What is a responsible AI policy?

What a responsible AI policy must cover

An effective responsible AI policy has six essential elements. First, a statement of permitted uses: what categories of AI use are approved, which tools are sanctioned, and under what conditions. Second, a statement of prohibited uses: what is not permitted; including uses banned under the EU AI Act and uses the organisation considers inconsistent with its values or obligations. Third, data handling requirements: what data may and may not be input into AI tools, including rules on personal data, confidential client information, and commercially sensitive data. Fourth, verification obligations: the requirement to check AI outputs before relying on them, proportionate to the risk of the decision. Fifth, supervision requirements: the level of human oversight required for different categories of AI use. Sixth, disclosure obligations: when and how to disclose to clients, colleagues, or regulators that AI was used in producing a piece of work.

Who needs a responsible AI policy?

A clear policy is useful for organisations whose staff use AI, particularly where confidential information or consequential decisions are involved. Its contents should follow the actual tools and work, with a named route for questions and exceptions. Do not present the same document as a universal legal requirement for every business. Check applicable professional, contractual and regulatory obligations, then explain the practical rules staff need to follow. Review whether people can comply with those rules using the systems available to them.

Legal references reviewed 4 October 2026. High-risk provisions have phased application and transition rules. Sources: Commission timetable, deployer duties, impact-assessment scope and literacy guidance.