Generative AI is already part of everyday business life.
Employees use AI tools to draft documents, summarize information, translate content, generate code or analyze data — sometimes before the company has decided which tools should be used or what information may be shared with them.
For companies operating in the EU, the question is therefore increasingly practical: do we need an internal AI policy?
Not necessarily as a standalone document. But most companies using generative AI should define at least a few clear rules.
One of the first issues is shadow AI: employees using publicly available AI tools or personal accounts without the company having reviewed their terms, security or data practices.
A company can therefore identify which tools are approved, which may only be used in certain circumstances and which should not be used for business purposes.
This does not require banning every unapproved AI tool.
The objective is to give employees a clear answer to a very simple question: which tools can I use for my work?
This is often the most important rule.
Employees may be tempted to upload contracts, customer documents, source code, financial information, personal data or internal materials because doing so makes the AI tool more useful.
But that information may be confidential, protected by contractual commitments or subject to GDPR requirements.
The company should therefore define what information may be submitted to approved AI tools and what information requires additional safeguards or must not be submitted at all.
Those rules should also reflect the actual terms and settings of the AI services used by the company, including whether data may be retained or reused for model training.
Generative AI can produce inaccurate, incomplete or fabricated information while presenting it convincingly.
An internal policy should therefore make clear when AI-generated content must be reviewed before it is used.
The level of review should depend on the context.
Using AI to prepare an internal first draft does not create the same risk as relying on its output for a customer deliverable, legal or financial analysis, software code or a business decision.
Human review should reflect the consequences of getting the answer wrong.
AI-generated text, images and code can also raise intellectual property issues.
Employees should not automatically assume that generated content is free of third-party rights or can be used for any purpose.
Additional checks may be appropriate where AI-generated material will be published, commercialized or incorporated into the company’s own products or services.
Again, the rules can be proportionate: not every AI-assisted email requires an intellectual property review.
Internal governance is also relevant under the EU AI Act.
AI literacy requirements have applied since February 2025. Following the 2026 Digital Omnibus on AI, providers and deployers must take measures to support the development of AI literacy among staff and other persons operating or using AI systems on their behalf, taking into account their knowledge, experience, education, training and the context in which the systems are used.
The amended provision does not require companies to guarantee a specific level of AI literacy for each individual.
An internal AI policy can form part of this approach, together with appropriate information, awareness and training.
It is not, however, a mandatory document under the AI Act.
For many companies, yes — but it does not need to become another twenty-page compliance document.
Depending on the company and its use of AI, the rules may sit in a dedicated AI policy, an existing IT policy or another internal governance document.
What matters is that employees know:
Which AI tools can I use? What information can I share with them? What do I need to check? And when should I not use AI at all?
A short policy that employees understand and use may be considerably more effective than a comprehensive document that nobody reads.
Withlaw assists international companies in defining practical rules for the use of AI in their European operations, including:
Our objective is to provide a practical framework that protects the company without unnecessarily restricting useful AI adoption.