Team AI Policy

Write the working rules that sit between your organization's general policy and the team's daily work: which tools, which data never goes in, who checks what, when you tell people AI was used, and who decides the unclear cases. Draft it, test it with the team, publish it.

Standard or regulation: the EU AI Act's AI literacy duty (Article 4, Regulation (EU) 2024/1689 as amended) and data protection guidance from IMY and the EDPB. The policy structure is practice, not research.

Use it when:

• Your team uses AI tools without shared rules, or each person has made up their own.
• The organization's policy exists but is too general to answer everyday questions.
• A new tool, a near miss or a new rule has just made the gap visible.

Skip it when:

• You do not yet know which rules reach your role: start with 10.3 Rules That Apply to My Role.
• The organization's policy already answers the six questions in Section 3 concretely: adopt it and spend the time on 10.11 AI Adoption Plan.

This page rests on a rule and on practice, not on research. The rule: the EU AI Act's literacy duty (Article 4) applied from February 2025 and was reworded by a 2026 amendment. Providers and deployers must now take measures that support the AI literacy of the staff who use AI on their behalf, with regard to their knowledge, experience and context of use, without a guaranteed level for each person (Regulation (EU) 2024/1689 as amended by 2026/1744). Data protection law applies to AI use as to any other processing, and the Swedish authority IMY and the European board EDPB publish guidance on what that means (IMY; EDPB). Neither tells a team lead what to write on Monday.

That gap is what the page fills. In practice, people under deadline follow rules they helped write, can find in a minute and can apply without asking. So the policy is one page, written with the team, and tested against the questions people actually ask. It names who decides exceptions, because unclear cases otherwise get guessed. It makes reporting a slip blame-free, because silence is the expensive outcome.

The limit: a team page adds to the organization's policy and the law. It can never loosen them.

Read your organization's AI or IT policy and note what is already decided, so the team page adds to it rather than contradicting it. Your 10.3 inventory is the quickest source.

Strong answer: "Corporate policy: two approved tools, no personal data in public tools. Nothing on disclosure, exceptions or training. Data questions go to the data protection officer."

What the organization's policy already decides:

Approved tools, and where the list lives:

Who answers data protection questions (a role):

What the team page must add:

Illustrative example: the team and the organization are made up.

The communications lead at a municipal housing company in Sweden has a team of seven with three unofficial AI habits and one near miss: a tenant's complaint pasted into a private account.

Section 1: the corporate policy lists two approved tools and bans personal data in public tools, but says nothing about disclosure, exceptions or slips.

Section 2: encouraged uses are drafting, summarizing published material and headline ideas. Tenant correspondence goes only into the approved tool, with names removed. Level 3 checks for anything with figures. Disclosure on published text. The lead decides exceptions within two working days.

Section 3: the team meeting finds two gaps: freelancers' own tools, and AI-generated images needing a brand review. Question 6 had no answer; the Slips row now says "tell the lead the same day".

Section 4: pinned in the team channel. The first quarterly review adds a rule for a new agent feature in the approved tool.