Company AI policy and the AI Act: clear rules for using AI at work

The AI Act does not ask for a document with that name, but it asks companies to train staff and to respect prohibitions and transparency duties: a written policy is the simplest way to show what the company does. The GDPR still applies to all personal data.The AI Act does not ask for a document with that name, but it asks companies to train staff and to respect prohibitions and transparency duties: a written policy is the simplest way to show what the company does. The GDPR still applies to all personal data.

Allowed tools, data not to enter, who approves a new use, the map of uses with the risk and how often it is reviewed.Allowed tools, data not to enter, who approves a new use, the map of uses with the risk and how often it is reviewed.

It asks companies to take measures so that staff have the skills to use AI (AI literacy). After the 2026 Digital Omnibus what counts is being able to show what was done, for example with an attendance record and a test.It asks companies to take measures so that staff have the skills to use AI (AI literacy). After the 2026 Digital Omnibus what counts is being able to show what was done, for example with an attendance record and a test.

Penalties reach up to 7% of worldwide annual turnover for prohibited uses and up to 3% for the other obligations, or a fixed amount if higher; for SMEs the lower of the two applies. In Italy the authorities named by law 132 of 2025 supervise.Penalties reach up to 7% of worldwide annual turnover for prohibited uses and up to 3% for the other obligations, or a fixed amount if higher; for SMEs the lower of the two applies. In Italy the authorities named by law 132 of 2025 supervise.

With a person’s oversight where needed, a log of every action and data where the company decides. For personal data Yellow Tech is the data processor and signs a DPA, and the company remains the controller.With a person’s oversight where needed, a log of every action and data where the company decides. For personal data Yellow Tech is the data processor and signs a DPA, and the company remains the controller.

Yellow Tech is an Italian company that writes the AI policy with companies, trains staff as article 4 of the AI Act requires and builds AI agents with oversight and a log.Yellow Tech is an Italian company that writes the AI policy with companies, trains staff as article 4 of the AI Act requires and builds AI agents with oversight and a log.

If it uses AI systems it must train the staff who use them, avoid prohibited uses and, from August 2, 2026, disclose when a customer is talking to an AI or reading generated content. For high-risk uses, such as recruitment, the rules arrive from December 2, 2027.If it uses AI systems it must train the staff who use them, avoid prohibited uses and, from August 2, 2026, disclose when a customer is talking to an AI or reading generated content. For high-risk uses, such as recruitment, the rules arrive from December 2, 2027.

Neither makes a use compliant on its own: with on-premise personal data stays on the company’s servers, in the cloud it depends on the vendor and where its servers are. The AI Act looks at how AI is used, not at where the model runs.Neither makes a use compliant on its own: with on-premise personal data stays on the company’s servers, in the cloud it depends on the vendor and where its servers are. The AI Act looks at how AI is used, not at where the model runs.

It depends on how many departments are interviewed, how many uses of AI are mapped, the article 4 training and any custom agents to include. The quote comes after a first analysis of the process.It depends on how many departments are interviewed, how many uses of AI are mapped, the article 4 training and any custom agents to include. The quote comes after a first analysis of the process.