What should an AI use policy cover under the EU AI Act?

Download it, with no email asked

• AI use policy template, Markdown

What is in it

Scope

• This policy covers every AI system [Company] builds, buys or uses for its work, including tools people sign up for themselves.
• It applies to staff and to contractors, agency workers and anyone else who uses AI on [Company]'s behalf.
• Owner: [name, role]. Approved by: [name]. Next review: [date].

Register before use

• An AI system is used for [Company]'s work only once it is in the AI inventory with an owner and a confirmed classification.
• Anyone who wants to start using an AI tool tells [owner or channel] first.
• A change of purpose, vendor or model is reported the same way, because it can change the classification.

AI literacy

• [Company] takes measures to support the AI literacy of its staff and of other persons dealing with the operation and use of AI systems on its behalf.
• The measures take into account each person's technical knowledge, experience, education and training, the context the systems are used in and the persons or groups they are used on.
• The duty does not require [Company] to guarantee any specific level of AI literacy of any individual.
• Practice: everyone reads the briefing for a system before first use and again when it changes, and [Company] records who read what and when. Article 4 prescribes no record.
• Article 4 has applied since 2 February 2025 (Article 113, third paragraph, point (a)).

Provision: Article 4(1), as replaced by Regulation (EU) 2026/1744

Uses that are never allowed

• No one uses an AI system for a practice Article 5 prohibits, whatever the tool or the vendor.
• The list is attached word for word: Article 5(1), first subparagraph, including points (ba) and (bb), and Article 5(1a) and (1b), which Regulation (EU) 2026/1744 inserted. A summary drops the conditions and exceptions that decide each case.
• Article 5 has applied since 2 February 2025; points (ba) and (bb) and Article 5(1a) and (1b) apply from 2 December 2026 (Article 113, third paragraph, point (a), as replaced by Regulation (EU) 2026/1744).
• Practice: anyone unsure whether a use falls under Article 5 stops and asks [legal contact] before going on.

Provision: Article 5

High-risk systems we deploy

• For each high-risk system [Company] uses as deployer, the owner takes appropriate technical and organisational measures so that it is used in accordance with its instructions for use (Article 26(1)).
• Human oversight is assigned to named people who have the necessary competence, training and authority, as well as the necessary support (Article 26(2)).
• Where [Company] controls the input data, it is relevant and sufficiently representative in view of the system's intended purpose (Article 26(4)).
• The owner monitors the system on the basis of its instructions for use and, where relevant, informs the provider in accordance with Article 72 (Article 26(5)).
• If there is reason to consider that using it in accordance with the instructions may result in a risk within the meaning of Article 79(1), the provider or distributor and the relevant market surveillance authority are told without undue delay and use is suspended (Article 26(5)).
• A serious incident: the provider is told first, immediately, then the importer or distributor and the relevant market surveillance authorities. If the provider cannot be reached, Article 73 applies mutatis mutandis. The duty does not cover sensitive operational data of deployers that are law enforcement authorities (Article 26(5)).
• A financial institution subject to internal governance requirements under Union financial services law is deemed to fulfil the monitoring obligation by complying with those rules (Article 26(5), second subparagraph).
• Logs the system generates automatically are kept, to the extent [Company] controls them, for a period appropriate to its intended purpose and of at least six months, unless Union or national law provides otherwise, in particular on personal data (Article 26(6)).
• A financial institution under Union financial services law keeps those logs as part of the documentation that law requires (Article 26(6), second subparagraph).
• Before a high-risk system is put into service or used at the workplace, [Company] as employer tells the workers' representatives and the affected workers that they will be subject to it, following the rules on informing workers where they apply (Article 26(7)).
• Where [Company] uses a high-risk Annex III system to make, or assist in making, decisions related to natural persons, those persons are told they are subject to its use (Article 26(11)); for law enforcement purposes, Article 13 of Directive (EU) 2016/680 applies.
• Where applicable, the provider's information under Article 13 is used to carry out a data protection impact assessment under GDPR Article 35 or Article 27 of Directive (EU) 2016/680 (Article 26(9)).
• [Company] cooperates with the competent authorities in any action they take in relation to the system (Article 26(12)).
• Not in this template: Article 26(8), for deployers that are public authorities or Union institutions, bodies, offices or agencies. Nor Article 26(10), on post-remote biometric identification in criminal investigations.
• These duties apply from 2 December 2027 for systems high-risk under Article 6(2) and Annex III and from 2 August 2028 under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744).

