Sample · Part I · Sections 1 – 5 · The five records

The usage policy and the one-page summary

In brief: The main document with nine areas of regulation, the gaps in each and what they mean; plus the one page that actually gets read.

The usage policy is the written form of decisions that management has taken beforehand. The handbook puts it in one sentence: whoever drafts a policy before deciding writes down wishes. That is why the file nutzungsrichtlinie-en.docx contains, for each area of regulation, not a finished paragraph but a paragraph with one or more yellow passages — and next to each passage a sentence on what the decision means.

1.1 Where the nine areas come from

The policy follows the handbook, not the other way round. Section 7 of the handbook goes through the subjects that belong in a usage policy and states for each where the requirement comes from and what happens if the point is missing. The selection rests on three published sources: the guidance of the German Data Protection Conference, which recommends clear internal instructions, their documentation and concrete examples of permitted and prohibited scenarios; measure M16 of the German Federal Office for Information Security, under which users should be told which applications they may use for which purposes, which inputs they may make and how they may reuse outputs; and the template of the Austrian Economic Chamber with its nine paragraphs.

Both authorities are German bodies; their recommendations are professional guidance, not a legal duty, and not binding in other Member States. The handbook records in section 3 that no express legal duty to keep an AI usage policy is apparent in the AI Act or in data protection law. The policy in this kit is therefore not a mandatory document but the means by which the business passes its decisions on to staff and can later show that it took them.

The nine areas, in the order of the handbook: permitted tools and access · permitted and prohibited uses · prohibited inputs · handling unavoidable personal data · review before use · release of documents leaving the business · labelling · reporting incidents · responsibility for doubtful cases.

1.2 The gaps, area by area

Header. Name of the business, effective date, version line, responsible person. The effective date should come after the briefing, because a policy nobody knows is, according to the handbook, worse than none — it feigns security (section 1). The version line carries a date so that, after a later change, it remains visible which version applied when (section 9).

Area 1 — Permitted tools and access. Two gaps: the reference to the register as the place where permitted tools are listed, and the decision whether private accounts are permitted for work. The supervisory authority recommends business devices and accounts because private accounts can create profiles of individual employees; the handbook concludes that a policy must name tool and access path — naming only the tool permits use through the private access as well (sections 6 and 7). In the example business, the two fitters with the privately set-up tool are the reason this gap cannot be filled with “as before”: either they get access through a business account, or use on the private phone for work ends on the effective date.

Area 2 — Permitted and prohibited uses. The gap for permitted uses asks for activities that actually occur in the business, not categories from a template. The gap for prohibited uses is pre-filled with the one case the handbook derives from Annex III of the AI Act — final decisions about persons are not based on an AI result — and leaves room for cases specific to the business. Uses in the personnel area are listed in Annex III as high-risk cases; the policy is the place where a business rules them out before the obligations for them become applicable (sections 3 and 7). The prohibition names uses, not tools. In the example business the permitted uses are: drafts of quotation texts, summaries of manufacturers' documents, translations for two fitters whose first language is not German, help with wording complaint letters. Prohibited: anything concerning job applications or the assessment of individual employees.

Area 3 — Prohibited inputs. The gap is a list of types of data that occur in the business, plus a rule for doubtful cases. The kit pre-sets five types found in practically every business — details of customers, employees and applicants; login data and keys; calculations, prices, contracts and customer lists; health data; third-party documents received in confidence — and leaves room for more. The rule for doubtful cases is the decisive part: a list without it is incomplete, because no catalogue covers every case. The strongest reason for this area is the trade secret: under Directive (EU) 2016/943 information is a trade secret only if it has been subject to reasonable steps to keep it secret. Whether an AI policy is recognised as such a step is undecided — the handbook says so expressly — but without a rule there is in any case no indication that the business took any step at all. The example business adds: the costing sheets per job and the access codes to customers' premises.

Area 4 — Handling unavoidable personal data. The gap asks which processes involving personal data may go into a tool at all, and with what preparation. The handbook relays the supervisory authority: removing names and addresses is regularly not enough, because the reference can be reconstructed from the context. The rule must therefore say when a process does not belong in a third-party system at all (section 7). The example business decides: customer data does not go into the tool; the complaint letter is drafted with placeholders and the office manager inserts the details afterwards.

Area 5 — Review before use. The gap names what is to be checked — figures, names, deadlines, references, standard designations — not only that a check is due. A general duty to check is read as a formality; the BSI requires that users be enabled to question outputs critically, adapt them and restrict their reuse. The example business adds references to standards in quotations, because the tool invents standard numbers in correct format.

Area 6 — Release of documents leaving the business. The gap names a person or role, not a department. The handbook says openly that it found no source expressly requiring release by a second person; it justifies the point as the organisational counterpart of the duty to check (sections 7 and 13). Deleting this area places the check on the author alone. The example business enters the office manager, in her absence the owner.

Area 7 — Labelling. The gap requires a responsible person and refers to the labelling checklist (section 4 of this guide). The handbook names two opposite mistakes: labelling nothing where required, or labelling everything as a precaution. A sentence such as “where required by law” hands the decision back to staff and is therefore not a rule.

Area 8 — Reporting incidents. The gap names who is to be told. The sentence that the report itself has no consequences is not set as a gap in the file but fixed — with the note that a business which deletes it learns of incidents last. None of the sources consulted expressly requires such a reporting channel; the recommendation follows from the incentives (sections 7 and 10).

Area 9 — Responsibility for doubtful cases. The gap names a person or role and a way of reaching them. The supervisory authority recommends involving the data protection officer; in businesses without that role — like the example business — a person must be named (section 7).

End. Announcement, follow-up, place, date, management's signature. The handbook names three triggers for a review — a new or changed tool, changed provider terms, a changed legal situation — plus a fixed date so that the review does not depend on someone noticing the change (section 9). How often is not documented in the handbook and is therefore a gap in the kit.

1.3 The one-page summary for posting

The file kurzfassung-aushang-en.docx (and the same page as PDF) is the one page that actually gets read. It does not contain any area in full but three things: what must never go into a tool, with drawn tick boxes so that the page can be gone through point by point at the briefing; what is checked before use; and who to ask in case of doubt and who to report an incident to. The gaps on this page are the same as in areas 1, 3, 5, 8 and 9 of the policy; they are taken from the policy, not decided anew. Filling in both files independently risks the notice and the policy contradicting each other.

The design follows the rules of the self-assessment sheet accompanying Volume 1: drawn tick boxes, enough line spacing, no dark areas, so that the sheet remains legible on any office printer.

1.4 What the example business ends up with

Three pages of policy, signed by the owner, effective two weeks after the briefing, follow-up in twelve months and with every new tool. The notice hangs next to the printer and sits as a PDF in the fitters' vehicle folder. Nobody had to read a law for it — but every line of the policy can be justified with a section number in the handbook.