How do you write an AI use policy that the EU AI Act actually asks for?
The EU AI Act asks for no document called an AI use policy. A policy is still the practical place to carry what it does ask for: literacy measures under Article 4, the prohibitions in Article 5, the disclosures in Article 50 and, for high-risk systems, the deployer duties in Article 26(1) and (2). Write it system by system, not only company-wide.
Written and last checked 9 October 2026 against Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744. Article 4 was replaced, Article 5(1) gained points (ba) and (bb), and Article 17(2) and Article 50(7) were replaced; Article 17(1), Article 26 and Article 50(3) to (5) were not amended.
The short answer
- No provision requires an AI use policy. "Acceptable use policies" appear only in what a general-purpose AI model provider documents for its model (Annexes XI and XII).
- Two kinds of provider owe written policies: high-risk providers, for the quality management system (Article 17(1)), and general-purpose AI model providers, on copyright (Article 53(1), point (c)).
- A use policy can carry four duties: Article 4 literacy measures, the Article 5 prohibitions, the Article 50 disclosures and, for high-risk systems, Article 26(1) and (2).
- The dates differ: Article 4 since 2 February 2025, in its current wording since 27 July 2026, and most of Article 5 since 2 February 2025, Article 50(3) and (4) since 2 August 2026 (an older synthetic-content system has until 2 December 2026 for its provider's Article 50(2) duty, under Article 111(4)), Article 26 from 2 December 2027 under Annex III and 2 August 2028 under Annex I (Article 113, as amended by Regulation (EU) 2026/1744), with a transitional rule for high-risk systems already on the market (Article 111(2), as replaced).
Does the EU AI Act require an AI use policy?
No. The phrase appears nowhere in Regulation (EU) 2024/1689 or in the 2026 amending act. The nearest is "the acceptable use policies applicable", which a general-purpose AI model provider documents for the AI Office and the national competent authorities, on request (Section 1, point 1(b), of Annex XI) and for the companies building on its model (point 1(b) of Annex XII). That is the vendor's, not yours.
Written policies are required in two places, and neither is a use policy. A provider of a high-risk AI system documents its quality management system "in a systematic and orderly manner in the form of written policies, procedures and instructions", covering at least the thirteen aspects that paragraph lists (Article 17(1)). Providers that are financial institutions subject to requirements regarding their internal governance, arrangements or processes under Union financial services law are deemed to meet that obligation through those rules, except for points (g), (h) and (i), taking into account any harmonised standards referred to in Article 40 (Article 17(4)); the quality management system guide covers the rest. A provider of a general-purpose AI model must "put in place a policy to comply with Union law on copyright and related rights" (Article 53(1), point (c)). The open-source exception in Article 53(2) lifts only points (a) and (b), not this one.
What can a use policy do for Articles 4, 5, 26 and 50?
Article 4. As replaced by Regulation (EU) 2026/1744, Article 4(1) requires providers and deployers to "take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used". It does not require them "to guarantee any specific level of AI literacy of any individual". A policy is one measure. One text sent to everyone takes no account of role or system, which is why the per-system part matters more than the preamble. The AI literacy guide covers the article in full.
Article 5. Every point of Article 5(1) prohibits "the use" of the practice it describes, so a deployer can breach it without building anything. Name the practices as forbidden uses, in the words of the article: the ten prohibited practices lists them. The eight original points have applied since 2 February 2025 under Article 113, third paragraph, point (a). Points (ba) and (bb), added in 2026, apply from 2 December 2026 (Article 113, third paragraph, point (a), as replaced). They prohibit a deployer's use only "where the deployer uses the system for the purpose of generating or manipulating such material or performance" (Article 5(1a), point (b)).
Article 50. Two paragraphs bind deployers. Copy them into the policy whole, because a summary is where the exceptions go missing:
- Article 50(3): "Deployers of an emotion recognition system or a biometric categorisation system shall inform the natural persons exposed thereto of the operation of the system, and shall process the personal data in accordance with Regulations (EU) 2016/679 and (EU) 2018/1725 and Directive (EU) 2016/680, as applicable. This obligation shall not apply to AI systems used for biometric categorisation and emotion recognition, which are permitted by law to detect, prevent or investigate criminal offences, subject to appropriate safeguards for the rights and freedoms of third parties, and in accordance with Union law."
- Article 50(4), first subparagraph: "Deployers of an AI system that generates or manipulates image, audio or video content constituting a deep fake, shall disclose that the content has been artificially generated or manipulated. This obligation shall not apply where the use is authorised by law to detect, prevent, investigate or prosecute criminal offence. Where the content forms part of an evidently artistic, creative, satirical, fictional or analogous work or programme, the transparency obligations set out in this paragraph are limited to disclosure of the existence of such generated or manipulated content in an appropriate manner that does not hamper the display or enjoyment of the work."
- Article 50(4), second subparagraph: "Deployers of an AI system that generates or manipulates text which is published with the purpose of informing the public on matters of public interest shall disclose that the text has been artificially generated or manipulated. This obligation shall not apply where the use is authorised by law to detect, prevent, investigate or prosecute criminal offences or where the AI-generated content has undergone a process of human review or editorial control and where a natural or legal person holds editorial responsibility for the publication of the content."
