Artificial intelligence is no longer a technology reserved for IT companies. Employees are already using AI tools to draft emails, translate documents, analyze information, conduct marketing, recruit, generate images, program, or automate repetitive tasks.
The legal issue is not that a company uses artificial intelligence. The problem arises when no one in the company knows exactly which tools are being used, what data is being fed into them, what decisions are being made based on the generated results, and who is accountable if something goes wrong.
This is where the need for an internal policy on the use of artificial intelligence—an AI Policy arises.
An AI Policy compliant with Regulation (EU) 2024/1689 on artificial intelligence—EU AI Act—serves to establish clear rules for management, employees, and collaborators regarding the use, procurement, approval, and, where applicable, development of AI systems within the organization.
The Regulation imposes specific obligations regarding the use of certain systems, AI literacy, transparency, high-risk systems, and prohibited practices. In practice, an internal policy is one of the most effective tools through which a company can translate these obligations into rules that employees can effectively follow.
The AI Act operates on a fundamental principle: the greater the risk that AI poses to individuals, the stricter the legal obligations. The regulation establishes prohibited AI practices, regulates high-risk systems, and imposes special transparency obligations for certain systems. For low- or minimal-risk uses, the compliance burden is much lighter.
Therefore, a serious AI Policy should not simply state, “Employees may use AI.” It should address the much more important question:
What should an AI Policy include?
For a medium-sized or large company, the policy should cover at least ten essential areas:
1. Purpose and Scope
The first step is to identify the individuals and tools to which the policy applies, covering not only systems officially purchased by the company but also AI tools that employees access individually for professional purposes: generative applications, chatbots, browser extensions, SaaS platforms, analytics tools, recruitment systems, or other applications that integrate AI features.
One of the most common problems is so-called “shadow AI”: management believes the company uses two approved tools, while employees individually use ten other applications, into which they also enter work-related information.
The policy must therefore establish a clear rule: which tools can be used without approval and which tools must be evaluated before use.
2. General Principles: AI Must Assist Humans, Not Eliminate Responsibility
The use of AI does not automatically transfer responsibility from the employee or the company to the technology provider. If an AI system generates an incorrect contract, false information, or an erroneous analysis, the argument “that’s what the AI said” is not sufficient.
Thus, an AI Policy should enforce at least three principles.
The first is human verification. For results that may have significant legal, financial, or professional consequences, there must be a person who verifies and validates the information.
The second is user responsibility. AI output must be treated as a working tool, not as guaranteed truth.
The third is proportionality. The more a system influences a person or an important decision, the more rigorous the legal and human oversight must be.
3. Classifying AI Uses by Risk
An AI Policy should adopt the logic of the AI Act and internally classify uses by risk.
A. Prohibited AI Practices
There are situations where a company’s response should not be “we need approval,” but simply “we cannot use the system for this purpose”. Article 5 of the AI Act prohibits, under the conditions set forth in the regulation, certain practices such as some forms of manipulation, the exploitation of individuals’ vulnerabilities, certain social scoring systems, or the use of emotion recognition in the workplace, with strictly defined exceptions for medical or safety purposes.
These prohibitions are already in effect. However, internal policy must translate them into a rule that is easy for employees to understand: if the use falls into a category prohibited by the AI Act, it cannot be approved internally.
B. High-Risk AI Systems
Here, there must be the most rigorous vetting process prior to acquisition and implementation.
Under the AI Act, this category may include AI systems used in sensitive areas, including certain systems related to recruitment, personnel selection, employment relationship management, task assignment, or the monitoring and evaluation of employee performance.
This is why the company must adopt a responsible approach before purchasing an AI system.
Suppose a company purchases an HR application that promises to automatically evaluate resumes; identify “the best candidate”; generate employee performance scores; predict the likelihood of an employee leaving; or provide recommendations regarding promotions or task assignments.
From a business perspective, the tool may seem extremely attractive. But before signing the contract, it is essential to verify legally what the system actually does. Does it engage in profiling? Does it evaluate individuals? Does it make or influence decisions regarding employees? Based on what data? Is there any actual human intervention?
Otherwise, the company risks purchasing a system only to discover later that certain features it paid for cannot be used as intended without additional obligations—or cannot be used at all for that purpose.
That is precisely why the legal audit should be conducted before the purchase, not after implementation. The full regime applicable to high-risk systems listed in Annex III of the AI Act is, according to the current legislative timeline, postponed until December 2, 2027. However, this postponement does not eliminate the obligations already arising from the GDPR, labor law, or other applicable regulations, nor does it justify the purchase of systems without a prior analysis.
C. Systems Subject to Transparency Obligations
Another relevant category is that of systems for which the AI Act establishes specific transparency obligations. Article 50, applicable as of August 2, 2026, sets forth—depending on the type of system and the status of the provider or user—rules regarding the provision of information to individuals who interact directly with an AI system, the labeling of certain AI-generated content, emotion recognition or biometric categorization systems, and deepfake content.
This does not mean that every email drafted using an AI tool must automatically be labeled “AI-generated.” Internal policy must establish in which situations there is actually a legal obligation for transparency and in which situations the company wishes, as a matter of its own policy, to apply a higher standard of transparency.
D. Low- or Minimal-Risk Uses
Spam filters, smart search functions, certain text correctors, or other tools with limited impact may be subject to a simpler internal framework. The purpose of an AI Policy is not to create bureaucracy for every automated function. Controls must be proportionate to the risk.
