ChatGPT in the Enterprise: AUP Template + 8 Prohibition Clauses

Main article: AI inventory in 8 steps — the full pillar article on this topic.

Source status: The legal statements in this article are based on a source review of 2 May 2026, supplemented by the legal status as at 17 August 2026: the Digital Omnibus for the AI Act is in force as Regulation (EU) 2026/1744 since 27 July 2026. Information on product features of individual tools stems from the original version of 26 April 2026 and has not been re-verified. Statements without a source are practice recommendations made by this article and not legal statements; they are marked in the text with (practice recommendation). The original version additionally mentions "code execution" and "output verification" in its summary: both are covered by clause 3 — the execution of AI-generated code, however, as a practice recommendation, because the reviewed source set contains no source on it.

What the AUP template has to cover

An acceptable use policy for generative AI governs three things: which tools and accounts are permitted, what must not be done with them, and how both are evidenced. The following structure is a proposal (practice recommendation).

1. Scope: which people, which tools. The original version of this article names GPAI tools such as ChatGPT, Microsoft Copilot, Claude and Gemini as the set of tools.
2. Permitted accounts and access approval: who grants access, which precondition has to be met beforehand (clauses 6 and 8).
3. The eight clauses with one rule, one rationale and one example sentence each.
4. Responsibilities: one named unit per system for oversight and escalation. The AI system inventory maintains this field in any case — alongside name and provider, use case, role (provider/deployer/both), risk class and the types of data processed.
5. Reporting channel: one channel for AUP breaches and for the suspicion of a personal data breach. The second one must be able to carry the deadline of Art. 33(1) GDPR.
6. Evidence: training and quiz record before access is granted (content and retention see clause 8).
7. Entry into force, version and review: date and version status on the document, so that it can later be evidenced which version applied when.

In the 12-month action plan of the EU AI Act compliance roadmap, the acceptable use policy sits in month 3 — after the AI system inventory, Art. 5 screening and AI literacy training in months 1 to 2. This sequence has a practical reason: without an inventory you do not know which systems the policy applies to.

Framework building blocks of the template

The eight clauses are the substantive core; structure points 1, 2, 4, 5 and 7 are the framework on which applicability and evidence depend. The following building blocks are drafting proposals in the same style as the clause wordings (practice recommendation) — wording, not a legal assertion.

Scope (structure point 1): "This policy applies to all employees of the company, including fixed-term employees, as well as to external persons who work with AI systems on our behalf. It applies to the tools listed under item 2; further tools are added exclusively via the AI system inventory."

Access approval (structure point 2): "Access is granted only once the training and quiz record under clause 8 is on file and access takes place via a company-provided account under clause 6. The approving unit is the unit named in the AI system inventory for the system concerned."

Responsibility and escalation (structure point 4): "For each approved system, the AI system inventory names a unit for oversight and escalation. Questions of interpretation regarding this policy — in particular exemption approvals under clause 2 — are decided by that unit; if it is itself affected, the management decides."

Reporting channel (structure point 5): "Report breaches of this policy to [unit/mailbox]. If there is a suspicion of a personal data breach, also report immediately to [data protection officer or controller] — without carrying out your own preliminary assessment, because the deadline of Art. 33(1) GDPR runs from the moment the controller becomes aware."

Consequences of a breach: "Breaches are documented and discussed with the employee concerned; the employment-law assessment is a matter for the HR department." You should align the design of this building block with your legal advisers and — in Germany — within the framework of works council involvement (section "Introduction in the company").

Entry into force, version and review (structure point 7): "This policy enters into force in version [number] of [DD.MM.YYYY] on [date] and replaces all previous versions. It is reviewed annually and adjusted in advance in the event of material changes to the list of tools or to the legal situation."

The eight clauses and their legal anchors

The eight clauses hang on four sets of norms: Art. 4 and Art. 3(56) AI Act (AI literacy), Art. 5 and Art. 50 AI Act (prohibitions and transparency), Annex III in conjunction with Art. 6 AI Act (high risk) as well as Art. 6, 9 and 28 GDPR (data side). Six of the eight clauses are prohibitions; two — external transparency (clause 5) and training record (clause 8) — are duties to act. For the protection of trade secrets, the reviewed source set contains no separate source; the clause wordings and drafting examples further below are drafting proposals (practice recommendation).

1. Prohibition on personal data

No real names, addresses, dates of birth or health data in prompts. Pseudonymise or use generic examples.

