AI policy for companies: template, building blocks, structure

What an AI policy is — and what the law says about it

An AI policy is an internal set of rules that specifies who in the company may use which AI systems for what purpose, which data may be entered in the process, and who is responsible for the results. There is no legal definition for it: neither the EU AI Act nor the Works Constitution Act (BetrVG), the GDPR, or the BSI Act (BSIG) knows the term "AI policy". European law only defines AI literacy — the term on which the obligations under Art. 4 of the EU AI Act depend.

The policy differs from a works agreement in how it comes about: the employer and the works council conclude the works agreement jointly, whereas the employer sets the policy alone. Both can exist side by side — and where co-determination applies, the policy does not replace the agreement.

Is an AI policy required by law?

No. No German or European provision requires a document with this name. In its questions and answers on AI literacy, the European Commission expressly clarifies that no specific governance structure is prescribed for Art. 4 and that no certificate of completion is needed. On its page on AI literacy, the Bundesnetzagentur (Federal Network Agency) likewise expressly lists what is not required: formalized or standardized training measures, external certifications, the introduction of an AI officer.

There are nevertheless indirect anchors, and they are the actual reason to write a policy:

• Art. 4 EU AI Act: Providers and deployers take measures "to support the development of the AI literacy of their staff …". The article has applied since February 2, 2025; its current version goes back to the Digital Omnibus Regulation (EU) 2026/1744, which entered into force on July 27, 2026. Companies are expressly not required to guarantee a specific level of competence for individual persons.
• Art. 26 EU AI Act: Anyone who deploys a high-risk AI system must take appropriate technical and organisational measures and assign human oversight to competent persons.
• Art. 32 (4) GDPR: Controllers take steps to ensure that persons acting under their authority do not process personal data "except on instructions" — an instruction that, in practice, can only be proven in writing.
• Section 2 no. 1 lit. b of the Trade Secrets Act (GeschGehG): Information is only a trade secret if it is "the subject of confidentiality measures appropriate under the circumstances". Anyone who does not regulate the handling of AI tools risks the protection itself.

In Germany, under Section 2 (1) KI-MIG, the Bundesnetzagentur is responsible for market surveillance under the EU AI Act, unless the Act provides otherwise; for individual sectors, the respective specialized authorities remain responsible.

Is there an official template for an AI policy?

Not for companies. A fill-in template cannot be found at the federal authorities. Anyone looking for an AI policy template will instead find two useful sources: recommendations from authorities that say what belongs in it, and ready-made samples from chambers and publicly funded bodies, such as the step-by-step guide from the Mittelstand-Digital Zentrum Berlin with free templates.

However, a sample does not replace your own analysis. Which systems are actually used in-house, which data arise in the process, and which roles are affected is not in any template.

The building blocks: what belongs in an AI policy

In its Management Blitzlicht „Generative KI für Unternehmen“, the BSI expressly recommends creating AI guidelines and places before them the guiding question of who may use which AI systems for what purpose. The recommendations of the BSI and the three cornerstones of the Bundesnetzagentur result in a framework of eight building blocks:

• Scope and purpose: who the policy applies to, including working students, freelancers, and service providers.
• Approved systems: a maintained list of approved AI systems, including an approval process for new ones. The BSI names as the goal preventing shadow IT and using only authorized systems.
• Access: company accounts instead of private access, switching off training with input data, configuring deletion periods and permissions.
• Data rules: what must never be entered — personal data and sensitive business information without protective measures.
• Responsibility for results: never adopt AI output unchecked, least of all for critical business processes; the final professional decision remains with humans.
• Labeling: where AI results go outside the company, the transparency obligations of the EU AI Act apply — separate labeling rules apply to chatbots and synthetic content.
• Competence and responsibility: who trains, who approves, who reports incidents. The Bundesnetzagentur names three cornerstones: determining the need, designing the measures according to role, context, and risk, and documenting, evaluating, and refreshing.
• Review: a fixed cycle at which the policy and the list of approved systems are reviewed.

Anyone who wants to set up a management system will find the corresponding standards framework in DIN EN ISO/IEC 42001 (edition 2026-08). The standard is voluntary and is not listed as a harmonized standard under the EU AI Act; it therefore does not give rise to a presumption of conformity.

Co-determination: when the works council has a say

Where there is a works council, the policy is not purely a management matter. The BetrVG expressly mentions artificial intelligence in three places:

• Section 90 (1) no. 3 BetrVG: The employer must inform the works council in good time about the planning of work procedures and work processes "including the use of artificial intelligence"; consultation on the measures is required by subsection 2.
• Section 80 (3) sentence 2 BetrVG: If the works council has to assess the introduction or application of artificial intelligence, "the involvement of an expert shall be deemed necessary in this respect" — the necessity is thus presumed by law and no longer has to be justified. Under sentence 1, the works council must still reach an agreement with the employer on the person, scope, and costs.
• Section 95 (2a) BetrVG: Co-determination on selection guidelines also applies when artificial intelligence is used in drawing them up.

In addition, there is Section 87 (1) no. 6 BetrVG for technical devices intended to monitor behavior or performance — the wording does not mention AI; extending it to systems suitable for monitoring is a matter for case law. Whether a specific AI tool is subject to co-determination therefore depends on the individual case and cannot be answered across the board. For high-risk systems in the workplace, Art. 26 (7) of the EU AI Act additionally requires informing the workers' representatives and the affected workers before putting the system into service.

