On August 2, 2026, the European AI Regulation (AI Act) came into general effect, with transparency obligations serving as the main new requirement for most companies. In Spain, on May 26, 2026, the Council of Ministers approved the Draft Organic Law on the Proper Use and Governance of Artificial Intelligence, which aligns the national framework with the European regulation and provides for penalties of up to 35 million euros or 7% of annual turnover for the most serious violations.
However, the most common problem in industrial companies is not noncompliance with the AI Act—it is the lack of any internal policy on the use of AI. While teams are already using ChatGPT, Copilot, or Gemini in their day-to-day work, management has not yet decided what is allowed, what is prohibited, and who is responsible for what. That is a legal, operational, and reputational risk that does not require an AI team to manage it: it requires a policy.
What Is AI Governance, and Why Does Your Company Need It?
AI governance is the set of policies, processes, and responsibilities that determine how an organization uses, oversees, and reports on the artificial intelligence systems it employs. It is not just a legal requirement—it is a risk management mechanism. Without it, the company does not know what data is being processed by external tools, what kind of content its AI-powered systems are generating, or whether any of its processes fall into the risk categories regulated by the AI Act.
What does the European AI Regulation (AI Act) require of companies?
The AI Act classifies AI systems into four categories based on their level of risk. Understanding which category each system your company uses falls into is the first step in determining which obligations apply.
The bans have been in effect since February 2025: social scoring systems, subliminal manipulation, and emotion recognition in workplace and educational settings in most cases. For general-purpose systems such as ChatGPT or Copilot, transparency requirements are the most significant: notifying users when they are interacting with an AI and labeling synthetic content in a machine-readable format. The Regulation requires organizations to have internal policies on the use of AI: who can approve the implementation of a new system, how human oversight is managed, how results are documented, and how complaints are handled. These policies must be in writing and known to the individuals who make decisions regarding AI within the company.
What are the risks of using Copilot, ChatGPT, or Gemini without an internal policy?
There are three types of risks. The legal: If an employee enters customer data, contractual information, or personal data into an external AI tool without following the established usage protocol, they may be in violation of the GDPR, the contract with the customer, and confidentiality obligations. The operational: If the company doesn't know which tools are being used or for what purpose, it cannot guarantee the quality or traceability of the outputs those tools generate. And the reputational: An error generated by AI that goes undetected due to a lack of human oversight can have costly consequences when dealing with customers or regulatory authorities.
A Step-by-Step Guide to Creating an Internal AI Usage Policy
The process has four phases. The first is the inventory: Identify which AI tools teams are using, how often, and for what tasks. The second is the risk classification: determine which uses are low-risk (drafting, internal summaries) and which require oversight or restriction (analysis of customer data, generation of legally binding documents). The third is the policy drafting: define what is permitted, what requires prior approval, what is prohibited, and who is responsible for oversight. And the fourth is the training: Communicate the policy to the team and ensure that it is understood and implemented.
The downloadable template at the end of this article can serve as a starting point for the third phase.
This policy establishes the rules for the use of artificial intelligence tools and systems at [company name], with the aim of ensuring responsible and secure use in compliance with current regulations, in particular Regulation (EU) 2024/1689 (AI Act) and the General Data Protection Regulation (GDPR).
This policy applies to all employees, contractors, and suppliers who use AI tools in the performance of their duties for the company.
| Tool | Status | Authorized Uses | Specific Restrictions |
|---|---|---|---|
| ChatGPT (OpenAI) | Subject to conditions | Drafting, summarizing, translation, analysis of public texts | Do not enter customer data, personal information, or confidential information |
| Microsoft Copilot | Subject to conditions | Assistance with internal documents, emails, and presentations | Verify business data settings before use. Do not use in contracts or legally binding documents without human review. |
| Google Gemini | Subject to conditions | Information search, idea generation, text analysis | Do not enter customer data or confidential project information |
| [Add Tool] | Approved | [Describe uses] | [Describe restrictions] |
| [Add Tool] | Unauthorized | — | [Reason for the restriction] |
Any tool not included on this list requires prior approval from the AI manager before it can be used.
| Type of Use | Status | Conditions or reason |
|---|---|---|
| Drafting and Internal Communications | Allowed | Always review the output before sending it. Do not assume that the generated content is correct without verifying it. |
| Meeting summaries or internal documents | Allowed | Only documents that do not contain confidential information about third parties. |
| Code generation or task automation | Subject to conditions | It must be reviewed by a qualified technician before being implemented in production systems. |
| Analysis of client proposals or documents | Subject to conditions | Only if any personally identifiable information or confidential data has been removed beforehand. |
| Creation of marketing content or external communications | Subject to conditions | Requires review and approval before publication. Indicate the use of AI when relevant. |
| Entering personal information about employees or customers into external tools | Prohibited | It violates the GDPR. This could result in a data breach with serious legal consequences. |
| Using AI to make decisions that affect employees (evaluation, hiring, etc.) | Prohibited | Requires mandatory human supervision in accordance with the AI Act. Only with express authorization from management. |
| Using AI tools not approved under this policy | Prohibited | Request prior approval from the AI manager before any use. |
- Employee personal information (name, ID number, pay stubs, health information, performance reviews)
- Personal information of customers or business contacts
- Confidential contractual information or information subject to a non-disclosure agreement (NDA)
- Non-public financial information (results, budgets, forecasts)
- Intellectual property, patents, designs, or protected technical know-how
- Login credentials, passwords, or IT security information
- Information regarding ongoing audits, inspections, or legal proceedings
| Role | Responsibilities |
|---|---|
| AI Manager | Keep the list of approved tools up to date, manage requests for new tools, review and update this policy at least once a year, and receive reports of incidents related to the use of AI. |
| Data Protection Officer | Verify that the use of AI tools complies with the GDPR, manage data breaches that may result from the improper use of AI, and update the record of processing activities when new tools are implemented. |
| Every employee | Understand and follow this policy; request authorization before using unapproved tools; report any incidents or observed misuse to the AI lead; and ensure human oversight of AI outputs before using them. |
Any improper use of an AI tool, any data breach resulting from its use, or any incorrect result that impacts customers or processes must be reported to the AI manager within 24 hours of detection.
Building teams: the first real step in AI governance
An AI usage policy that the team doesn't understand or doesn't know how to implement isn't a policy—it's just a document in a folder. Effective AI governance starts with teams that are familiar with the tools, understand the risks involved, and know when to apply human oversight. That requires specific training, Not just internal communication.
