MKB Juristen drafts custom legal documents
It is best not to cobble together or copy important contracts, terms and conditions, and other legal documents yourself. We help entrepreneurs on a budget with customized legal solutions, clear costs upfront, and practical explanations.
- Custom contracts, terms and conditions, and legal documents
- Budget-friendly and clear about the costs upfront
- Request a free consultation or a no-obligation quote
When drafting an AI policy for staff, you establish all the rules of conduct that employees must follow when using AI tools in a single document: the scope of application, permitted and prohibited forms of use, handling of company and personal data, monitoring of compliance, and the employment law consequences of violations. Below, section by section, is what specifically belongs in the policy and why — ensuring you get regulations that are workable and that you can hold your staff accountable to.
The short answer
- Scope: to whom and which tools the policy applies.
- Permitted use: approved tools and tasks, with an obligation to monitor the output.
- Prohibited use: confidential data, personal data, shadow AI.
- Data and GDPR: what is and isn't allowed in a prompt.
- Control and enforcement: how to supervise and which sanctions apply.
- Anchoring: inclusion in the employee handbook plus acknowledgment.
Drafting an AI policy for staff: the building blocks
A good policy is concise, concrete, and enforceable. Avoid abstract vision statements; employees must be able to see what they are and are not allowed to do. Therefore, work with clear sections and examples. The foundation consists of scope, rules of conduct, data rules, control, and enforcement.
Scope and definitions
Start with the scope, so that there is no discussion about who the rules apply to:
- For whom: all employees, including temporary staff, interns, and contractors.
- Which tools: all generative AI (text, images, code), both approved and not.
- On which devices: business and, if applicable, private for work use.
- Short definitions: what do you understand by “AI tool”, “prompt”, and “output”?.
Permitted and prohibited use
This is the heart of the policy. Split it into two lists so that employees have something to hold onto.
Allowed (with conditions):
- Concepts, summaries, and brainstorming with an approved business AI environment.
- Code suggestions, provided they have been checked for functionality and licenses.
- Translations and text revisions of non-confidential material.
- The following always applies: the employee checks the output and remains responsible.
Forbidden:
- Pasting confidential business information into public AI tools.
- Entering personal data without a valid legal basis.
- Sending uncontrolled output out as one's own work.
- Using unapproved tools (shadow AI).
Data and GDPR
Provide a separate, concrete section on data — this is where the greatest risk lies. Differentiate between types of information:
- Never enter: customer files, personnel data, quotations, source code, passwords.
- Only in approved environment: internal, non-public business information.
- Free to use: general, public, or anonymized information.
Refer to the GDPR obligation to protect personal data and to the risk of a data breach. An employee who pastes an applicant's CV into a free chat to have a review written is processing personal data without a legal basis — precisely the scenario you want to rule out.
Control and enforcement
Describe how you monitor compliance and what constitutes a violation. Without this section, the policy is unenforceable
- Which logging or control you apply, announced transparently in advance.
- That the monitoring is proportionate and respects the employee's privacy.
- A sanctions ladder: warning, official warning with documentation, and for serious violations, more severe measures up to dismissal.
- Regarding structural monitoring: the role of the Works Council (right of consent, Article 27 of the Works Councils Act).
Anchoring in the employee handbook
Conclude with the legal anchoring; otherwise, the policy is not binding:
- Inclusion in or link to the employee handbook.
- Reference from the employment contract.
- A unilateral amendment clause (Article 7:613 of the Dutch Civil Code) to update the policy.
- Demonstrable acknowledgment by employees.
Honest recommendation
If you have a small team, one approved tool, and hardly any sensitive data, you can draft the policy yourself using the sections above as a checklist. In that case, you do not need a lawyer — provided you properly incorporate the policy into the employee handbook and obtain confirmation of acknowledgment.
Do engage legal assistance as soon as you work with personal data, have a Works Council, or actually want to be able to impose sanctions; in that case, the data, control, and enforcement sections must be legally sound. See also what an AI policy for employees is and what it costs to have one drafted. Ready to get started? View the AI policy for employees.
Frequently Asked Questions
Scope and definitions, permitted use, prohibited use, a separate section on data and GDPR, compliance monitoring, a sanctions ladder, and integration into the employee handbook. Concrete and with examples, so that employees know what they are allowed to do.
Yes. Simply prohibiting it is counterproductive, because employees will use AI anyway. By also specifying permitted use with conditions (approved tools, obligation to monitor output), you keep usage within boundaries and limit shadow AI.
Create three categories: never enter (customer files, personnel data, source code, passwords), only in an approved environment (internal company information), and freely available (public or anonymized information). Refer to the GDPR and the risk of a data breach.
Describe the logging or monitoring methods you apply, announce them transparently in advance, and keep them proportionate. Include a sanctions ladder: from a warning to building a case file and, in the case of serious violations, more severe measures. Involve the Works Council in structural monitoring.
A control or monitoring system may require consent pursuant to Article 27 of the Works Councils Act (WOR). The substantive rules of conduct often fall under the right to issue instructions, but submit the monitoring component to the Works Council in a timely manner to prevent later disputes.
Include it in the employee handbook, refer to it in the employment contract, and have employees confirm receipt. Add a unilateral amendment clause (Article 7:613 of the Dutch Civil Code) to allow for the policy to be updated if technology changes.
As short as possible. A few pages with clear lists and examples work better than a long vision document. Employees must be able to see at a glance what is permitted and what is prohibited; this increases compliance and enforceability.
