# AI use policy: free template

> Fill in a short form and download an AI use policy as a Word file. Based on the GDPR and the EU AI Act, for schools, institutions and companies. No sign-up.

Source: https://etekos.com/en/ai/policy · SIA ETEKOS, Latvia · ai@etekos.com · +371 2666 2621

Every school and institution whose staff use ChatGPT, Copilot or other AI tools needs written rules: which tools may be used, which data must never go into them and who is responsible for the result. Fill in the form and the policy is ready as a Word file you can edit and approve.

## Template (with empty fields)

### [Organisation name]: AI use policy


Approved on [date]. Responsible person: [Responsible person].


This document was made from the template at etekos.com/en/ai/policy. Adapt it to your situation before approval and, if possible, show it to your data protection officer. The template is not legal advice.

#### 1. Purpose and scope


This policy sets out how [Organisation name] staff (teachers and other staff) use artificial intelligence (AI) tools at work, to protect personal data and to meet the General Data Protection Regulation (GDPR) and the EU AI Act (Regulation 2024/1689).


An AI tool in this policy is any program or service that generates text, images, audio, code or other content on a user's request, for example chat assistants, translation and image tools.

#### 2. Approved tools


For work, only these tools may be used, signed in with a work account:

- Etekos AI

Other AI tools may be used for work only with written approval from [Responsible person]. Before approval it is checked that a data processing agreement exists with the provider, where the data is processed and that the provider does not use it to train models.


Approved tools that process personal data are listed in [Organisation name]'s records of processing activities (GDPR article 30).


Work information that is not public must not be entered into free AI tools or personal accounts.

#### 3. Information that must not be entered


Even in approved tools, do not enter:

- personal identity numbers, dates of birth and home addresses;
- health data and other special categories of personal data (GDPR article 9), such as religious beliefs or ethnic origin, and data about criminal convictions (GDPR article 10);
- pupils' names together with marks, behaviour notes or information about support measures;
- passwords, access codes and other credentials.

If a task needs information about a specific person, replace the name with a label such as [Pupil A] and enter only what the task really needs.

#### 4. Responsibility for the result

- AI can be wrong and can invent facts and sources. Users check facts, figures, references to legislation and sources before using a result.
- The person who uses or sends a document, letter or other result is responsible for it, not the AI tool.
- Decisions with legal effects or a significant effect on a person are made by a person. AI may help prepare information but does not make the decision.
- Teachers assess pupils' learning. AI may help draft a comment against the teacher's criteria, but the teacher gives the mark.
- Users respect copyright: they do not enter other authors' works without the right to use them, and before publishing they check that an AI result does not copy someone else's work.
#### 5. Transparency

- Text generated or substantially changed by AI and published to inform the public is labelled as such, unless a person who takes responsibility for it has reviewed and edited it (AI Act article 50).
- AI-made or AI-changed images, video and audio that look like real people, places or events are labelled as AI-made when published.
- If [Organisation name] uses an AI chat assistant to talk to people, it must be clear to them that they are talking to AI.
#### 6. Prohibited uses


AI tools must not be used:

- to recognise emotions of pupils or staff (AI Act article 5);
- to rate or classify people by behaviour or personal characteristics in a way that can lead to unfavourable treatment;
- to deceive, manipulate, harass or track people;
- to create fake documents or signatures, or to imitate a person's voice or image without their consent.
#### 7. AI literacy


Since 2 February 2025 [Organisation name] takes measures to build the AI literacy of people who use AI tools at work (AI Act article 4). New staff read this policy before using AI tools. Staff take a short training session on safe AI use at least once a year. [Responsible person] keeps a record of who has been trained and when.

#### 8. Mistakes and incidents

- If data that section 3 forbids is entered into an AI tool by mistake, the user deletes the chat at once and tells the responsible person the same day.
- The responsible person assesses whether a personal data breach has happened. If it has, [Organisation name] follows its breach procedure and, where required, notifies the supervisory authority within 72 hours (GDPR article 33).
- If an AI tool gives a harmful, discriminatory or obviously wrong result, the user does not use it and tells the responsible person.
#### 9. Responsible person and review


[Responsible person] is responsible for compliance with this policy, the list of approved tools and training. The policy is reviewed every 12 months, or earlier if legislation or the tools in use change.


## Frequently asked questions

### Is an AI use policy mandatory?

No law asks for a document with this name. But the GDPR requires an organisation to show that it processes personal data securely, and article 4 of the EU AI Act requires it to take measures to build staff AI literacy. A written policy is the simplest way to show both.

### Does this template replace legal advice?

No. The template follows the GDPR and the EU AI Act, but every organisation adapts it to its own situation. It is worth showing it to your data protection officer before approval.

### Are my answers sent anywhere?

No. The document is made in your browser. The organisation's name and other answers are not sent to a server and not stored.

### Should the policy name specific tools?

Yes, that is recommended. If a policy only bans "free tools", staff do not know what they may use. It is better to name tools that come with a data processing agreement and work-account sign-in.

## More about Etekos AI

- Etekos AI: https://etekos.com/en/ai
- For schools: https://etekos.com/en/ai/schools
- For institutions: https://etekos.com/en/ai/institutions
- Security and data: https://etekos.com/en/ai/security