Contents
Short answer
Decide which AI services are approved and what information may be entered. Passwords, keys and other secrets never go in; internal, personal or customer data only after the service has been checked. People review results before they are used. Under Art. 4 of the EU AI Act, companies that deploy AI systems must also take measures to support the development of AI literacy among those using them.
What are the risks?
Confidential and personal data
Inputs can contain trade secrets, internal documents, customer data or personal data. How a service uses, stores or trains on inputs differs by service, contract and setting – clarify this before approval.
Credentials
Passwords, API keys or tokens in prompts, code snippets or logs may be stored or exposed.
Wrong or invented results
AI systems can produce plausible-sounding but incorrect facts, figures or sources.
Insecure code and scripts
Generated code may contain errors or vulnerabilities and should be reviewed like third-party code.
Copyright
Reusing outputs can raise copyright questions. Seek qualified advice if needed.
Shadow AI
When unapproved services are used with private accounts, you lose track of where company data goes.
Simple AI policy (editorial guidance)
| Category | Examples |
|---|---|
| Allowed | General wording, publicly known information, brainstorming without confidential data |
| Only after review | Internal documents, customer data, personal information, source code, contract content |
| Never enter | Passwords, API keys, access tokens and other secrets |
Step by step
- 01
Take stock
Ask openly which AI services the team already uses – without blame.
- 02
Approve services
Check requested services against the approval checklist and name the approved tools.
- 03
Write the policy
Capture the three categories in a short, clear rule and name a contact for unclear cases.
- 04
Enable the team
Explain risks and review rules in line with actual use, for example as part of your security awareness work.
- 05
Allow incident reporting
Anyone who accidentally entered confidential data should be able to report it without fear. Then check whether personal data is affected.
- 06
Review regularly
Services, terms and the law change. Review the rules at least once a year.
Don’t use AI results unchecked
- Verify facts and names.
- Recalculate figures.
- Open cited sources and check that they exist and support the statement.
- Test generated code and have it reviewed before use.
- Don’t use legal or specialist statements without review.
- Don’t automate decisions with significant effects on people without appropriate human review.
AI literacy under Art. 4 AI Act
Under Art. 4 of Regulation (EU) 2024/1689, in the consolidated version of 27 July 2026, providers and deployers of AI systems take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf. This takes into account, among other things:
- their technical knowledge, experience, education and training,
- the context in which the AI systems are used,
- the persons or groups of persons on whom the AI systems are to be used.
- The obligation does not require providers or deployers to guarantee a specific individual level of AI literacy.
- The law does not prescribe a specific training format or certificate. Type and scope depend on the use.
Check before introducing an AI tool
This list does not replace a data protection impact assessment where one is required.
- Purpose: what will the tool be used for?
- Data types: what information will be entered?
- Provider and location
- Contract terms, especially on use of inputs
- Data protection, including processing agreements where relevant
- Storage, history and training settings
- Access rights and company accounts instead of private accounts
- Approval by the responsible person or function
- Human control of results
- Exit and data export where relevant
Checklist
- Approved AI services are named.
- The three categories “allowed / only after review / never enter” are known.
- Company accounts are used instead of private accounts.
- Storage and training settings have been checked.
- Results are reviewed by people before use.
- AI literacy measures suited to the use are in place.
Common mistakes
- Banning AI outright – this often drives unapproved use.
- Assuming inputs are always or never used for training without checking the terms.
- Pasting code with embedded keys for debugging.
- Accepting sources named by the AI without checking them.
- Believing a particular certificate is legally required.
Frequently asked questions
Do we have to ban AI tools?
No. Clear rules and approved services are usually more effective than a blanket ban.
Are our inputs used to train the model?
That depends on the service, the contract and the settings. Check this for each service before approval.
Is AI training legally required?
Art. 4 AI Act requires measures to support the development of AI literacy but does not prescribe a specific format or certificate.
May personal data be entered into AI tools?
Only after checking the service, especially regarding data protection and contract terms. If in doubt, seek data protection advice.
What if someone accidentally entered confidential data?
Have it reported, delete the history if possible, change affected credentials and check whether a personal data breach has occurred.
Sources
- EUR-Lex – Regulation (EU) 2024/1689 (AI Act), consolidated version of 27 July 2026, Art. 4
- European Commission – AI Literacy: Questions & Answers
- BSI (German Federal Office for Information Security) – Artificial intelligence
Checked on 7 October 2026.
This content is for general guidance and does not replace legal or data protection advice. The usage rules are an editorial suggestion for your internal organisation, not a legal requirement.