Step 5
The rules for your staff: the AI use policy
By the end you will have a policy with a version and a date, its approval recorded, communicated to the people who apply it and with their acknowledgements on file.
What this step is
The AI use policy is the document that tells your team which tools it may use, which data never goes into them, who reviews the results and whom to alert if something goes wrong. Which clauses it needs is covered in its own article, linked at the end. This step deals with what comes after drafting it: how its approval is recorded, how it is communicated, how acknowledgements are collected and when it is reviewed.
A policy kept in a loose document leaves no record of which version applies or who has read it. The aim of this step is to give both questions a written answer: the current version, with its date, and the list of people who have acknowledged it.
It comes after the inventory and the classification on purpose. With the real systems in front of you, the list of authorised tools stops being generic and the policy can name the systems in the inventory instead of abstract categories. And it comes before the AI literacy measures in Step 6, because knowing the policy is the first of them.
Why
The policy is an internal methodological control, not a legal obligation in itself: it sets out your internal rules on the use of AI and keeps a record of how it was circulated. It does not replace legal advice, and its value depends on two things no template comes with: that people know it and that it is kept up to date.
What it contains does rest on legal obligations. The training clause is one of the AI literacy measures under Article 4 of Regulation (EU) 2024/1689, which Step 6 covers. The rules on which personal data never goes into a tool, and with which vendors, rest on the GDPR and on the data processing agreement from Step 4.
If your organisation is in Spain, two employment rules shape how the policy is drawn up and communicated. Where the policy sets criteria for the use of digital devices, Article 87(3) of the LOPDGDD requires workers’ representatives to take part in drawing them up and staff to be informed of those criteria. And if you use algorithmic or automated decision-making systems —including those that are not AI—, article 3(2)(k) of Spain’s RD 723/2026 (Real Decreto 723/2026) requires each worker to be informed in writing of their existence and, where they decide on working conditions, of their guidelines, criteria and rules, in employment relationships lasting more than four weeks. That information, and the information that Article 64(4)(d) of the Estatuto de los Trabajadores gives the works council, are documents in their own right: the policy does not replace them.
How, in three actions
Record the approval of a specific version
Once the text has been reviewed, whoever has the authority to do so —management, or the AI Officer you appointed in Step 0— records their approval of that version, with their name, their role and the date. The version carries a number and a date on its cover. If you later change a single rule, that is a new version; the previous one is kept, because it is the one that applied until that day.
Send it to the people who apply it, not only to its authors
Send it to everyone who uses AI systems in their work, with a short message saying what changes for them and whom to ask. Include those who join later: the policy becomes part of onboarding. If there is workers’ representation and the policy sets criteria for the use of digital devices, their involvement comes before this mailing, not after.
Collect acknowledgements and date the review
Ask each person to confirm in writing that they have received and read the current version, and keep each acknowledgement with its date. Set the first review: no rule fixes how often, but once a year and whenever the tools, the vendors or the rules change is a sound minimum. Each new version is acknowledged afresh; earlier acknowledgements are kept.
The typical mistake
Posting the policy on the intranet and calling it communicated.
A document in a shared folder proves neither that anyone has read it nor which of its versions applied on the day someone put a customer’s data into an unauthorised tool. Without acknowledgements there is no way to know who knew the rules, and without a version there is no way to know what the rules were. Three things prevent it: a dated version, a copy sent to each person and an individual acknowledgement on file. It is more work the first time; later versions reuse the same list of recipients and the same procedure.
The template
Eight clauses for drafting your organisation’s AI use policy, each with sample wording and the legal basis behind it. The last one, on the involvement of representatives and on review, is the one this step puts into practice.
AI use policy template for companiesEstimated time
Two or three days of work between days 16 and 22: one to adapt the template to your systems, another for review and recording the approval, and the rest to communicate it. Acknowledgements keep arriving while you move on to Step 6.
What you take away
The current version of your AI use policy, with its date and approval recorded, a record of how it was communicated to staff and the acknowledgement record, with the date of its next review.
How it works in Alethexis
In Alethexis, the policy starts from a template for your sector, is edited section by section, goes through review, has its approval recorded and is published by the Owner; each publication is a new version, with its PDF and the SHA-256 integrity hash of the file, and earlier versions are kept.
Each member acknowledges the current version from the section itself, and the block shows how many have done so, for example “4 of 6 members have acknowledged it”; a new version is acknowledged afresh and earlier acknowledgements are kept.