Purpose and structure
This handbook is addressed to the management of companies in which more than one person uses AI tools — and which have to decide what is put in writing about it.
It answers a single question in its parts: What do we write down, and why precisely that? Not which tool is any good. Not where to click. Rather: which decisions are taken before the writing begins, what belongs in a set of rules, how it comes into force and stays current, and what happens if someone does not comply with it.
Structure
Four parts. Part I addresses what a set of usage rules can achieve, what the situation looks like without one, and how far the law and the supervisory authorities require it. Part II addresses the decisions to be taken before the writing begins. Part III addresses the rules themselves: their content, training, entry into force, and how to handle breaches. Part IV contains a self-assessment of the state of the rules, together with delimitations, open questions, a glossary and the list of sources.
Relationship to Volume 1
This handbook does not presuppose Volume 1, “AI in the Company”. Where Volume 1 has already answered a question with a source and a date, this handbook refers to it instead of proving it again; each reference states in one sentence what is dealt with there, so that this handbook remains readable on its own. The terms of that glossary are adopted and not redefined.
Scope
The governing legal framework is the law of the European Union, in particular the Artificial Intelligence Act as amended in July 2026 and the General Data Protection Regulation. Switzerland is not the subject of this volume.
On the subject of this volume, uniformity ends earlier than elsewhere. Employment law is not harmonised across the Union: the General Data Protection Regulation expressly permits Member States to provide “more specific rules to ensure the protection of the rights and freedoms in respect of the processing of employees’ personal data in the employment context”, and works council participation is regulated differently from one Member State to the next. Where this handbook names national provisions, it does so as an illustration of that diversity, not as a statement of the law of any one State.
Source: Art. 88(1) Regulation (EU) 2016/679, consolidated text 02016R0679 — EN — 04.05.2016 — 000.003, eur-lex.europa.eu (accessed 8 September 2026).Handling of sources
Every statement that a reader may understand as an obligation carries a primary source with its version, the provision and the date of access. Source lines appear immediately beneath the statement concerned; the full list is in Section 15.
Where a statement could not be substantiated, this is expressly noted — as not ascertainable, with the reason, and not as an estimate. Those places are collected in Section 13.
The recommendations on which this handbook relies come from national bodies. A Union-level counterpart — a publication by a body of the Union addressing how a company’s workforce handles AI tools internally — was sought and not found in the sources consulted. The two obvious candidates deal with something else: the orientations issued by the European Data Protection Supervisor on 28 October 2025 are addressed to Union institutions, bodies, offices and agencies and rest on Regulation (EU) 2018/1725; Opinion 28/2024 of the European Data Protection Board deals with the anonymity of AI models and the legal basis for their development. For that reason, each recommendation states which body issued it and for which territory it applies.
This handbook is no substitute for legal advice and is not a commentary. It contains no model wording for a set of usage rules; it explains what belongs in such rules and why. Where individual sentences are shown as examples, they are marked as examples and do not replace wording tailored to the company.