Sample · Kit

Purpose and structure

In brief: What this kit is, what it is not, in which order it is filled in, and how you can tell it is finished.

This kit is for the management of a business in which more than one person uses AI tools — and which wants not only to regulate but to show what has been regulated, which tools have been reviewed and who has been briefed. It supplies five records as editable files: a usage policy with a one-page summary for posting, a tool register with an approval form, a training record, a labelling checklist and a plan for entry into force. This guide says, for each file, what it does, which decisions the business must take in it, and what each decision means.

What the kit is

A set of forms in which the passages where the business has to decide are highlighted in yellow and set in square brackets. Next to each of these passages stands one sentence in italics: what the decision means and where in the handbook “AI Policies for the Workforce” (Volume 2 of the series) the basis is given. That is the rule which sets this kit apart from a collection of templates: every gap is marked and explained. A template in which you only enter the company name decides, in the business's place, things it cannot see.

The kit does not presuppose Volume 2. Anyone who only wants to fill in the forms gets through with this guide; anyone who wants to be able to explain why a point is in the policy finds the reasoning, with source and date, in the handbook at the place named next to the gap.

What the kit is not

It is not legal advice and not a legal opinion. No file claims that a business complies with a rule by using it. Nor does the kit establish any legal position anew: where it names a provision, it cites the handbook by section number or the source given there with its date; where date and source are missing, it says “check current status”. What the handbook deliberately does not say — for instance how long a training record must be kept — the kit does not say either; it leaves the passage as a gap and explains why.

The kit contains no names of tools or providers and no completed approval list: a supplied list of names would be out of date the moment it is printed. It supplies the empty register and the procedure by which the business keeps it itself, with a date in every row.

The order

1. Open the entry-into-force plan (inkraftsetzung-en.xlsx). The sheet is the plan for everything else; the responsible person and the intended effective date are entered there first.
2. Fill in the usage policy (nutzungsrichtlinie-en.docx). Nine areas of regulation, each with one or more gaps. This is where the decisions are taken; everything else depends on them.
3. Create the tool register (tool-register-en.xlsx, freigabeformular-en.docx). Every tool actually used in the business gets a row; every tool to be approved gets an approval check.
4. Post the one-page summary (kurzfassung-aushang-en.docx or .pdf). One page with what must never go into a tool, and with the route to take in case of doubt.
5. Hold the briefing and record it (schulungsnachweis-en.docx, schulungsnachweis-en.xlsx). The policy is gone through with staff; date, participants and content are recorded.
6. Create the labelling checklist (kennzeichnungs-checkliste-en.docx) as soon as the business publishes AI content or lets an AI system speak directly to customers; a business that does neither records that with a date.
7. Complete the entry into force. Tick the last rows, enter the follow-up.

How you can tell it is finished

The kit is finished when a folder — on paper or as a file store — contains five things that together answer one question: What have we regulated, since when, for which tools, and who knows about it?

• The usage policy with effective date, version line and management's signature; no yellow passage left open.
• The tool register, in which every tool in use has a row with review date and follow-up, and a completed approval form for every approved tool.
• The training record with one signature per person who uses AI tools for work, and the list of content covered.
• The labelling checklist per publication or per system — or a dated note that the business currently publishes nothing and lets no system speak directly to persons.
• The entry-into-force plan, in which every row carries a date and the follow-up is entered.

The example business

The examples in this guide refer to a fictitious electrical installation business with twelve employees: an owner, who is also the management, an office manager, two further office staff, seven fitters and an apprentice. There is no IT department and no data protection officer; the office manager looks after the computers on the side. Three people in the office use an AI tool for quotation texts, summaries and translations; two fitters have set one up privately on their phones. The business is located in Austria. People appear by their role, never by name.

Choice of words

The files and this guide say tool; the German edition of the handbook says Werkzeug at the same places. What is meant is the same: an AI system that the business uses as deployer and did not develop itself. Area of regulation means one of the nine subjects the handbook names in section 7 for a usage policy. Record here means a sheet that shows, with date and signature, that something was regulated, reviewed or carried out — not that it is legally sufficient.