# Internal AI Acceptable Use Policy
**Organisation**: [Your Company Name]  
**Effective Date**: [Date] | **Version**: 1.0  
**Compliance Scope**: EU AI Act (Regulation 2024/1689), GDPR (Regulation 2016/679)  
*Status: Review-ready working draft for internal management adoption.*

---

## 1. Purpose & Scope
This policy establishes mandatory operational rules for all employees, contractors, and staff utilizing Generative AI tools (including, but not limited to, ChatGPT, Claude, Microsoft Copilot, Cursor, Midjourney, and Gemini) in the course of their work for [Your Company Name].

Under **EU AI Act Article 4 (AI Literacy)**, organisations deploying AI systems must ensure their personnel possess an adequate level of AI literacy, considering their technical knowledge, experience, education, and the context in which AI tools are deployed.

---

## 2. Approved vs. Prohibited Tool Tiers

### Tier 1: Formally Approved Commercial AI Tools
Tools with commercial enterprise agreements guaranteeing zero model training on customer prompts and data residency in the European Union.
- [e.g., Enterprise Claude with Zero-Data-Retention, Mistral Le Chat Enterprise]

### Tier 2: Conditional Use (Non-Confidential Only)
Consumer/free AI tiers (e.g., free ChatGPT, free Claude).
- **Rule**: Permitted ONLY for public research, drafting non-confidential outlines, and generic ideation.
- **Strict Prohibition**: Never paste customer personal data, internal source code, financial spreadsheets, or employee records into Tier 2 tools.

### Tier 3: Prohibited AI Practices (EU AI Act Article 5)
Under no circumstances may any employee deploy or experiment with:
1. Emotion recognition systems in the workplace.
2. Biometric categorisation assessing sensitive traits.
3. Social scoring or untargeted facial scraping.

---

## 3. Data Protection Safeguards (GDPR Alignment)
1. **Personal Data Minimisation (Art. 5(1)(c) GDPR)**: Before inputting any prompt into an AI model, staff must anonymize or pseudonymize all personal identifiers (names, emails, telephone numbers, IP addresses).
2. **Special Category Data (Art. 9 GDPR)**: Never process health data, biometric data, racial/ethnic data, or trade union membership in any public AI model.
3. **Intellectual Property & Code**: Proprietary codebase snippets must only be indexed or processed through vetted, commercial tools with documented security assurances.

---

## 4. Transparency & Output Verification (EU AI Act Art. 50)
1. **Human Oversight**: AI outputs are informational drafts. Staff are solely responsible for verifying the accuracy of all AI-generated code, legal text, calculations, and customer communications.
2. **AI Disclosure**: When an external customer or client communicates with an automated AI agent or chatbot, they must be explicitly informed that they are interacting with an AI system.

---

## 5. Employee Acknowledgment & Signature
I confirm that I have received, read, and agree to adhere to the [Your Company Name] Internal AI Acceptable Use Policy.

**Employee Name**: ___________________________  
**Signature**: _______________________________  
**Date**: ___________________________________