WhyWhy does a company need an AI policy?
Because your people already use AI, and without rules each of them handles company data their own way. This year 35% of Czech companies with 10 or more employees use AI, twice as many as a year earlier.1 But rules are not keeping up with that pace:
of Czech companies with up to 250 employees have clear rules and policies for using AI. Among microbusinesses it is 18%.2
of Czech employees say their company has clear rules for the safe use of AI.3
of employees worldwide have uploaded sensitive company or customer information into a public AI tool.4
This is called shadow AI: people use tools the company has not approved, typically a private account in a public chatbot. They do not do it out of malice. They want to save time and nobody told them where the line is. According to the KPMG and University of Melbourne study, 44% of employees worldwide have used AI against their company's policies, 66% rely on AI output without checking it and 61% avoid revealing that they use AI.4
It costs companies money. According to IBM, a high level of shadow AI added USD 670,000 to the average cost of a data breach, and 63% of breached organizations had no AI governance policy or were still developing one.5
“The treacherous thing about shadow AI is that the company is both the victim and the perpetrator.”
Michal Nulíček, attorney and partner, ROWAN LEGAL (2026), translated6
The victim, because it loses data and know-how. The perpetrator, because under the GDPR the company is responsible for the personal data of clients and employees that someone pastes into a chatbot, not the chatbot and not the employee. A policy is the cheapest way to change that.
LawIs an AI policy mandatory?
No law directly requires a written AI policy. In practice you need one, because otherwise you cannot show that you meet obligations that already apply today. Three sets of rules matter:
-
AI Act: AI literacy Law
Article 4 has applied since February 2, 2025 to every company that uses AI. The company must take measures so that people who work with AI understand its capabilities and risks according to their role. The Digital Omnibus amendment of July 2026 clarified that a company does not have to guarantee any specific level of knowledge for each person, but the obligation remains.7 In its Q&A the European Commission says that no certificate is needed and organizations can keep an internal record of training and other measures. It also notes that staff who write texts with ChatGPT should be informed about the risk of hallucinations.8
-
GDPR: accountability for data Law
As the controller, the company is responsible for personal data put into an AI tool. It must be able to show that it protects that data, even when an employee entered it through a private account. Without an approved tool covered by a data processing agreement, it cannot show that.
-
Czech labor law: rules people provably know Lawyers' view
An employer may decide which tools people use and may restrict or ban AI. But if the rules are not written down and provably communicated, the employer is in a weak position in a dispute. With a policy in place, pasting client data into a public chatbot is a breach of work duties.9
In the Czech Republic, the AI Act will be supervised by the Czech Telecommunication Office, and in some areas also by the Czech National Bank and the Office for Personal Data Protection. The government approved the bill on November 9, 2026 and it now goes to the Chamber of Deputies. For some breaches, the authority is first to issue a warning and a call to remedy them.10 A company with a policy, training and a list of its tools has that remedy ready in advance.
Stricter rules apply to high-risk uses of AI, for example in hiring or evaluating employees. After the amendment, these obligations moved to December 2, 2027.11 Using AI to recognize employees' emotions, however, is already prohibited.12
CoreWhat may go into AI and what may not?
What matters is the combination of tool and data, not the tool alone. The same chatbot can be fine for a public text and forbidden for client data. That is why the Czech public administration's template approves a specific tool for a specific purpose and type of data.13 For a smaller company, three colors are enough:
| Color | What data | Where it may go | Example |
|---|---|---|---|
| GreenFreely | Public information, general questions, your own texts without sensitive data | Any approved tool | A presentation outline, explaining a term, proofreading a public article |
| AmberWith a condition | Internal documents, your own source code, meeting notes without personal data | Only a company tool under contract that does not train on your data. A person always checks the output. | Summarizing an internal analysis, code review, a draft offer |
| RedNever | Passwords and API keys, national ID numbers, salaries, health data, client data without the client's consent | Nowhere, not even an approved tool, unless the data owner explicitly allows it | A CRM export, payslips, server credentials |
Add one default rule that appears in the public administration template and in lawyers' advice alike: when in doubt, do not put the data into AI and ask.13
TemplateDownloadable AI usage policy template
The template has 14 sections and four annexes. We built it from the internal regulation template published on the eAcademy of the Czech Digital and Information Agency,13 the AI policy of the Prague University of Economics and Business14 and lawyers' recommendations.6,9,15 We left out the parts meant for public authorities and shortened the text for a company of up to 250 people. Replace the square brackets with your own details.
Purpose and scope
Say right at the start that this is not a ban. People then see the policy as help, not a threat.
Sample wording1.1 This policy sets out rules for the safe and responsible use of artificial intelligence tools (“AI”) in work for [company name]. Its aim is not to ban AI but to allow its beneficial use without putting data, clients or the company's reputation at risk.
1.2 The policy applies to all employees and to external contractors who work with company data, on company and private devices alike when they are used for work.
Definitions
Include AI features built into office software, browsers and developer tools in the definition. People use exactly these without thinking of them as AI.
Sample wording2.1 An AI tool means any application, web service, add-on or feature that, based on a prompt, creates, edits or evaluates text, code, images, sound or other content.
