How to write an AI policy for your company
An AI policy does double duty: it sets sensible ground rules for your team, and it is the clearest way to show you have taken AI literacy seriously under Article 4.
Keep it short and real
A policy nobody reads protects nobody. Aim for a page or two in plain language, about the tools your people actually use, rather than a long document about AI in the abstract.
The test of a good AI policy is not its length but whether someone could read it in five minutes and come away knowing what they are allowed to do.
What to cover
The essentials are: which tools are approved, and for what; what must never be entered, such as confidential or personal data a tool is not cleared for; when a human has to review output before it is relied on; and who to ask when someone is unsure.
It also helps to say plainly what is off limits, for example using AI to make a final decision about a person without a human review, so the high-risk lines are clear before anyone crosses them.
Set the AI literacy expectation
State plainly that people using AI are expected to understand its limits, and point to the training or guidance you provide. This is the part that speaks directly to the Article 4 literacy duty.
You do not need a formal course. A short briefing, the policy itself, and a named person to ask are enough for most teams to meet the bar.
Name an owner and a review date
Put one person in charge of the policy, and set a cadence to revisit it. A policy with no owner drifts out of date the moment your stack moves.
Quarterly or twice-yearly is plenty for most businesses. The point is that someone is actually looking, not the exact interval.
Make it easy to follow
Pair the policy with a short approved-tools list and a simple way to request a new tool. People follow a policy they can work with, and route around one that gets in the way.
If saying yes to a sensible new tool takes a quick message rather than a committee, your team will keep you in the loop instead of adopting things quietly.
A starting point
Veillo generates an AI Literacy Policy from your company details, so you start by editing a draft rather than facing a blank page. It is general by design and meant to be adapted to how you actually work.
Because it is generated from your register, it can reference the tools and uses you have actually recorded, which makes it concrete rather than generic.
This guide is general educational information, not legal advice. For how the Act applies to your organisation, classify your systems and consult qualified counsel.
Put it into practice
Classify your AI systems against the Act and generate the documents this guide describes.