Why you need one

The Danish Data Protection Agency sees more personal data breaches because employees enter work-related personal data into AI tools without their employer's knowledge. The agency recommends that the workplace sets rules for whether and how the tools may be used. At the same time, Article 4 of the EU AI Act requires businesses that use AI to support their employees' AI literacy. A short policy covers both. Read about AI policy and the AI Act.

The template

1. Purpose and scope

The policy applies to all employees, temporary staff and consultants who use AI on behalf of [the company].

2. Approved tools

  • Only these tools may be used for work tasks: [for example Microsoft 365 Copilot and ChatGPT Business with a company account]. New tools are approved by [person responsible].
  • Free and private AI accounts must not be used for work data.

3. Data that must never be entered

  • Civil registration numbers, health information and other sensitive personal data, information about children, passwords and keys, trade secrets and customer data marked confidential.
  • If in doubt, leave it out, or first remove names and other information that can identify people.

4. Personal data and GDPR

  • Personal data may only be processed in tools where [the company] has a data processing agreement and where training on our data is switched off.
  • Use only the information the task requires.

The Danish Data Protection Agency points out that the provider may in some cases still use the information even when training is switched off. Read the provider's terms before a tool is approved.

5. Confidentiality and security

  • Contracts, offers and source code from customers may only be entered if the customer has agreed to it.
  • Be extra alert to scam emails. AI makes them more convincing.

6. A person approves

  • Everything made with AI that is sent to customers or used in decisions is read and fact-checked by an employee who stands behind it.
  • AI must not make decisions about employees or customers on its own.

7. Transparency towards customers

  • A chatbot on our website clearly states that you are writing with AI.
  • Images, audio and video created or altered with AI that show real people or events are labelled as AI-generated.

The transparency rules in Article 50 of the AI Act apply from 2 August 2026.

8. Accounts and licences

  • AI tools are used only with company accounts created by [IT or person responsible]. The account is closed when the employee leaves.
  • Terms on data storage, training and transfer to countries outside the EU are reviewed before a tool is taken into use.

9. Responsibility and contact person

  • [Name or role] owns the policy and the list of approved tools. Questions go there.
  • If you have entered personal data by mistake, tell [contact person] immediately. It may be a personal data breach that must be assessed and possibly reported to the Danish Data Protection Agency within 72 hours.

10. AI literacy

  • New employees go through the policy and a short guide on errors in AI answers, data and security when they start.
  • We keep an internal guide with examples of good and prohibited use and update it when we take new tools into use.
  • We record who has received the policy and the guide.

11. Tasks AI is suited for

  • AI may be used for drafts, summaries and ideas.
  • AI must not be used for legal or financial advice to customers without professional review, or to assess job applicants.

12. Review

The policy is reviewed at least once a year and whenever new tools or legal changes arrive. Next review: [date].

Replace the text in [brackets] with your own names and dates. The button copies the template as plain text without the explanations.

Next step

Adapt the template, have management approve it, and go through it with your employees. If you need help choosing tools and setting them up securely, read about AI policy and the AI Act and secure AI setup.

The template is a starting point and not legal advice. Sources: the Danish Data Protection Agency on AI tools and the agency on personal data in AI tools (both in Danish).