AI Workplace Policy Template 2026 — Free EU AI Act + DPDP-Ready Download

What an AI workplace policy must cover in 2026

An AI workplace policy in 2026 needs seven pillars: scope and definitions, lawful basis and consent, the decision categories where AI is permitted or banned, human oversight on material decisions, employee transparency and rights, vendor and model governance, and an audit and review cadence. A policy that only covers acceptable-use of ChatGPT is doing one-seventh of the job. The legal weight in 2026 sits on the other six pillars, and a missing pillar is what an EU AI Act conformity reviewer or a DPDP grievance officer will land on first.

Walk the seven pillars in order. Each one has a specific decision the policy must make on paper, not a vague principle.

1. Scope and definitions. Name the systems in scope (productivity platforms, hiring tools, scheduling AI, generative copilots, evaluation models). Name the employee groups (full-time, contractors, vendor workers operating on internal systems). Define what counts as an AI decision versus an AI-assisted human decision. The line between the two is where most disputes will land in 2026.
2. Lawful basis and consent. State the legal basis for each AI use under GDPR (legitimate interest, contract, consent) and under DPDP (consent, certain legitimate uses). Do not collapse to a single basis across the policy — different AI uses sit on different bases. Calendar-state reading sits on a different basis than emotion inference, and they should be named separately.
3. Decision categories — allowed, conditional, banned. Three lists. The allowed list covers AI uses the employer endorses by default (drafting, summarisation, coding assistance with named vendors). The conditional list covers uses that need manager sign-off or DPIA (productivity scoring, hiring screen, performance evaluation). The banned list covers Article 5 prohibitions and any employer-specific stops.
4. Human oversight on material decisions. Name which decisions require a human in the loop and how the loop is evidenced. A productivity flag that triggers a manager 1:1 is one human-oversight pattern; an AI-only hiring rejection is forbidden under Article 22 of the GDPR for fully automated decisions with legal or similarly significant effect. Spell this out — do not leave it implicit.
5. Employee rights and transparency. The policy must state what data the AI system processes, how the employee can see their own record, the route to dispute an AI-driven decision, and the right to request human review. Under DPDP, name the grievance officer and the response timeline.
6. Vendor and model governance. Which AI vendors are approved. Which sub-processors are blocked. Where data is hosted (EU, India, US). What model versions are pinned and how upgrades are reviewed. Most 2023 policies skip this entirely — and it is the section a procurement team will need first.
7. Audit and review cadence. A documented review cycle (quarterly is the floor for high-risk uses, annual is the ceiling). Who owns the audit (DPO, CISO, legal, HR). What the audit covers (proportionality, accuracy, drift, consent freshness, vendor posture). What triggers an ad-hoc review (vendor change, regulator guidance, incident).

How the EU AI Act and DPDP shift the template

The 2026 regulatory map is not a single framework — it is two parallel ones with overlapping obligations and a few sharp differences. The table below shows where each framework sits on each of the seven pillars. An employer running AI across both regions has to satisfy the stricter of the two on each line.

The DPDP Rules implementing the Act are expected to be notified late 2025 or 2026, which means India sections of the policy should be drafted to flex with the final rules — name the Data Fiduciary and the grievance officer, hedge any timelines tied to specific Rule provisions. The deeper India-specific worksheet for the 14 questions a CISO should score before notification lives in the DPDP Rules CISO worksheet. [needs-legal-review]

On the EU side, the Annex III high-risk classification is the operational trigger that pulls a workplace AI system into the conformity assessment, technical documentation, and post-market monitoring stack. The vendor-readiness scorecard that walks 14 questions an EU CISO should ask procurement is in the EU AI Act vendor-readiness scorecard. [needs-legal-review]

The three clauses most templates miss

We have reviewed perhaps forty AI workplace policies drafted by HR teams between 2023 and early 2026. The same three gaps appear in almost all of them.

1. The emotion-inference clause

EU AI Act Article 5 prohibits AI systems that infer emotions of natural persons at the workplace — with narrowly drawn exceptions for medical or safety reasons. Most 2023 policies predate that line being clarified. Sentiment analysis built into engagement surveys, tone analysis on internal chat, AI-driven mood scoring on calls — all sit close to or across the line. The policy should ban these by name, not leave them implicit.

2. The surveillance-default-off statement

Every productivity tool ships with default configurations. Almost none of those defaults match the policy intent. Screenshots are usually on by default; screenshot frequency is set by the vendor not the employer; keystroke logging is on by default in several mid-market products. A policy that does not state a surveillance-default-off posture leaves the technology defaults as the de-facto policy. The statement is simple — "all monitoring features default off; any feature must be enabled by named role-based exception with DPO sign-off" — and it carries a lot of weight.

3. The vendor governance clause

The 2023 templates focus on what employees may and may not do with AI. The 2026 question is what AI vendors the employer may and may not bring in. The clause should name the approved-vendor list, the sub-processor blocklist, the data-residency requirement (EU AI workloads stay EU, India SDF data stays India), the model-version pinning rule, and the change-review trigger. Without this clause the policy cannot answer the procurement question that arrives every quarter — "can we use this new AI tool?"

The free download

The working draft below covers all seven pillars, names the Article 5 prohibitions, includes the surveillance-default-off statement and the vendor governance section, and ships with a DPDP-specific India appendix that flexes for the final Rules. It is a starting draft — counsel review before deployment, always.

FAQ