Provision: Article 26

Telling people when AI is involved

• A system [Company] provides that interacts directly with people tells them they are interacting with an AI system, unless that is obvious to a reasonably well-informed, observant and circumspect person, given the circumstances and the context of use (Article 50(1)).
• Synthetic audio, image, video or text generated by a system [Company] provides is marked in a machine-readable format and detectable as artificially generated or manipulated, with technical solutions that are effective, interoperable, robust and reliable as far as technically feasible, taking into account the specificities and limitations of the type of content, the costs of implementation and the generally acknowledged state of the art (Article 50(2)).
• That marking is not required where the system performs an assistive function for standard editing or does not substantially alter the input data or its semantics (Article 50(2)).
• A content-generating system placed on the market before 2 August 2026 has until 2 December 2026 for that marking (Article 111(4), added by Regulation (EU) 2026/1744).
• People exposed to an emotion recognition or biometric categorisation system [Company] deploys are informed of its operation, and their personal data is processed in accordance with Regulations (EU) 2016/679 and (EU) 2018/1725 and Directive (EU) 2016/680, as applicable (Article 50(3)).
• Image, audio or video deep fakes [Company] generates or manipulates are disclosed as artificially generated or manipulated. In an evidently artistic, creative, satirical, fictional or analogous work or programme, it is enough to disclose that such content exists, in a way that does not hamper the display or enjoyment of the work (Article 50(4), first subparagraph).
• Text [Company] generates or manipulates and publishes to inform the public on matters of public interest is disclosed as artificially generated or manipulated, unless it has undergone human review or editorial control and a natural or legal person holds editorial responsibility for its publication (Article 50(4), second subparagraph).
• Each of paragraphs 1 to 4 excepts certain uses authorised or permitted by law in relation to criminal offences, on the conditions that paragraph sets.
• The information is given in a clear and distinguishable manner at the latest at the first interaction or exposure, and meets the applicable accessibility requirements (Article 50(5)).
• Article 50 applies from 2 August 2026 (Article 113, second paragraph), apart from the later date for Article 50(2) above (Article 111(4)).

Provision: Article 50

Data and approved tools

• Only tools on [Company]'s approved list are used with customer data, personal data or confidential information.
• Approved tools and what each may be used for: [list].
• Before a tool is approved, [owner] checks the vendor's terms on training with our data, where the data is processed and who receives it.

Checking output

• A person reads AI output before it is sent to a customer, published or used in a decision about a person.
• Output that looks wrong, unfair or unsafe is not used and is reported to [contact].

Reporting problems

• Errors, misuse and harm involving an AI system are reported to [contact] the same day.
• For a high-risk system, the owner then follows the Article 26(5) steps above.

Review

• This policy is reviewed every [period] and when the law, a system or a vendor changes.
• Version: [number]. Changes since the last version: [list].

The same work, in the app

Complipath has no template for an AI use policy; its step-by-step plan turns the same provisions into steps for your own systems, with Article 4 and Article 5 for every workspace with a system, Article 50 where a confirmed classification created that duty and Article 26 for each high-risk system you use as a deployer, each step quoting its article. Step-by-step plan.

The provisions it names

Article 4(1), as replaced by Regulation (EU) 2026/1744; Article 5; Article 5(1a) and (1b) and Article 5(1), first subparagraph, points (ba) and (bb), inserted by Regulation (EU) 2026/1744; Article 17(1); Article 26; Article 50; Article 111(4), added by Regulation (EU) 2026/1744; Article 113, second paragraph; Article 113, third paragraph, points (a) and (c), as replaced by Regulation (EU) 2026/1744. Each is in Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744.