If you have staff, some of them are probably already pasting work into ChatGPT or a similar tool. That is not necessarily a problem, but it should be a decision rather than an accident. This guide covers what the Dutch data protection authority, the EU AI Act and the Dutch business portal say, and gives you a starter AI policy to adapt.
We build AI automations, so we have an interest in AI being used well. The facts come from the sources linked at the end. The policy template is our suggestion. This is not legal advice; for questions about your own situation, ask a privacy lawyer or your data protection officer if you have one.
What the sources say was checked on 26 October 2026. Rules and guidance change, so check the linked pages.
What the Autoriteit Persoonsgegevens published in July 2026
On 13 July 2026 the Dutch data protection authority (AP) published a tool for generative AI and the GDPR (in Dutch, "Hulpmiddel generatieve AI en de AVG"). According to the AP's page:
- It helps you assess whether your organisation wants, can and may use generative AI, and helps with implementation and putting it into use.
- Using it before you buy, implement and use generative AI helps your organisation meet the requirements of privacy by default and privacy by design.
- It is mainly meant for organisations that want to give generative AI applications access to existing files or data in the organisation, but the AP says it can be useful beyond that.
The same page has the AP's advice on a prior consultation request from the municipality of Haarlemmermeer about Microsoft 365 Copilot. The AP concluded that the planned processing would infringe the GDPR and explains why in its advice. That was one organisation's specific plan, not a ruling on the product for everyone, but it shows why the check matters before connecting an AI tool to your files.
The AP also has a separate guidance document for organisations that develop or are responsible for putting generative AI models into use.
What the EU AI Act says about staff
Article 4 of the EU AI Act, on AI literacy, applies from 2 February 2025. It says providers and deployers of AI systems must take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and others using AI systems on their behalf, taking into account their knowledge, experience, training and the context. It does not require any specific level of AI literacy from any individual.
In plain words: if your staff use AI at work, train them in how to use it. A short written policy and a short briefing is a reasonable first step. We checked the text on artificialintelligenceact.eu; check whether it has been amended since.
What business.gov.nl says if you run a shop
The Dutch business portal says that if you use AI-generated images or text in your online shop, or use AI in any other way, for example a chatbot, you must clearly inform visitors about this.
A starter AI policy
Copy this, change what does not fit your business and keep it to one page. It is our suggestion, not a legal template.
1. Which tools may we use? List the approved tools by name and who has an account. Anything not on the list needs approval first. Use business accounts rather than personal ones.
2. What may never be pasted into an AI tool? Decide this explicitly. A sensible starting point:
- Personal data about customers, staff or applicants (names, contact details, health or financial information)
- Passwords, access keys and internal credentials
- Contracts and confidential documents of clients
- Anything you are not allowed to share outside the company
3. What can be used? General questions, drafts that contain no personal or confidential information, summaries of public material, brainstorming, rewriting your own text.
4. Who checks the output? A person reads and takes responsibility for anything sent to a customer or published. AI tools can be wrong, and the output is your responsibility.
5. Do we tell people? If your website, shop or chatbot uses AI-generated text, images or a chatbot, say so clearly. See what business.gov.nl says above.
6. Before connecting a tool to our files or customer data Run it through the AP's tool first. Check what the provider does with the data you enter, and whether they offer a data processing agreement.
7. Training and review Brief every new employee. Review this policy every six months, because the tools change.
8. Who do I ask? Name one person.
Frequently asked questions
Is using ChatGPT at work allowed under the GDPR?
That depends on what you put into it and how the tool is set up. The AP's tool is meant to help you decide whether and how to use generative AI. For your own case, ask a privacy lawyer.
Do I need a written AI policy?
No source we read says a one-page policy is mandatory. The AI Act's AI literacy rule, however, asks you to take measures for staff who use AI, and a short policy with a briefing is a practical way to do that.
What about AI chatbots on my website?
See our guide to AI chatbots for a small business website, which covers the Dutch authorities' warnings about chatbots and what a chatbot project costs.
Does the policy apply to freelancers?
If they use AI on your behalf, put them under the same rules in the contract.
Want help with this?
We build AI automations with clear rules about what data goes where. A 30-minute consultation costs €30. We look at how your team works and tell you honestly whether an automation, a chatbot or just a written policy is what you need.
Sources
All sources were read on 26 October 2026.
- Autoriteit Persoonsgegevens: Hulpmiddel generatieve AI en de AVG + VR Microsoft Copilot (13 July 2026, in Dutch)
- EU AI Act, Article 4: AI literacy
- Business.gov.nl: Checklist for starting a webshop
- NyxWorks: AI automation page
Rules and guidance change. Check the linked pages and, for your own situation, ask a lawyer.
Next step
Want this done for your business?
Tell us what you need. You get a fixed scope and a public price, usually within a day.
Start a project
