Is what I type sent anywhere?

No. Your answers and company details stay in your browser. They are not sent to our servers, and we cannot see them. To move your work to another computer or colleague, export the answer data (JSON) and import it there.

Which laws does this edition follow?

EU law checked on October 30, 2026: the EU AI Act (Regulation (EU) 2024/1689) as amended in 2026, the GDPR, the copyright rules on text and data mining, and, where they apply, NIS2 and DORA. National laws, such as employment law and the rights of works councils, differ by country and are left for you to add.

Does the EU AI Act require a policy like this?

The AI Act does not prescribe a written AI use policy. It does require deployers to follow its rules on prohibited practices, transparency and high-risk systems, and a written policy with training is the usual way to show staff what those rules mean in daily work and to keep a record that you did so.

Is this legal advice?

No. Shishin Kobo produces a template draft. Have your legal counsel or data protection officer review the policy, and check it against your works agreements and information security policy, before you distribute it.

Can I edit the document freely?

Yes. The free version exports HTML and prints to PDF. The one-time purchase ($65) adds Word and Markdown export, so you can edit the policy in your own format.

How do I receive the license key?

Gumroad, which handles the payment, emails the key right after you pay. Open the Export tab in the builder and register the key there.

Generative AI Use Policy template, version 3.3 (EU edition)

“Can I paste this into an AI tool?”

Decide the answer before your staff ask: an AI use policy built on the EU AI Act and the GDPR

Shishin Kobo turns those decisions into a company document. Answer 34 questions, and a 26-chapter policy template is rewritten with your company's answers.

Open the builder for free Read the sample PDF (58 pages)

No sign-up. What you enter stays in your browser. The one-time purchase with Word export is $65.

Page 17 of the sample: the data classification and input permission matrix in the Data Handling Rules chapter — Page 17 of the sample. Your answers to the questions become the marks in this input permission table.

Built on EU law

The chapters on law follow the EU AI Act, the GDPR and the other EU rules a company meets when its staff use AI, checked on October 30, 2026. The policy turns them into rules for daily work: what may be entered into which tool, which uses are prohibited, when AI-generated content must be labeled, who reviews high-risk uses, and what to do in the first 72 hours after personal data leaks.

It suits companies of any size in the EU and the EEA, and companies elsewhere that serve EU customers. The chapters that do not depend on law, such as the rules for AI agents and the approval flow, are the same as in our Japan edition.

How it works

Pick a base template by industry, company size and AI stance. There are 90 combinations.
Answer the questions. Each answer rewrites the matching sentence in the draft, and the changed line is marked in red.
Review the checklist. It lists what is still the default answer, what is blank, and the checks to finish before distribution.
Export the policy as HTML or print it to PDF for free. Word and Markdown export come with the one-time purchase.

Sample pages

This is the all-industry sample before a company name is entered. It runs to 58 A4 pages. Colored fields are what your company fills in, and dotted boxes are editor's notes. When you enter your company name and export, the editor's notes and the opening how-to page disappear.

Sample	Pages	Size	PDF
All industries	58 pages	0.7 MB	Open PDF
Manufacturing	55 pages	0.7 MB	Open PDF
Finance and insurance	55 pages	0.7 MB	Open PDF
Healthcare	55 pages	0.7 MB	Open PDF
Public sector and local government	55 pages	0.7 MB	Open PDF
Retail and services	55 pages	0.7 MB	Open PDF
IT and software	55 pages	0.7 MB	Open PDF
Construction and real estate	55 pages	0.7 MB	Open PDF
Transportation and logistics	55 pages	0.7 MB	Open PDF
Education	55 pages	0.7 MB	Open PDF

Base templates by industry

When you pick an industry, rules that tend to matter in that industry go into the policy. The table shows the first rule added for each industry.

Industry	Rule added by default	Builder
All industries	No industry-specific rules; only the chapters that apply to any company	Open in the builder
Manufacturing	Design drawings, CAD data, process charts and cost information must be handled only on the internal AI platform	Open in the builder
Finance and insurance	Customer transaction histories, balances and credit information must be handled only on the internal AI platform	Open in the builder
Healthcare	Patient names, dates of birth, medical histories and test results are health data, a special category under Article 9 of the GDPR, and must be handled only on the internal AI platform	Open in the builder
Public sector and local government	Residents' personal information must be handled only on the internal AI platform	Open in the builder
Retail and services	Customer purchase histories and inquiries may be entered only after information that identifies individuals has been removed	Open in the builder
IT and software	Source code and data entrusted by clients must not be entered into external AI without the client's consent	Open in the builder
Construction and real estate	Drawings, structural calculations and ground survey data must be handled only on the internal AI platform	Open in the builder
Transportation and logistics	Delivery addresses and recipient names may be entered only after information that identifies individuals has been removed	Open in the builder
Education	Learners' names, grades and guidance records must be handled only on the internal AI platform	Open in the builder

Planned revisions

The laws and guidance in the policy were checked on October 30, 2026. We revise the template as the following dates approach.

Date	Law or guidance	What changes
November 20, 2026	Consumer Credit Directive (EU) 2023/2225	Consumers can ask for human intervention when their creditworthiness is assessed by automated processing
December 2, 2026	EU AI Act: new prohibited practices and the end of the marking grace period	AI that generates non-consensual intimate images or child sexual abuse material becomes prohibited, and generative AI placed on the market before August 2, 2026 must mark its output
December 9, 2026	Product Liability Directive (EU) 2024/2853	Software and AI systems placed on the market from this date are products, and defects can lead to liability without fault
December 2, 2027	EU AI Act: high-risk obligations (Annex III)	Deployer duties for AI used in employment, education, credit scoring and insurance pricing start to apply, including impact assessments and log retention
December 11, 2027	Cyber Resilience Act: main obligations	Security requirements for products with digital elements, including software with AI features, start to apply
August 2, 2028	EU AI Act: high-risk obligations (Annex I)	Obligations for AI that is a safety component of products such as machinery and medical devices start to apply

Pricing

Building the policy and distributing it as HTML or print is free and needs no sign-up. The one-time purchase is $65. It adds Word and Markdown export, and Word versions of the 10 industry base templates.

See pricing and how to buy

Frequently asked questions

Is what I type sent anywhere?: No. Your answers and company details stay in your browser. They are not sent to our servers, and we cannot see them. To move your work to another computer or colleague, export the answer data (JSON) and import it there.
Which laws does this edition follow?: EU law checked on October 30, 2026: the EU AI Act (Regulation (EU) 2024/1689) as amended in 2026, the GDPR, the copyright rules on text and data mining, and, where they apply, NIS2 and DORA. National laws, such as employment law and the rights of works councils, differ by country and are left for you to add.
Does the EU AI Act require a policy like this?: The AI Act does not prescribe a written AI use policy. It does require deployers to follow its rules on prohibited practices, transparency and high-risk systems, and a written policy with training is the usual way to show staff what those rules mean in daily work and to keep a record that you did so.
Is this legal advice?: No. Shishin Kobo produces a template draft. Have your legal counsel or data protection officer review the policy, and check it against your works agreements and information security policy, before you distribute it.
Can I edit the document freely?: Yes. The free version exports HTML and prints to PDF. The one-time purchase ($65) adds Word and Markdown export, so you can edit the policy in your own format.
How do I receive the license key?: Gumroad, which handles the payment, emails the key right after you pay. Open the Export tab in the builder and register the key there.