AI usage policy template for European teams

A policy you can adapt

Replace every bracketed field before sharing this policy. Confirm each approved tool with your security owner and explain the rules to your team.

1. 1. Purpose and ownership

   [Organisation] permits AI for [approved tasks]. [Policy owner] maintains the approved-tool list, answers questions and reviews this policy on [review date]. Separate approval is required for new tasks or tools.

2. 2. Approved tools and individual access

   Use only tools and models on [approved-tool list], with organisation-approved accounts and individually assigned keys. Do not share keys or put them in source code. Ask [access contact] for access, a budget and an expiry date.

3. 3. N1 Public

   Submit only information authorised for external sharing. A public webpage may still contain personal data or protected material. Check permission before reusing it. Public availability is not permission to process personal data.

4. 4. N2 Internal

   Internal procedures and working documents may go only to environments explicitly approved for N2 Internal. Remove unnecessary details. Check the model, provider and permitted data level before uploading a file or connecting a document source.

5. 5. N3 Confidential

   Customer files, non-public contracts and other confidential material require specific approval and documented safeguards. Do not submit them to consumer chat services. European hosting alone is insufficient: assess retention, training reuse, access, contracts and international transfers.

6. 6. Experimental

   Use synthetic examples or information authorised for public sharing unless a separate assessment permits more. Experimental is not a higher confidentiality level. If a document is unclassified, ask [security contact] before submitting it.

7. 7. Minimum necessary inputs

   Include only what the task needs. Remove identifiers where possible; removing names does not necessarily anonymise a file. Personal data needs its own assessment regardless of classification. Never submit passwords, access tokens or provider keys as prompts.

8. 8. Human review and consequential decisions

   The employee using AI remains responsible for the final result. Before sharing, publishing or deploying it, verify facts, calculations, sources, rights and code behaviour. Do not delegate decisions affecting people to AI alone. Recruitment and similar uses require specialist review before introduction.

9. 9. Reporting and review

   Report accidental disclosure, incorrect access or unsafe results to [incident contact] promptly, without copying sensitive content into the report. [Security owner] decides containment and follow-up. Train employees before granting access and review approvals whenever a provider or use changes.

Before you approve a model

• Record its provider, processing location and permitted data levels. Do not infer location from the model publisher's nationality.
• Review retention, training reuse, subprocessors, contractual protections and transfer arrangements. Record the evidence and the person who approved it.
• Test access with synthetic data. Assign a named user, a small budget and an expiry; decide who may approve changes.
• Explain the policy using one real task and one example that needs additional approval. Make the approval contact easy to find.

A gateway enforces access, not judgement

AI-GATEWAY can restrict a key to selected models and a declared data level, apply budgets and record usage metadata. It cannot classify every prompt or establish lawful processing. This hosted portal does not yet provide separate customer organisations; contact us before connecting a production team. ai-gateway@nanocorp.app

The free plan covers up to 2 users. Provider usage is paid separately through your own provider contract.

Read the API integration guide