Does the EU AI Act Require Your Company to Have an AI Policy?

The EU AI Act is aimed mostly at companies that build AI systems — but it doesn't ignore companies that merely use them. If your business operates in the EU, sells to EU customers, or has EU employees, several obligations apply to you as a 'deployer' of AI systems, and a written AI policy is the practical way to meet them. The Act's obligations have been phasing in since February 2025, and the EU's 2026 Digital Omnibus (Regulation (EU) 2026/1744, in force since July 27, 2026) moved some dates and softened one duty, as noted below.

The deployer obligations that touch ordinary companies

• AI literacy (Article 4, applicable since February 2025): providers and deployers must take measures to support the AI literacy of their staff and anyone else using AI on their behalf, with training appropriate to their role and the tools they use. Since the 2026 Digital Omnibus the duty is to support literacy, not to guarantee any specific level for any individual.
• Prohibited practices (applicable since February 2025): certain AI uses — manipulative techniques, social scoring, emotion recognition in the workplace beyond narrow exceptions — are banned outright, with the Act's steepest penalties.
• Transparency (Article 50, applicable since August 2, 2026): people must be told when they are interacting with an AI system rather than a human. Deployers must also inform people exposed to emotion recognition or biometric categorization, disclose deepfakes, and disclose AI-generated text published to inform the public on matters of public interest unless a person has reviewed it and takes editorial responsibility. Providers of systems already on the market have until December 2, 2026 to meet the machine-readable marking duty.
• High-risk uses: if you use AI in employment decisions (screening, evaluation), that's a high-risk category carrying significant deployer duties — human oversight, monitoring, record-keeping. The Digital Omnibus postponed these duties from August 2, 2026 to December 2, 2027; building the review habit now is cheaper than retrofitting it.

So is a written policy legally mandatory?

The Act doesn't contain a sentence saying 'every company must have an AI policy.' But look at what it does require of deployers — trained staff, no prohibited uses, transparency to users, human oversight of high-risk applications — and ask how you'd demonstrate any of it without a written policy. A policy is how the obligations become operational: it names the approved tools, embeds the prohibited-use list, sets the disclosure default, and documents the human-review requirement. It's also the first artifact a regulator or enterprise customer will ask to see.

What to put in the EU-aware sections

• GDPR rules for personal data in prompts: lawful basis, processor agreements, transfer mechanisms
• A commitment to avoid the Act's prohibited practices, with examples staff can recognize
• Legal review required before any AI use in employment or other high-risk decisions
• Disclosure defaults for customer-facing AI
• Role-appropriate AI training, supporting Article 4's literacy duty

Our generator includes EU-specific clauses automatically when you select the EU as a jurisdiction — GDPR, EU AI Act prohibited practices, AI literacy, and high-risk review requirements — alongside your industry's rules.