Data protection and trade secrets

The Datenschutzkonferenz (Data Protection Conference) of the German supervisory authorities has published several guidance documents on AI: on artificial intelligence and data protection in May 2024, on recommended technical and organisational measures for the development and operation of AI systems in June 2025, and on generative systems using the RAG method in October 2025. They are administrative practice, not a legal norm — but they show what supervisory authorities measure an AI deployment against.

In practice, data protection and trade secret protection amount to the same rule: whatever is entered into an AI system may, under certain circumstances, leave the controlled area. For entities that fall under the NIS-2 implementation, there is the additional point that Section 30 (2) BSIG in any case requires concepts for risk analysis and for security in information technology (no. 1) as well as basic training and awareness-raising measures (no. 7). Anyone who wants to sort the terms from the field first will find them in the AI glossary.

Introduce, train, review

The pressure to act is measurable. According to the study report „Künstliche Intelligenz in Deutschland“ by the digital association Bitkom (telephone survey of 604 companies with 20 or more employees, 2025), only 23 percent of companies have fixed rules for the use of generative AI; 31 percent are planning them, 24 percent have not yet addressed the question, and 16 percent expressly rule out rules. At the same time, the share of companies in which, in the respondents' assessment, employees widely use generative AI that has not been provided has risen from 4 percent in 2024 to 8 percent. And 43 percent do not offer any AI training at all.

From the employees' perspective, the same survey confirms the picture: 70 percent of the employed persons surveyed state that their employer does not offer any continuing professional development on AI; 20 percent have already been trained. Two thirds name as the biggest disadvantage of AI in the workplace that it is unclear to whom the data goes. Precisely these two gaps — missing rules and missing competence — reinforce each other: anyone who does not know what is allowed does not ask, but tries it out in a private account.

This results in the sequence for the introduction: first survey which systems are actually in use, then write rules, then train — and only put the policy into force once the employees know what it contains. A policy that nobody knows only shifts the risk on paper. How often retraining takes place is not a question of the calendar but of the risk analysis; for getting started with AI literacy under Art. 4, Bridgly bundles the fundamentals in AI training courses.

Is an AI policy mandatory for companies?

No, no provision requires a document with this name. The European Commission expressly clarifies regarding Art. 4 EU AI Act that no specific governance structure is prescribed. Indirectly, however, regulatory needs arise from Art. 32 (4) GDPR, from Section 2 GeschGehG, and, for high-risk systems, from Art. 26 EU AI Act.

Is there an official template for an AI policy?

Not for companies. An official model AI policy from a federal authority does not exist in Germany. Authorities such as the BSI and the Bundesnetzagentur publish recommendations on what belongs in it; ready-made samples are available from chambers and publicly funded bodies such as the Mittelstand-Digital centers. No template replaces your own inventory.

Does the works council have to approve an AI policy?

That depends on the content. Section 90 BetrVG requires information (subsection 1 no. 3) and consultation (subsection 2) when artificial intelligence is used, and Section 95 (2a) requires co-determination on selection guidelines. A genuine co-determination right under Section 87 (1) no. 6 BetrVG presupposes a device intended or suitable for monitoring and must be examined in the individual case.

What must an AI policy contain at a minimum?

The scope, a list of approved systems with an approval process, rules for access and input data, responsibility for reviewed results, labeling obligations, responsibilities for training and incidents, and a fixed review cycle. The BSI sums up the guiding question like this: Who may use which AI systems for what purpose?

• Art. 4 EU AI Act – AI literacy, version of Regulation (EU) 2026/1744 (legal status: 4 Sep 2026, unofficial mirror)
• Art. 26 EU AI Act – Obligations of deployers of high-risk AI systems (legal status: 4 Sep 2026, unofficial mirror)
• European Commission – AI literacy: questions and answers on AI literacy (as of 27 Jul 2026)
• Bundesnetzagentur – AI literacy under Article 4 EU AI Act (accessed: 4 Sep 2026)
• Section 2 KI-MIG – Competent market surveillance authority (in force since 29 Jul 2026)
• Section 80 (3) BetrVG – Involvement of an expert in the case of artificial intelligence (version of 19 Jul 2024)
• Section 90 BetrVG – Rights to information and consultation, including the use of artificial intelligence (accessed: 4 Sep 2026)
• Section 95 (2a) BetrVG – Selection guidelines when artificial intelligence is used (accessed: 4 Sep 2026)
• Art. 32 (4) GDPR – Security of processing (legal status: 4 Sep 2026, unofficial mirror)
• Section 2 no. 1 GeschGehG – Definition of trade secret (accessed: 4 Sep 2026)
• Section 30 (2) BSIG – Risk management measures of particularly important and important entities (accessed: 4 Sep 2026)
• BSI – Management Blitzlicht „Generative KI für Unternehmen“ (as of 30 Aug 2024)
• Datenschutzkonferenz – Guidance documents on artificial intelligence (as of October 2025)
• DIN EN ISO/IEC 42001:2026-08 – AI management systems (accessed: 4 Sep 2026)
• Bitkom – Study report „Künstliche Intelligenz in Deutschland“ (February 2026; the figures on the rules follow Figure 25, while the running text at the same point gives a deviating 36 percent)
• Mittelstand-Digital Zentrum Berlin – AI policy for companies in 7 steps (as of 16 Jul 2026)
• Image license: AI-generated image (Bridgly), labeled "Created with AI" as an overlay; prompt in the field „Bild-Prompt (KI-Bild)“.

All sources accessed on 4 Sep 2026 unless otherwise stated in the entry. Legal texts carry their legal status in the entry; statistics carry their reference year.