[Organisation name]: AI use policy
Approved on [date]. Responsible person: [Responsible person].
This document was made from the template at etekos.com/en/ai/policy. Adapt it to your situation before approval and, if possible, show it to your data protection officer. The template is not legal advice.
1. Purpose and scope
This policy sets out how [Organisation name] staff (teachers and other staff) use artificial intelligence (AI) tools at work, to protect personal data and to meet the General Data Protection Regulation (GDPR) and the EU AI Act (Regulation 2024/1689).
An AI tool in this policy is any program or service that generates text, images, audio, code or other content on a user's request, for example chat assistants, translation and image tools.
2. Approved tools
For work, only these tools may be used, signed in with a work account:
Etekos AI
Other AI tools may be used for work only with written approval from [Responsible person]. Before approval it is checked that a data processing agreement exists with the provider, where the data is processed and that the provider does not use it to train models.
Approved tools that process personal data are listed in [Organisation name]'s records of processing activities (GDPR article 30).
Work information that is not public must not be entered into free AI tools or personal accounts.
3. Information that must not be entered
Even in approved tools, do not enter:
personal identity numbers, dates of birth and home addresses;
health data and other special categories of personal data (GDPR article 9), such as religious beliefs or ethnic origin, and data about criminal convictions (GDPR article 10);
pupils' names together with marks, behaviour notes or information about support measures;
passwords, access codes and other credentials.
If a task needs information about a specific person, replace the name with a label such as [Pupil A] and enter only what the task really needs.
4. Responsibility for the result
AI can be wrong and can invent facts and sources. Users check facts, figures, references to legislation and sources before using a result.
The person who uses or sends a document, letter or other result is responsible for it, not the AI tool.
Decisions with legal effects or a significant effect on a person are made by a person. AI may help prepare information but does not make the decision.
Teachers assess pupils' learning. AI may help draft a comment against the teacher's criteria, but the teacher gives the mark.
Users respect copyright: they do not enter other authors' works without the right to use them, and before publishing they check that an AI result does not copy someone else's work.
5. Transparency
Text generated or substantially changed by AI and published to inform the public is labelled as such, unless a person who takes responsibility for it has reviewed and edited it (AI Act article 50).
AI-made or AI-changed images, video and audio that look like real people, places or events are labelled as AI-made when published.
If [Organisation name] uses an AI chat assistant to talk to people, it must be clear to them that they are talking to AI.
6. Prohibited uses
AI tools must not be used:
to recognise emotions of pupils or staff (AI Act article 5);
to rate or classify people by behaviour or personal characteristics in a way that can lead to unfavourable treatment;
to deceive, manipulate, harass or track people;
to create fake documents or signatures, or to imitate a person's voice or image without their consent.
7. AI literacy
Since 2 February 2025 [Organisation name] takes measures to build the AI literacy of people who use AI tools at work (AI Act article 4). New staff read this policy before using AI tools. Staff take a short training session on safe AI use at least once a year. [Responsible person] keeps a record of who has been trained and when.
8. Mistakes and incidents
If data that section 3 forbids is entered into an AI tool by mistake, the user deletes the chat at once and tells the responsible person the same day.
The responsible person assesses whether a personal data breach has happened. If it has, [Organisation name] follows its breach procedure and, where required, notifies the supervisory authority within 72 hours (GDPR article 33).
If an AI tool gives a harmful, discriminatory or obviously wrong result, the user does not use it and tells the responsible person.
9. Responsible person and review
[Responsible person] is responsible for compliance with this policy, the list of approved tools and training. The policy is reviewed every 12 months, or earlier if legislation or the tools in use change.