Your AI policy
Mar 31st, 2025 by Jesper Kråkhede
Following the AI Act post last month, many have asked for advice on an AI policy. Here is what I think it should cover, in plain language.
Which tools are allowed. List the approved AI services and how to request new ones. Be clear that unapproved services must not be used with company data.
What data may be used. Public information is usually fine. Internal, confidential and personal data only in approved tools that keep the data inside your control. Some data, like health information or trade secrets, might not be allowed at all.
Who is responsible for the result. AI can be wrong, and it can be confidently wrong. The person who uses the output is responsible for checking it, just as with any other source.
Transparency. When should customers or colleagues be told that AI was used? At least when it affects decisions about people.
Building AI. If you develop your own AI solutions or agents, they must go through the same security and privacy review as any other system, plus an assessment of AI specific risks.
Training and ownership. Everyone gets basic training. Someone owns the policy and reviews it regularly, because the technology is moving fast.
Keep it short. A policy nobody reads protects nobody.
The best AI policy fits on two pages and is actually followed.