The reason is the permission logic of the GDPR: insofar as personal data are processed through the input, the processing is lawful only if at least one of the six grounds for lawfulness in Art. 6(1) GDPR is met. A stricter level applies to health data: health data belong to the special categories, whose processing Art. 9(1) GDPR prohibits in principle — with narrow exceptions under paragraph 2, such as explicit consent. If the tool provider processes data on your behalf, the requirements on processing on behalf of a controller in Art. 28 GDPR apply in addition — set out in clause 6. And before you approve a new processing operation, check Art. 35(1) GDPR: where a high risk is likely — in particular where new technologies are used — a data protection impact assessment must be carried out beforehand; its place in the sequence is set out in the section "Introduction in the company".

Drafting proposal: "No personal data of real persons may be entered in prompts, file uploads or custom instructions. Replace names, contact details and case references with placeholders. Data under Art. 9 GDPR — in particular health data — are excluded without exception."

2. Prohibition on trade secrets

No patents, strategies, contracts or financial data in prompts.

In legal terms this clause stands differently from the other seven: the reviewed source set of this article contains no source on trade secrets legislation and none on the professional rules for lawyers, doctors or tax advisers — the original version of this article names both as interfaces, but they are not backed by sources here. Only the area of overlap is robust: contracts and personnel files regularly contain personal data, which means clause 1 applies as well.

For the clause to be workable, it needs four determinations (practice recommendation). First, the categories that count as confidential within the company: contracts and draft contracts, price and cost calculations, source code and system architecture, M&A and strategy documents, personnel files. Second, the substitute action: the facts are abstracted instead of pasting in the original. Rule of thumb for this: company, product and project names, specific amounts, quantities and contract data stay out; the prompt contains only the structure of the question — so instead of the price list of a framework agreement, the question of how a volume-tiered pricing clause with three purchase volumes can be constructed. Third, the approval route for exceptional cases — the responsible unit is the one from the building block "Responsibility and escalation". And fourth, the check question before every input: does the document contain personal data? Then clause 1 applies in addition.

For entities within the scope of NIS2, a second layer is added. If your entity falls within that scope, assign clause 6 — company-provided accounts only — (practice recommendation) to the implementation to be documented under § 30(1) BSIG 2025 (Austria: self-declaration under § 33(1) NISG 2026), because access control, cryptography and multi-factor authentication are part of the statutory minimum catalogue of risk management measures there (§ 30(2) BSIG 2025 in Germany, § 32(4) NISG 2026 in Austria). Whether your entity is covered depends on the type of entity: in Germany, a particularly important entity is any other undertaking of a type specified in Annex 1 that employs at least 250 staff or has an annual turnover of more than EUR 50 million and, in addition, an annual balance sheet total of more than EUR 43 million; an important entity is an undertaking of a type specified in Annex 1 or 2 with at least 50 staff or an annual turnover and an annual balance sheet total of more than EUR 10 million each, insofar as it is not already a particularly important entity (§ 28(1) and (2) BSIG 2025). Austria works with the same thresholds, but with different terms: large undertaking (§ 25(2) NISG 2026) and medium-sized undertaking (§ 25(3) NISG 2026). A large undertaking of an Annex 1 type is accordingly deemed an essential entity; entities of an Annex 1 or Annex 2 type that operate a large or medium-sized undertaking are deemed important entities, provided they are not already an essential entity (§ 24(1) and (2) NISG 2026).

Drafting proposal: "Confidential company content — contracts, calculations, source code, strategy and personnel documents — is not entered in prompts, file uploads or custom instructions. If the facts are needed for processing, they are abstracted; approval of an exceptional case is granted exclusively by the responsible unit named in the inventory."

3. Prohibition on unchecked adoption

ALWAYS check AI output. For facts and quotations: additional verification.

The anchor is Art. 4 AI Act in the version applicable since 27 July 2026 (Regulation (EU) 2026/1744): providers and deployers take measures to support the development of AI literacy among their staff and other persons dealing with the operation on their behalf; a particular level of AI literacy is not owed in doing so. The term is legally defined in Art. 3(56) AI Act as the skills, knowledge and understanding that allow AI systems to be deployed in an informed way and awareness to be gained of the opportunities, risks and possible harm — which makes output quality control both a training topic and a work instruction.

For texts on matters of public interest, the check additionally has a transparency effect: anyone relying on the exception in Art. 50(4) AI Act — role allocation in clause 5, conditions in the FAQ "Do we have to label every AI-generated text?" — needs a named responsible person, not just a quick glance at the text.

