AI Policy Generator: your template in two minutes
Answer six questions and get a complete AI policy as a Word file - with up to ten sections derived from trade-secret law, GDPR and the EU AI Act. No signup, no input ever leaves your browser.
By Michael Kaiser, founder of ArkeonTech Last updated:
Legal basis: GDPR, German trade-secret law (GeschGehG) and the AI Act as amended by the Digital Omnibus (Regulation (EU) 2026/1744)
Your input
Your policy
The text updates with every input.
ai-policy.docx
Enter the company name to generate the template.
All input stays in your browser. Nothing is sent, stored or analysed.
What the generated policy contains
The template covers the sections an AI policy needs for SMEs: scope including shadow use, approved systems with company accounts, the data classes that must never be entered, permitted use cases, employee duties, training under Art. 4 AI Act, the named responsible office and the review cycle. On request it adds a rule for labelling published AI content and a works council section. You download the result as a Word file, print it as PDF or copy it formatted.
Why companies need an AI policy in 2026
Without a policy employees use AI anyway - privately and invisibly. That shadow use is the risk: a trade secret loses its protection under the GeschGehG if it is not covered by reasonable confidentiality measures, and an unauthorised upload of personal data is a GDPR breach. Art. 4 AI Act has additionally required measures for staff AI literacy since February 2025 - a written, communicated policy with documented training is the most direct evidence.
Limits of this template
The generator produces a solid draft, not legal advice. Before publishing, have the text reviewed by a lawyer - in particular where a works council exists (co-determination under § 87 BetrVG), where professional secrecy holders work in the company or where you operate in a regulated industry. The article on the AI policy explains the structure and the legal anchors in depth.
Further reading
Read the article: what belongs in an AI policy and why most failFrequently asked questions
There is no duty to a document under this name. But without written rules you can evidence neither the will to secrecy under the GeschGehG nor that you took measures for AI literacy under Art. 4 AI Act - and both are presumed in a dispute.
Yes, if a works council exists: rules on the use of technical systems and on employee conduct are subject to co-determination (§ 87 BetrVG). Without consent the policy is void - the generator therefore offers a dedicated works council section.
No. The template covers the usual mandatory sections and names the legal bases, but it does not know your company. With secrecy holders, regulated industries or an existing works council, legal review is a must.
Yes. Download the policy as a Word file or copy it formatted into your word processor. The template is deliberately a draft: adapt systems, data classes and responsibilities to your company.
Nothing, and nothing. The tool is free, needs no signup and builds the document entirely in your browser. No input is transmitted or stored.
For companies that want to allow their staff to use AI - or whose staff already use it anyway. Whoever bans AI outright needs technical blocking rather than a policy; whoever allows it needs the rules in writing.
Matching ArkeonTech service
The policy is step one - adoption is step two
We support AI adoption in companies: from the policy via system selection to the process and documentation that the works council and the data protection officer want to see.