2.2 Protected information means in particular personal data, information about clients and their projects, trade secrets, unpublished source code, credentials and financial data.
Core principles
Two sentences everyone should remember, even if they forget the rest of the policy.
Sample wording3.1 AI is an assistant, not an author or a decision maker. Every output is the responsibility of the employee who used it, as if they had created it themselves.
3.2 Anyone unsure whether they may put data into AI does not do so and asks [the AI administrator].
Roles and responsibilities
In a small company, a policy owner and one AI administrator are enough. In a larger one, add a go-to person in every team.
Sample wording4.1 The owner of this policy is [the managing director / CEO]. The owner approves the list of permitted tools and changes to the policy.
4.2 [The AI administrator] keeps the register of AI tools, assesses requests for new tools, organizes training and handles questions and incident reports.
4.3 Team leads make sure their team follows the policy and decide which outputs a second person must check.
Approved tools
The most important section. Approve only business plans with a data processing agreement where the vendor does not train on your data. Put the list in an annex so you can change it without reissuing the policy.
Sample wording5.1 Only the AI tools listed in Annex 1 may be used for work, only through company accounts and only to the extent stated there.
5.2 Only a tool for which the company has a contract with data processing terms, and whose provider does not use inputs or outputs to train models by default, may be approved.
5.3 Using free or private accounts of AI services for work data is prohibited.
New tools
People will want to try new things. Give them a simple way to request a tool, or they will start using it in secret.
Sample wording6.1 Anyone who wants to use a new AI tool or add-on asks [the AI administrator], stating the purpose, the type of data and the provider. Until it is approved, the tool is not used for work.
6.2 Approval applies to a specific purpose and type of data. The same tool may be allowed for public texts and forbidden for client data.
Data traffic light
This is where the table from the previous chapter goes, adapted to your data.
Sample wording7.1 Green, freely in approved tools: public information, general questions, outlines, proofreading one's own texts without protected information.
7.2 Amber, only in an approved company tool and with the output checked: internal documents, company source code, meeting notes without personal data.
7.3 Red, prohibited: credentials and keys, personal data beyond Annex 1, client data without the client's consent.
Data protection
Client contracts often restrict the use of AI. Make it clear in the policy which takes precedence.
Sample wording8.1 Only what the task requires is put into an AI tool. Names and identifiers are removed or replaced before input where the task allows.
8.2 Passwords, API keys, tokens and other credentials are never put into AI, not even into an approved tool.
8.3 Where a client contract restricts the use of AI, it takes precedence over this policy.
Checking outputs
AI makes up facts and citations. Damien Charlotin's database already lists more than 2,200 court decisions that dealt with content made up by AI.16
Sample wording9.1 A person checks every AI output before it is used: facts, figures, citations and links, and whether it matches the brief and the law.
9.2 Code written with the help of AI goes through the same review and tests as any other code, and its author must understand it.
9.3 AI must not make decisions about people on its own, in particular about hiring, evaluation or pay.
Transparency
The AI Act requires labeling deepfakes and AI-generated texts published to inform the public on matters of public interest. A text that a person has reviewed and is responsible for does not need a label.12
Sample wording10.1 The use of AI is disclosed where the law or a contract requires it, or where not disclosing it could mislead the recipient. For example: “[Tool name] was used in preparing this material; the content was checked by [name].”
10.2 The image, voice or likeness of a real person is not created with AI without their consent.
Copyright
AI tools' terms differ on who may use an output commercially. Check before you hand an output to a client.
Sample wording11.1 Third-party works (texts, images, code) for which the company does not hold the necessary rights are not put into AI.
11.2 Before an output is used commercially, it is checked that the tool's terms allow it.
Training and AI literacy
This is how you meet Article 4 of the AI Act. The attendance record is your evidence.
Sample wording12.1 Every employee completes basic training on AI and on this policy within [30] days of joining or of the policy taking effect. Completion is recorded.
12.2 Those who use AI heavily or administer AI tools complete extended training. Training is repeated at least once a year or when the tools change significantly.
Incidents
People report mistakes only when they are not afraid to. Say so explicitly in the policy.
Sample wording13.1 Anyone who finds that protected information has been put into AI, or that AI has produced a harmful output, reports it without undue delay to [the AI administrator]. A timely report is not considered an aggravating circumstance.
13.2 [The AI administrator] records the incident, assesses whether it is a personal data breach under the GDPR and proposes a remedy.
Monitoring, breaches and effect
You may monitor to a reasonable extent, and people must know about it in advance. Czech labor law does not allow reading all conversations across the board.15
Sample wording14.1 The company may, to a reasonable extent, monitor which AI services are used on company devices and networks, and block unapproved tools. Employees are informed of the extent of monitoring in advance.
14.2 A breach of this policy is a breach of the duties arising from the legal regulations that apply to the work performed.
14.3 This policy takes effect on [date]. The owner reviews it at least once a year and always after a serious incident or a change in the law. Employees confirm that they have read the policy [by signature / in the system].
Add annexes to the policy: a list of approved tools with permitted purposes, the data traffic light, a request form for a new tool and an acknowledgment form. You will find them in the downloadable template.