This article describes the content of the provisions it names. It is not legal advice and not an assessment of your specific case. Whether and how a provision applies to your business is a legal question.
Most businesses sit in one of two states. Either nobody said anything and everyone uses whatever they find, or a template from the internet sits on the drive with no trace of the business in it.
Both show up the same way in daily work. Somebody who means well pastes a real customer case into a writing tool because the reply has to go out quickly. Without a rule that person has nothing to go by.
What should an AI usage policy for employees contain?
Four decisions carry the whole document: which tools are approved, which data may go in, who checks the output before use, and who decides about a new tool. Everything else follows from those four.
An AI usage policy is a written house rule setting out which AI tools may be used in the business, with which data, and who answers for the output. It settles the questions each person otherwise settles alone, under time pressure.
Which points belong in it?
Eight sections are enough in a small company. Each one settles a decision that would otherwise be taken case by case.
- Approved tools: product names and accounts, not categories. A category is not permission.
- Data that may go in: general wording, anonymised cases, material already published.
- Data that stays out: personnel data, health data, costings, contract terms, credentials.
- Checking the output: who reads a result before use, and against what.
- Labelling: what gets marked when it leaves the business, and who decides.
- Responsibility: one named person who answers questions and approves tools.
- Route for a new tool: who asks, who reviews, who approves, where it is logged.
- Training and evidence: who received which content, when, for which tools.
The point most often missing is the seventh. Without a route for a new tool the list is out of date after a quarter, and then whatever held before the policy holds again. It needs a date and an owner.
Written form has a second reason. According to WKO, a trade secret is information that is secret, has commercial value because it is secret, and is the subject of appropriate confidentiality measures. WKO names staff training and company policies on handling secrets among the examples. What exists only in the owner's head is not a measure.
What does the AI Act require of an AI usage policy?
The regulation requires no document by that name. Article 4 of the AI Act has required providers and deployers since 2 February 2025 to ensure a sufficient level of AI literacy among their staff and the persons dealing with AI systems on their behalf, measured against prior knowledge, training and the context of use.
The AI service desk at Austria's regulator RTR names four measures: an internal AI policy with a strategy, references to the other house policies and fixed roles, a current survey of the systems in use, a training concept, and records kept with the personnel file. As a template it points to the WKO guidelines.
Transparency comes on top. Article 50 of the AI Act has applied since 2 August 2026 and provides that people are told when they speak to an AI system, unless that is obvious, and that artificially generated or altered images, audio and video are recognisable as such. For text, paragraph 4 provides for disclosure where it informs the public on matters of public interest. Whether that applies in a given case is a legal question.
A policy works through its tool list. Where it names a category instead of a product and an account, each person keeps deciding alone, and in a hurry.
Does the works council have to agree to an AI usage policy?
The house rule itself usually not. Introducing a system that allows staff to be monitored is another matter. Section 96 paragraph 1 number 3 of the Austrian Labour Constitution Act makes control measures and technical systems for monitoring employees subject to the works council's consent, provided those measures touch human dignity. The act does not know the term AI, it asks about the effect.
Under section 96a of the same act, systems for the automated collection, processing and transfer of employees' personal data also require that consent, although it can be replaced by a decision of the conciliation board. In businesses with no works council, control measures touching human dignity are permitted under section 10 AVRAG only with the consent of the employee concerned. Which systems are covered has to be assessed case by case.
In practice that means settling co-determination before the start, not after the first report, wherever a tool evaluates employees' hours, texts or conversations. Where a high risk system is used at the workplace, Article 26 paragraph 7 of the AI Act also provides that workers' representatives and the affected employees are informed beforehand.
How does a policy turn into daily practice?
By coming out of the business and sitting somewhere everyone finds during the working day. Five steps lead there, as a guide in two to four weeks, depending on the number of tools in use.
- 1.Survey: which tools are in use, including private accounts and features inside existing software.
- 2.Decide: which of them stay, which go, which move into a company account.
- 3.Write: the eight sections on two to four pages, in the language of the house, with your own examples.
- 4.Discuss: half an hour with the team, where each person names a case they find unclear. Those cases belong in the document afterwards.
- 5.Keep it current: a date on the policy, a person who maintains it, a look whenever a tool is added.
Which records the AI Act and the GDPR provide for alongside the house rule is on our page about GDPR and the AI Act. What evidence of AI literacy under Article 4 looks like is in the post on that provision, and why a rule without support fizzles out on our page on change management and adoption.
An AI usage policy is the shortest document in the house that changes anything. Once the survey of tools is done, it costs an afternoon. It takes a decision off your staff that they would otherwise make alone, at four on a Friday.