The rule becomes workable through a three-tier depth of review (practice recommendation). Tier 1, purely internal draft: plausibility check by the person working on it. Tier 2, content intended for external recipients: four-eyes review, with the reviewing person noted in the document. Tier 3, decision-relevant figures, quotations, sources and legal statements: comparison against the primary source, with the source checked recorded in the document. Record the designation of the editorially responsible person under Art. 50(4) where the content sits — in the document properties, in a CMS field or in the approval note; without that place, the exception cannot be evidenced in a dispute.

AI-generated code (practice recommendation): The reviewed source set contains no source on the execution of AI-generated code; in practice, treat it like any other unchecked output. Before it is adopted, a second person reviews it; in production and customer environments it is not executed without approval from the unit named in the AI system inventory; adopted dependencies and their licences are reviewed before use. The depth of review corresponds to tier 2, and to tier 3 for code that is shipped or decision-relevant.

Drafting proposal: "AI output is a draft, not a result. Before any internal or external use, check content, figures and source references independently. Quotations and sources are verified against the primary source; the source checked is recorded in the document."

4. Prohibition on AI for high-risk decisions

No automated HR/credit/insurance decisions without human review.

These three fields fall within two of the eight high-risk areas of Annex III: no. 4 covers employment and workforce management, no. 5 essential private and public services, including creditworthiness assessment ((b)) and life/health insurance scoring ((c)). The exception in Art. 6(3) AI Act is to be interpreted narrowly: it applies only if the system performs exclusively a narrow procedural task (such as sorting), performs a limited task within the use case, or performs a specific activity that supports human action without replacing it. If the system produces recommendations or assessments capable of materially influencing human decisions, it remains high risk; if it performs profiling of natural persons, the exception is excluded in any event. The borderline cases from the HR area are set out in the FAQ "May we use ChatGPT in recruitment?".

For Annex III systems, the obligations of Chapter III Sections 1–3 apply from 2 December 2027 (Art. 113(3)(c)(i) AI Act as amended by Regulation (EU) 2026/1744, in force since 27 July 2026; details in the section "When each obligation applies"). Independently of the AI Act, discrimination liability applies in recruitment: burden of proof in Germany, prima facie evidence in Austria — sources in the section "Germany and Austria".

Drafting proposal: "Decisions on hiring, promotion, dismissal, granting credit or insurance cover are not based on an AI proposal unless a named person has independently reviewed the facts and documented the decision."

5. Duty of external transparency

Clearly label AI-generated content for customers (Art. 50).

Art. 50 AI Act allocates four obligations across two roles. The provider is subject to paragraph 1 — an AI system intended to interact directly with natural persons must inform them that they are interacting with an AI system — and to paragraph 2, the machine-readable marking of synthetic audio, image, video and text content as artificially generated or manipulated. The deployer is subject to paragraph 3 (informing the persons concerned in the case of emotion recognition and biometric categorisation) and paragraph 4 (disclosure for deepfakes: that the content has been artificially generated or manipulated). For your AUP this means: anyone generating AI images in marketing or operating a chatbot must know in which role they are doing so — provider under Art. 3(3) or deployer under Art. 3(4).

The obligation has applied since 2 August 2026 (Art. 113 AI Act). The fine ceiling is up to EUR 15 million or 3 % (Art. 99(4) AI Act) — the full tiering is set out in the FAQ "What does a breach cost?". According to the reviewed source status (04/2026), the open standard C2PA Content Credentials was the dominant carrier format for machine-readable marking; the practical consequence is a question to the tool provider: are content credentials set at all, and do they survive export? Resolve the role question with a check question: if you generate the content with a purchased tool, you are acting as a deployer — in which case the deployer obligations under paragraphs 3 and 4 come into consideration, insofar as their conditions are met; if you make your own system available or place it on the market under your own name, the provider obligations under paragraphs 1 and 2 apply.

Drafting proposal: "Content intended for customers that has been generated or materially altered with AI is labelled. Chatbots point out their AI character at the beginning of the dialogue; AI-generated image, audio and video content carries the marking in the record. Before publication, it is recorded whether the company is acting as a provider or as a deployer in the individual case."

6. Company-provided accounts only

Personal ChatGPT accounts prohibited — only an enterprise tenant with a data boundary, i.e. a tenant provided by the company. (Product information as at the original version of 26 April 2026; not re-verified.)

