AI Acceptable Use Policy Template for the EU AI Act

An AI acceptable use policy is the single most useful governance document for a company that uses AI rather than builds high-risk systems. It is not a statutory requirement in itself, but it is how you discharge Article 4 AI literacy, keep staff the right side of the Article 5 prohibitions, and avoid data and disclosure mistakes. This page templates the sections.

Why it matters under the Act

Article 4 has required AI literacy across the workforce since 2 February 2025, for all AI. A clear policy plus a short briefing is a proportionate way to meet it. The policy is also where you operationalise the lines that matter: what is approved, what is banned, and how to handle data — so a well-meaning employee does not paste client data into a consumer tool or build a quietly high-risk workflow.

The policy — sections to include

1. Purpose and scope. Who and what it covers; that it applies to all AI tools used for work.

2. Approved tools. The list of sanctioned AI tools and the process to request a new one (so "shadow AI" surfaces).

3. Prohibited uses (Article 5). No manipulative or deception-based use; no inferring employees' or others' emotions in the workplace; no social scoring; no untargeted scraping of facial images. These are banned outright.

4. High-risk awareness. Staff must not, without sign-off, use AI to make or materially influence decisions on hiring, promotion, credit, or access to services (Annex III areas) — and must flag any such use for classification.

5. Data handling. What may and may not be entered into AI tools; personal and special-category data rules (GDPR); confidentiality; approved tiers/DPAs.

6. Transparency (Article 50). When customer-facing AI must disclose it is AI, and when AI-generated content must be marked or disclosed (content-marking from 2 December 2026).

7. Human oversight and accountability. AI output is a draft, not a decision; who is accountable; review expectations.

8. Training and review. Literacy expectations by role; policy owner; review cadence.

Worked example: a 250-person services firm

Castellan Group, a 250-person professional-services firm, has no high-risk systems but heavy day-to-day AI use. Its acceptable use policy lists approved tools, bans the Article 5 practices outright, sets a rule that any AI touching hiring or client-eligibility decisions must be flagged for classification, forbids client personal data in non-approved tools, and requires the customer chatbot to disclose it is AI. Combined with a 30-minute briefing, this discharges Article 4 literacy and contains the realistic risks.

How Confir helps

Confir complements the policy with the classification engine behind it: when a flagged use comes in, it returns the tier and role with a cited rationale, so "is this allowed?" has a defensible answer rather than a judgment call. The engine is deterministic and rule-based, and it keeps the register of approved uses current.

Frequently asked questions

Is an AI acceptable use policy required by the EU AI Act?

Not as a named obligation. But it is the practical way to discharge Article 4 AI literacy (in force since 2 February 2025 for all AI), keep staff clear of the Article 5 prohibitions, and prevent data and disclosure mistakes. It is strongly advisable even for companies with no high-risk systems.

What must the policy cover to meet Article 4?

Enough for staff to use AI competently for their role: what tools are approved, what is prohibited, how to handle data, when disclosure is needed, and that AI output is a draft requiring human judgment. A policy plus a short briefing is a proportionate way to meet the literacy duty.

What prohibited uses should the policy name?

The Article 5 bans: manipulative or deceptive use causing harm, inferring emotions in the workplace, social scoring, and untargeted facial-image scraping. These are prohibited outright since 2 February 2025, with the top penalty tier, so the policy should state them plainly.

Does the policy need to address customer-facing AI?

Yes. Where AI interacts with customers it must disclose it is AI (Article 50(1)), and AI-generated content published externally must be marked or disclosed (Article 50(2)/(4), content-marking from 2 December 2026). The policy should set those expectations.

Who should own the policy?

A named owner — typically compliance, legal or IT leadership — with a review cadence, because approved tools and the regulation both change. The policy should make clear who classifies new or flagged AI uses.

Related guides

• Article 4 AI literacy
• Article 5 prohibited practices
• The AI use case register
• Article 50 transparency obligations
• EU AI Act for startups