The information is given "in a clear and distinguishable manner at the latest at the time of the first interaction or exposure" and "shall conform to the applicable accessibility requirements" (Article 50(5)). Article 50(3) to (5) have applied since 2 August 2026 (Article 113, second paragraph); only the provider duty in Article 50(2) has a later date, 2 December 2026, for systems placed on the market before 2 August 2026 (Article 111(4)). The four Article 50 disclosures covers the provider duties as well.
Article 26. For a high-risk system, the deployer takes "appropriate technical and organisational measures to ensure they use such systems in accordance with the instructions for use accompanying the systems, pursuant to paragraphs 3 and 6" (Article 26(1)), and assigns human oversight to natural persons "who have the necessary competence, training and authority, as well as the necessary support" (Article 26(2)). Both are "without prejudice to other deployer obligations under Union or national law and to the deployer's freedom to organise its own resources and activities for the purpose of implementing the human oversight measures indicated by the provider" (Article 26(3)). The policy is where you organise them. Article 26 applies from the dates above, subject to Article 111(2), as replaced, for systems already on the market; the deployer obligations guide covers its other paragraphs.
What should the policy contain?
Nine things, each tied to what it serves:
| What the policy says | What it serves |
|---|---|
| The systems it covers, each with an owner | Article 4 measures take account of each system's context; Article 26 attaches per high-risk system |
| What each system is for, and what it must not be used for | Article 26(1) and the instructions for use; a new purpose can make you a provider under Article 25(1), point (c) |
| The prohibited practices, named | Article 5(1) |
| When to tell people that AI is in use or made the content | Article 50(3), (4) and (5) |
| Who oversees each high-risk system, by name | Article 26(2) |
| The briefing each role gets, per system | Article 4(1) |
| What to do when a system is wrong or behaves unexpectedly | Article 26(5), for high-risk systems |
| How to ask for a new tool | Keeping the list in the first row current |
| Who reviews the policy, and when | Keeping every row above true |
What does Complipath do here, and what does it not?
Complipath has no template for an AI use policy or an acceptable-use policy. What it has on Starter is the per-system half. The AI literacy tracker sends each person a briefing for the systems they work with, in eight sections. Three take your company's own words, among them what the system must not be used for and what to do when it is wrong; the rest come from your register, from documentation a person confirmed and from your plan. Each person presses "I have read this", and you download the record as PDF or CSV. It records a reading, not competence. The step-by-step plan lists each system's next steps by role, with the article behind every step. Every live Complipath feature is on one page, and the ranking of compliance tools for mid-size companies compares the alternatives.
What this means for you
If you're a provider: your staff use AI too, so everything above applies to you as a deployer of those tools. For a high-risk system you place on the market, Article 17(1) asks for written policies in the quality management system, and your Article 13 instructions for use are what your customers' Article 26(1) measures rest on.
If you're a deployer: start from the register, not from a template. Name the forbidden uses in the words of Article 5, write the Article 50 disclosure rules for the teams that publish content, and for each high-risk system name the people who oversee it under Article 26(2).
FAQ
Does the EU AI Act require an AI use policy? No provision requires a document by that name. Providers of high-risk systems document a quality management system in written policies, procedures and instructions under Article 17(1), and general-purpose AI model providers owe a copyright policy under Article 53(1), point (c). For everyone else, a use policy is a practical way to carry duties in Articles 4, 5, 26 and 50.
Is a policy enough to meet the AI literacy duty? Not on its own. Article 4(1) asks for measures that take into account technical knowledge, experience, education and training, the context systems are used in and the persons they are used on. One text sent to everyone takes no account of who reads it. It does not require you to guarantee any specific level of AI literacy of any individual.
What should the policy say about labelling AI content? Disclose a deep fake under Article 50(4), with a lighter rule for evidently artistic, creative, satirical, fictional or analogous work. Disclose AI text published to inform the public on matters of public interest, unless it had human review or editorial control and someone holds editorial responsibility. Uses authorised by law to detect, prevent, investigate or prosecute criminal offences are excepted.
Can we use our AI vendor's acceptable use policy as ours? Not as the whole of it. A vendor's usage policy says what its product may and may not be used for, and for a general-purpose AI model the provider documents the acceptable use policies applicable for the companies that integrate it (point 1(b) of Annex XII). Copy its restrictions into your policy, then add what the Act asks of you.
Sources: Regulation (EU) 2024/1689 (EUR-Lex), Article 4, Article 5, Article 13, Article 17, Article 25(1), Article 26, Article 50, Article 53, Article 111(2), Article 113 and Annexes XI and XII; as amended by Regulation (EU) 2026/1744 (EUR-Lex), which replaced Article 4, inserted Article 5(1), first subparagraph, points (ba) and (bb) and Article 5(1a) and (1b), and replaced Article 17(2), Article 50(7), Article 111(2) and Article 113, third paragraph, points (a) and (c). Article 17(1) and (4), Article 26, Article 50(3) to (5) and Article 53 were not amended.
Where this question meets the product: the AI literacy tracker. Answering it in a customer's questionnaire: how to answer AI questions in a supplier questionnaire. The feature that does this in the app: AI Act technical documentation software. Tools ranked on it: Best Annex IV documentation software. Everything else: every live Complipath feature.