company, a document of 4–6 pages divided into short parts works well. Employees should be able to understand each part without a lawyer’s help.

The list below is the minimum scope. Not every part has to be long: the list of tools can be a table, and the incident procedure can be five steps.

The most common mistake is an overly detailed classification. Employees will not remember twelve categories, and within a week they will be relying on gut feeling. Four classes with examples from your own company are enough in most cases.

The key is to match each class of data to a type of tool. A tool “covered by a contract” means a business version in which the provider undertakes not to use the data to train models and signs a data processing agreement (DPA). Microsoft, for example, states that prompts and responses in Microsoft Copilot used with a work account are not used to train models.

If the company has no tool for a given class, the policy should say so plainly: “we do not process this data in AI for now”. That is better than silence, which employees will read as permission.

You can copy and adapt the wording below. Square brackets mark places to fill in. Before adopting the provisions on employment law and personal data, review them with a lawyer or your data protection officer.

Name job titles rather than people, because people change roles. In a company of 30 people one person may hold several roles; what matters is that everyone knows who to turn to.

For a typical company, the AI Act does not require a register of AI systems. A list of the tools in use is still very useful: it shows what the company pays for, which data goes where, and who to ask when a provider changes its terms.

A spreadsheet with a few columns is enough. Remember that AI also appears in software nobody bought “as AI”: in the CRM system, the email marketing tool or the online meeting tool.

Update the list whenever a new tool is added, whenever a provider changes its terms and during the annual review. The tools most often missed are those bought by marketing or sales from their own budgets, so ask about them directly.

Article 4 does not specify the number of hours or the form of training. Following the Digital Omnibus changes, it no longer requires a specific level of knowledge either. It requires steps that support that knowledge and suit who uses AI and for what. An accountant who uses an assistant to summarise emails needs different knowledge from someone setting up a customer chatbot.

For most employees, a short training session covering four topics is enough: how the tool works, where it makes mistakes, what data must not be given to it and how to report a problem. People who implement or manage AI need a broader programme.

Workshops based on the company’s own examples work better than an online course with a test at the end. A sample exercise: “A customer sends you a contract and asks for a quick opinion. Which tool will you use and what will you not paste in?” Keep the attendance list and materials; they are evidence that the company has taken these steps.

The sentence “in the event of an incident, notify your manager” is not enough. An employee under stress needs specific steps. It is worth describing four typical situations and giving the first response for each.

The most important deadline comes from the GDPR. A personal data breach must be reported to UODO within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to individuals. That is why an internal report must reach the right person within hours, not days.

A policy does not need months of negotiation. A small team is enough: a member of the management board, someone from IT, someone from HR and the person responsible for personal data. The plan below assumes you work from a ready template rather than writing from scratch.

The first step usually takes the most time, because it involves talking to managers. Do not cut it short: it shows what people are really using.

Each of the mistakes below leads to the same outcome: employees sign the document and go back to their old habits. It is worth checking your draft policy against them before adopting it.