Using AI tools at work without the employer's knowledge and approval: an employee pastes a customer's email into a free chat service for a summary, or translates a draft contract with the browser's AI. It appears when a tool is banned or missing but the need is real. The risk of shadow AI is not the AI but that data flows to a service whose terms nobody has read, and that nobody checks the result.

Does the law require an AI use policy?

Not by that name. Article 4 of the AI Act requires measures to support staff AI literacy, and Article 26(7) requires informing workers before a high-risk system is used at the workplace. The GDPR requires that personal data is processed only for a defined purpose and that there is a contract with any processor. A use policy is how these obligations become an instruction an employee can follow.

What must a use policy contain at minimum?

The approved tools and the route for requesting a new one; what data may and may not be entered; who is responsible for checking the output; when AI use is disclosed to a customer or content is labelled; which purposes require a separate assessment before use; how training is arranged and evidenced; how an error or a leak is reported; and who owns the policy and when it is updated.

How is a policy rolled out so that it is followed?

By offering an approved route for every need that shadow AI has revealed, by training the rules briefly and repeatedly rather than in one announcement, and by keeping the reporting threshold low: an employee who admits to entering the wrong data is thanked, not reprimanded. A policy nobody reads does not meet Article 4's requirement of measures; training whose completion is recorded does.

An AI use policy for the workplace: what it must say to end shadow AI

Shadow AI appears when a tool is banned but the need remains. A working policy says what may be used and entered, who checks the output and how it meets Article 4 of the AI Act.

In brief

An AI use policy is an organisation's written position on which AI tools may be used at work, for what, with what data and under whose responsibility. No law requires it by that name, but the AI Act's Article 4 requirement of measures supporting AI literacy, its Article 26 requirement to inform workers about high-risk systems, and the GDPR's requirements on purpose and processors are in practice met through it. The policy's most important job is to end shadow AI: not by banning but by offering an approved route for every real need.

Why a ban creates shadow AI

When an organisation bans AI tools, it does not remove the need to summarise a long report, translate a message or draft a reply. The need remains, and it is met by a free service in the browser that nobody has assessed. This is shadow AI, and its risks are familiar: a customer's data flows to a service whose terms allow it to be used for training; nobody checks the output, because the use cannot be admitted; and when something goes wrong, nobody says so.

Our skills catalogue describes the skill AI governance in the organisation at four levels, and at level 2 an employee uses only approved tools and reports the need for a new one instead of adopting it alone. This works only if there are approved tools and a route for reporting the need. A policy that only says no teaches the employee to stay quiet.

What the law requires, even without requiring a policy

Article 4 of the AI Act, as amended by Regulation (EU) 2026/1744, obliges providers and deployers to take measures to support the development of their staff's AI literacy, taking into account their knowledge, training and the context of use. The obligation does not require guaranteeing anyone a particular level, but it does require measures, and a measure is something that can be shown to have been done. A written position and training on it are a measure; a ban buried in an email is not. The article is covered in Article 4 of the AI Act.

Article 26(7) obliges an employer to inform workers' representatives and the affected workers before putting a high-risk system into use at the workplace that they will be subject to one. Recruitment screening and workforce management systems are high-risk areas under Annex III, so the policy must recognise them before anyone puts them into use. That is covered in High-risk AI.

Article 5 of the GDPR requires that personal data is processed only for a specified purpose and only to the extent necessary, and Article 28 that there is a contract with any service that processes personal data. An AI service into which a customer's data is entered processes personal data, and its role must be established first. A service that processes the data only on the organisation's behalf and on its instructions is a processor and needs an Article 28 contract. A service that uses the inputs for its own purposes, such as training its model, is a controller in its own right, and giving it the data is a disclosure that needs a legal basis of its own. A free consumer service is usually the latter. That is why "what may be entered" is the data protection core of the policy; it is treated separately in What may be entered into an AI tool at work?.

What the policy must contain

A working use policy is short. Its eight parts answer the questions employees actually ask.

Part	The question it answers	What it rests on
Approved tools and procurement route	What may I use, and how do I ask for something new	GDPR Article 28, the organisation's own procurement
Data that may be entered	What may I paste into a prompt	GDPR Article 5, confidentiality obligations, licence terms
Responsibility for checking	Who answers for what the AI produced	The person who signs the output; the model does not
Transparency	When do I tell the customer, when do I label content	AI Act Article 50
Limits on purposes	What may I not do without a separate assessment	AI Act Article 5 prohibitions, Annex III, Articles 26 and 27
Training and evidence	What must I know and how is it verified	AI Act Article 4
Incidents	What do I do when I entered the wrong data or the output was wrong	GDPR Article 33, the organisation's reporting route
Owner and updates	Who looks after this and when does it change	The AI officer; updated when tools or the law change

Each row is one or two paragraphs. A ten-page policy is not the one an employee remembers while pasting a customer's message into a prompt.

Responsibility for checking is the policy's most important sentence

One sentence settles more than any other: whoever uses an AI output answers for it. A language model produces fluent text that can be wrong, and the error does not show in the text. If the policy says the output is a draft that the employee checks and answers for as their own, AI use is a professional's tool. If the policy does not say it, the output goes to the customer unchecked and responsibility is sorted out afterwards.

This is also where Article 4's AI literacy becomes concrete. Literacy is not writing prompts but knowing what the model cannot do: it does not know the organisation's internal matters, it invents sources, it continues the pattern when the facts run out. This is learned by practising, not from an announcement.

How the policy is rolled out

Roll-out is three things. First an inventory of what staff already use. Mapping shadow AI is best done without consequences, because the aim is to surface needs, not culprits. Every need found gets an approved route in the policy or a reasoned refusal.

Then training that is short and repeated. The policy's rules are few, but they must be remembered in the situation where the temptation is to skip them. Regular repetition keeps them in mind, and a recorded completion is the evidence of an Article 4 measure. Why short and repeated beats a training day is explained in Microlearning at work.

Finally an owner. At level 3 of our skills catalogue a supervisor drafts and rolls out the policy for their own area and recognises shadow AI, and at level 4 the AI officer builds the governance system and ties it to legal obligations. Without a named owner the policy goes stale at the first new tool. Who in the organisation is responsible for AI use is covered in Who in the organisation is responsible for AI use?.

What the policy does not solve

A policy does not make a tool safe. The approved tool's contract, where the data resides and whether the service learns from inputs are settled in procurement, and the policy only points to it. Nor does a policy replace the assessment of a high-risk system: it recognises that an assessment is needed and says who does it. And a policy does not stop someone who decides to break it. Its job is that an honest employee knows how to act correctly, and that acting correctly is easier than acting wrongly.