AI use without clear agreements increases privacy risks and uncertainty inside teams. A clear AI policy helps your organisation work responsibly and still leave room for innovation.
AI offers opportunities, but it raises questions about confidential information, mistakes and responsibility. Practical agreements make clear which applications employees may use, which information they may enter and when human oversight is needed.
You will read how to protect data, weigh security risks and steer AI use inside HR, IT, marketing and finance. You will also discover how to make guidelines workable in day-to-day processes, so teams know when to check, correct or ask for help.
Key takeaways
- Lay down which data employees may and may not enter into AI applications.
- Weigh innovation against privacy, security, fundamental rights and possible social consequences.
- Translate central agreements into concrete guidelines for IT, marketing, HR and finance, among others.
- Follow how teams apply the agreements and decide where extra explanation or support is needed.
Table of contents
- How can AI policy protect the privacy of data in AI applications?
- How can AI policy strike a balance between innovation and national security?
- AI guidelines for HR, IT, marketing and finance
- Why does an organisation need an AI policy?
- elli: employee engagement platform
How can AI policy protect the privacy of data in AI applications?
Protect personal data by laying down in advance which information AI systems may process and who gets access. With generative AI, also set agreements about external applications, confidential information and generated content. A practical AI policy helps teams guard those boundaries in their daily work.
Data security and privacy
Privacy determines how personal data is collected and used. Data security protects that information from unwanted access and misuse. Both matter when, for example, an employee enters customer data into an AI system. Lay down which data is confidential, where employees may process it and which access rights apply. A DPIA assesses the privacy risks of an AI application. Limit input to what the process needs and prevent sensitive information from ending up in public applications.
AI legislation and privacy rules
The European AI regulation focuses on AI risks, while the GDPR contains rules for personal data. Those frameworks meet one another as soon as an application uses personal data. According to the European Union, the obligations of the European AI regulation for providers of GPAI models became applicable on 2 August 2025. According to the European Union, Article 5 prohibits certain AI practices, including manipulative systems, social scoring and emotion recognition in the workplace. Translate those frameworks into internal agreements. Appoint an owner per application to assess risks before use starts.
Privacy in data governance
Data governance lays down who manages information, what it is used for and how access is arranged. Also include source confidentiality and business confidentiality. VRT NWS shares only publicly available information with external AI systems that do not run on a VRT server. That is a practical example: do not share confidential documents, personal data or unpublished source information with an external application. Make clear per process which input is allowed and who checks the result. Lay down how employees report incidents and how generated information is reviewed before it is shared. That is how your AI policy connects privacy agreements to day-to-day work processes.
How can AI policy strike a balance between innovation and national security?
A clear framework makes responsible experimentation possible and sets limits on applications that pose risks to people or security. A multidisciplinary team brings together technological development, human oversight and societal impact. The agreements help teams weigh opportunities and risks per application.
Developing AI policy in steps
Work the framework out in seven steps so responsibilities and risks become clear.
- Map the applications in use and planned, including shadow AI.
- Determine per application the purpose and the processes involved.
- Assess possible consequences for fundamental rights and societal groups.
- Map data sources, access and cyber risks.
- Appoint owners from management, ICT, privacy and communications.
- Lay down human oversight, stop decisions and incident reporting.
- Revise agreements when use, technology or risks change.
Technology with dual-use potential deserves attention for possible misuse. That is how experiments can keep running within agreed limits. The AI readiness and change readiness of teams partly determines how they put those agreements into practice.
Elements of a good AI policy
A good framework ties ethical principles to concrete choices about the development and use of AI. Lay down who assesses an application, which data is appropriate and when a human checks the result. Include transparency, possible biases, security and responsibilities. Employees must be able to report risks and raise doubts. That is how teams also weigh social consequences in innovation.
Belgian guidelines and model documents
The Flemish AI strategy offers governments a framework to assess AI for public processes and services. Use such principles as a reference and translate them to your own processes and risks. The European AI regulation takes a risk-based approach. A multidisciplinary team can translate that context into internal working agreements, with room for responsible development and clear human responsibility.
AI guidelines for HR, IT, marketing and finance
For ChatGPT and other generative AI applications, your organisation’s internal agreements apply at work. Make clear per team which tasks are suitable, who assesses the result and when use is not appropriate. That gives employees practical room without each department having to come up with its own rules.
Translate the framework into recognisable work situations:
- HR: use AI for a first draft of a general job description or internal announcement. Let an employee check whether the text is correct and fits the organisation.
- IT: keep track of which applications teams use and who holds functional ownership. Assess new applications before employees deploy them for work processes.
- Marketing: use AI, for example, to explore variations of a campaign text. Check facts, tone and rights to images or text before publication.
- Finance: let AI help structure a non-confidential analysis. A finance lead checks assumptions and conclusions before they end up in reports.
Also describe a simple procedure for exceptions. An employee who wants to deploy a new application presents the purpose, the information needed and the expected result to the designated owner. That owner assesses whether a trial is appropriate and which checks remain necessary. That is how you prevent uncertainty from leading to use outside the agreed way of working.
