AI Acceptable-Use Policy Builder

AI Acceptable-Use Policy Builder IddiLabs · AI Governance Workspace · runs entirely in your browser

01Organisation & document control

Organisation name Regulatory context

Policy owner (role) Approver (role/body)

Version Effective date

Review cycle Document status

Include status stamp in print / Word export

02Scope

Policy applies to All employees Contractors and consultants Temporary staff and interns Cover unapproved (“shadow”) AI use explicitlyAdds a clause requiring that only approved tools are used for work purposes, on any device.

03Regulatory anchorscited in the text

EU AI Act (Reg. (EU) 2024/1689)AI literacy (Art. 4), prohibited practices (Art. 5), transparency (Art. 50), oversight (Arts. 14, 26). GDPR (Reg. (EU) 2016/679)Data-protection principles, automated decisions (Art. 22), DPIA (Art. 35). IP, copyright & licence termsClause on third-party content, output ownership and tool licence compliance. DORA (Reg. (EU) 2022/2554)AI vendors as ICT third-party providers; register of information. CSSF Circular 22/806Outsourcing due diligence and notification for material arrangements. Professional secrecy (Art. 41, Law of 5 April 1993)Luxembourg financial-sector confidentiality obligations. High-risk AI is used or plannedAdds an Annex III section noting obligations apply from 2 Dec 2027 (Digital Omnibus, 2026).

04Approved AI tools

New-tool request channel — how staff request approval of a new tool

05Data rules

Never enter into any AI tool

Personal data may be processed in approved enterprise toolsOnly where a lawful basis exists and the tool is cleared for it. Unchecked = personal data prohibited in AI tools.

06Oversight & transparency

Human review required before AI output is used externally or relied upon No solely automated decisions with legal or similarly significant effect on individuals Label AI-generated content where required or where it could mislead Disclose when persons are interacting with an AI system (e.g. chatbots)

07Training & incidents

AI-literacy training is mandatory for staff in scope Training cadence Incident reporting channel

08Governance

Exceptions approved by (role) Document classification

Draft