4. What can and cannot an employee input into an AI tool?
This is probably the rule that employees need to understand best. An employee can open an AI tool and, in a matter of seconds, upload: a contract, a resume, a customer database, a financial report, a confidential email, or an internal document.
From the company’s perspective, the question isn’t just “Does AI help us work faster?,” but: “What happens to the information once we enter it?”
The policy must clearly state that unauthorized AI tools cannot be used to input information such as: personal data of employees or customers, social security numbers, financial or banking data, trade secrets, contracts and confidential correspondence, business strategies, or any other information for which the company has confidentiality obligations.
Not every use of personal data in an AI system is automatically prohibited. However, it must be analyzed in light of the GDPR, and there must be legal justification, transparency, security, and, where applicable, an assessment of the provider and the risk. The AI Policy and the GDPR policy must, therefore, work together, not as two independent documents.
5. Profiling and Automated Decisions: An Area Where Risk Is Rapidly Increasing
Special attention must be paid to systems that do not merely generate text but analyze a person.
For example, a system may analyze behavior, productivity, work history, or other characteristics and assign a score. When that score begins to influence hiring, promotions, bonuses, task assignments, or other important decisions, additional legal risks arise. Article 22 of the GDPR already regulates decisions based solely on automated processing, including profiling, when such decisions produce legal effects on the individual or similarly affect them to a significant extent. Therefore, an AI Policy should expressly stipulate that no AI system that performs profiling or evaluation of individuals may be procured or used without a prior legal assessment.
6. Vendor Verification: “GDPR-compliant” Is Not Enough
Large technology companies have their own contractual terms, security standards, and compliance procedures. However, using a product provided by a global company does not automatically transfer the client’s entire liability to the vendor. On the contrary, technology contracts typically delineate responsibilities very carefully.
The provider is responsible for certain components of the service and for its own obligations, while the client company may bear responsibilities regarding how it uses the product, the data entered, access rights, the configuration of security measures, the legal basis for processing, etc.
For this reason, before contracting for an AI system, one should at least review the terms regarding data protection, security, subcontractors, data transfers, the use of data for model development, intellectual property, incidents, and contractual liability.
7. AI Literacy: Training Is No Longer Just a Recommendation
One of the most important elements of the AI Act is artificial intelligence literacy—AI literacy.
Article 4 takes effect on February 2, 2025 and requires providers and professional users of AI systems to take measures to develop the AI literacy of their staff and other individuals who operate or use the systems on their behalf. The level and form of these measures must be tailored to the individuals’ knowledge, their experience, the context in which AI is used, and the individuals on whom the systems are used.
This means that simply emailing a 20-page policy does not solve the problem. Employees need to understand in practical terms: what they can input into an AI, what they cannot input, why AI can make mistakes, when the result must be verified, when approval must be sought, and when the use of the system may affect a person’s rights.
8. Copyright and AI-Generated Content
The fact that a tool has generated an image or text does not automatically mean that the company can assume it holds all rights to the material or that the result does not infringe on the rights of third parties. Copyright protection may depend, among other things, on the level of human creative contribution, and the provider’s terms must be reviewed separately.
9. What risks does a company face if it ignores the AI Act?
The severity of the penalties makes it very clear that the AI Act should not be treated as a mere recommendation for best practices.
For violations of the prohibitions set forth in Article 5, the administrative fine may reach up to 35 million EUR or, in the case of a company, up to 7% of its total annual global turnover from the previous fiscal year, with the criterion set forth in the regulation applying.
For violations of certain other obligations regarding AI operators, penalties may reach up to 15 million EUR or 3% of global annual turnover. The AI Act also provides for penalties for providing incorrect, incomplete, or misleading information to the authorities. The regulation requires that penalties be effective, proportionate, and dissuasive, taking into account the situation of SMEs.
Furthermore, if the use of AI also constitutes a violation of the GDPR, the company may simultaneously be subject to the data protection penalty regime.
However, the risk is not limited to a fine. Uncontrolled use of AI can also result in: loss of confidentiality, disclosure of trade secrets, disputes with employees, intellectual property issues, contracts with unsuitable suppliers, the inability to use a feature that has already been purchased, or reputational damage.
10. Specifics for Companies in Romania
For companies in Romania, the AI Policy must align with at least three legal areas.
The first is the AI Act, including the obligation regarding AI literacy, prohibited practices, and, where applicable, transparency and the regulatory framework for high-risk systems.
The second is the GDPR and Romanian data protection legislation. When AI processes data belonging to employees, customers, or other individuals, the use of this technology does not eliminate existing obligations regarding the legal basis for processing, providing information, data minimization, security, or conducting a DPIA when the legal conditions are met.
The third is labor law. The use of systems that monitor, profile, or evaluate employees may require informing them and, in certain situations, consulting with them or their representatives, depending on the system and the applicable legal framework.
In other words, the AI Policy should not be drafted in isolation, but must be integrated with the company’s existing internal regulations, GDPR policy, security policy, and HR procedures.
Before the next purchase, the right question is not just:
“What can this AI do for our company?” but “Can we legally use it the way we intend to?”
A legal assessment of existing AI tools, followed by a registry of the systems in use, an approval procedure, and an AI Policy tailored to the company’s operations can prevent a situation where the organization discovers legal risks only after an acquisition, following an incident, or after intervention by a regulatory authority.
We are available to provide further information. Contact us by phone at 0720291919 or by email at [email protected].