Make agreements findable in the place where teams work, for example in an internal knowledge portal or project environment. Pair each guideline with a concrete example and a point of contact. Let team leads flag where employees get stuck and adjust instructions when a task, application or working method changes. That way the guidelines fit day-to-day practice and teams can use AI purposefully, with clear responsibility for the final result.
Why does an organisation need an AI policy?
Without shared agreements, different rules emerge per team. One employee enters customer information into a public application, while a colleague carefully shields the same information. An AI policy makes clear which applications fit the organisation’s goals and where the limits lie. That gives innovation direction instead of leaving it as a scattering of experiments without ownership.
Policy helps make risks manageable. Think of a generated summary with incorrect facts, a model outcome that disadvantages certain groups, or confidential information that is shared by accident. Lay down, therefore, who assesses applications, who checks the results and who can pause their use. Employees must also know where they report doubts or incidents.
Clear agreements support responsible experimentation. A team can, for example, test an AI application with non-confidential data, a defined purpose and human oversight. The owner then assesses the quality of the results, the impact on the work process and any unexpected effects. If the application does not work as intended, the team can adjust or stop its use.
An organisation can follow how agreements are working through concrete signals: which applications teams use, how many employees know the guidelines and which questions or incidents keep coming back. Discuss those signals regularly with representatives from ICT, privacy and the teams involved. That makes clear where extra explanation is needed and which agreements are insufficiently clear in day-to-day practice.
Trust also demands clear responsibility. When an AI system suggests a customer message or internal analysis, an employee remains responsible for checking it and for using it. Lay down which decisions AI may support and when human assessment remains necessary. That gives employees something to hold on to and makes it visible to those involved how the organisation uses AI.
Make the policy accessible and testable. Give employees short examples per application and appoint a recognisable point of contact. Revise agreements when processes or systems in use change. That way AI policy stays a practical part of leadership, rather than a document teams rarely consult.
Download the white paper: Human-ready is AI-ready
elli: employee engagement platform
elli helps you translate guidelines into actual AI adoption. The workforce intelligence platform maps how teams deal with AI, where use lags and which factors explain that. That way you see not only whether agreements exist, but also where employees need knowledge, skills or support.
A change readiness assessment is suitable when you introduce AI policy or roll out an AI programme and want to know how well people are prepared. The measurement puts the human side of change in view. On that basis you choose targeted actions and support teams during the roll-out. That is how you connect policy choices to day-to-day practice.
Want to discuss how elli can support your organisation? Get in touch with elli.
Make responsible AI use part of your next step
The next step is not just laying down agreements, but making sure they give direction to day-to-day work. Pick a concrete process in which AI is already being used or will shortly be introduced. Discuss with the teams involved which choices they may make on their own and when human assessment remains necessary.
Make the policy testable. Ask team leads how employees apply the agreements, which uncertainties keep coming back and where extra support is needed. Use those signals to make guidelines easier to understand and to align AI use with changing practice. That way your AI policy stays connected to the choices teams actually make.
Do you want to bring the human side of AI adoption along more deliberately? elli offers measurements and support around change readiness. Start with a clear picture of what people need to work responsibly with AI. From there you can learn more precisely, adjust and track progress.
Give your organisation a clear starting point for the next step.
Download the white paper: Human-ready is AI-ready
Frequently asked questions about AI policy
What is AI policy?
AI policy is the internal framework with which your organisation steers choices about AI use. It translates goals and values into agreements for employees, managers and technical teams. Think of a project team that lays down which applications it uses for customer communication, who checks the texts and how mistakes are reported. That way those involved know which considerations they make before AI becomes part of a process.
How do you manage and protect data in an AI system?
Start with an overview of the data that an application receives, processes and returns. Determine per type of data who needs access and remove information that is not needed for the purpose. Test, for example, a summary process with fictional customer data before you use real files. Also lay down who manages the settings, how you revoke access and how employees report suspicions of unwanted access.
How can AI policy close the digital divide and support equal access to AI?
Do not make access depend on job title, digital skills or having a workstation of one’s own. Offer employees comparable explanations, chances to practise and support that fits their work, such as a short team session or a shared workstation. Then check per team who can use the application and where practical barriers exist. Tailor the support to that, without treating use as a performance metric.
How can AI policy promote transparency in AI decision-making?
For every decision-making process, lay down where AI plays a role and who assesses the result. In a system that sorts customer questions, for example, an employee can see which category the system suggests and correct that choice. Also note which information was used, why an employee changed something and how an objection can be made. That way colleagues can reconstruct afterwards how a decision came about.
How do you adjust AI policy to changes in research and development?
Treat policy as a living framework. Appoint an owner who follows changes in the systems in use, working methods and relevant guidelines. Let teams report changes when an application processes new data or supports different tasks. Discuss such reports regularly with technical and subject-matter owners. Then update examples, permitted applications and instructions, so employees do not keep relying on agreements that no longer fit.
What does AI policy mean for daily practice?
It means that employees have something to hold on to for concrete tasks, not just a document on the intranet. A communications adviser knows, for example, which draft text AI may help compose and who checks the facts. A manager knows for which outcomes human assessment is needed. Discuss unclear situations in team meetings and use them to clarify instructions. That way responsible use becomes a shared way of working.