The robust reason is a contractual one: under Art. 28(1) and (3) GDPR you may work only with processors that provide sufficient guarantees, and the cooperation must be governed by a contract with a statutory minimum content — subject matter, duration, nature and purpose of the processing, types of data, categories of data subjects. This can be evidenced only for the accounts covered by that contract. The same logic carries data subject rights: Art. 12(3) GDPR requires a response without undue delay and in any event within one month — which presupposes that you know in which system the data sit.

If you use a high-risk system as a deployer, a retention obligation is added: logs must be kept for at least six months under Art. 26(6) AI Act. Therefore record for each system where these logs sit and how they are secured when the tenant or the provider changes (practice recommendation) — otherwise, when the contract ends, access to the evidence ends too.

Drafting proposal: "Work content is processed exclusively via the accounts provided by the company. The use of private accounts for work purposes is prohibited, including for tests and individual cases."

7. Prohibition on manipulative use

No deepfakes, no manipulated sources, no phishing templates.

Here the AUP borders on the strictest level of the AI Act. Art. 5(1) AI Act prohibits, among other things, AI systems using subliminal techniques or purposefully manipulative or deceptive techniques to materially distort behaviour with significant harm ((a)) and the exploitation of vulnerabilities due to age, disability or a social or economic situation ((b)). Particularly relevant for employers: emotion recognition in the workplace and in education institutions is prohibited under (f), and biometric categorisation to infer sensitive attributes under (g). These prohibitions have applied since 2 February 2025; the ceiling is up to EUR 35 million or 7 % (Art. 99(3) AI Act) — the full tiering is set out in the FAQ "What does a breach cost?".

Below the prohibition threshold, the disclosure obligation for deepfakes under Art. 50(4) AI Act remains (role allocation in clause 5); in artistic, satirical or fictional use it may be discreet, but it cannot be omitted.

Drafting proposal: "No content is generated that is intended to deceive persons or manipulate their behaviour — in particular no deepfakes without disclosure, no falsified sources, no phishing or social engineering templates. Emotion recognition in the workplace is prohibited."

8. Duty of training + quiz

Before use: modules 4-6 of the AI literacy curriculum + 70% quiz.

The obligation follows from Art. 4 AI Act, has applied to providers and deployers since 2 February 2025 and has had a new wording since 27 July 2026 (Regulation (EU) 2026/1744): what is owed are measures that support the development of AI literacy, not an owed level of competence. The three modules named cover exactly the AUP material: module 4 "AI in everyday work" (AUP, data protection, confidentiality, verification), module 5 "High-risk AI" (Annex III, FRIA, conformity assessment) and module 6 "Transparency Art. 50" (chatbot notices, deepfake marking, watermarking). The knowledge quiz of the curriculum comprises 25 questions with a pass mark of at least 70 %; a re-test takes place in the event of failure and after twelve months — requirements of the curriculum, not statutory values.

The record is part of the obligation and contains the employee's name and position, training date, module completions with time stamps, quiz result, certificate ID and refresher date. The retention period — for as long as the person is with the company, plus three years after departure — is a practice requirement of the curriculum, not a statutory deadline. One note on sanctions, because it is often misquoted: Art. 4 is not listed separately in the catalogue of fines in Art. 99(4) — the penalisation of breaches of the AI literacy obligation is governed by Member State law (Art. 99(1) AI Act).

Drafting proposal: "Access to the approved AI tools is granted only after completion of modules 4 to 6 and a passed quiz (at least 70 %). The record is placed in the personnel file; the refresher takes place after twelve months."

Introduction in the company: involvement and evidence

When an AUP is introduced in Germany, the co-determination of the works council under § 87 BetrVG (German Works Constitution Act) must be observed — this statement stems from the original version of this article and is not backed by a source in the reviewed source set; an Austrian equivalent is not dealt with here. Plan the involvement early for that reason and align it with your organisation's legal advisers.

The introduction sequence (practice recommendation): AI system inventory in place — review under Art. 35(1) GDPR by the unit named in the inventory or by the data protection officer — draft AUP with version status — submission to the body — training modules 4 to 6 and quiz — access granted — review after twelve months. Its place in the overall plan is set out in the first section (month 3).

For the procedure of involving the body (practice recommendation): the body receives five documents — the draft AUP with version status, the list of approved tools and accounts, a description of what the audit log evaluation captures and what it does not, the training and quiz concept, and the reporting channel. Submission takes place before the first access is granted, not after the rollout, and is made by the unit that holds oversight of the systems concerned in the AI system inventory. The evidence for the file consists of three documents: the signed AUP with version date, the training and quiz record per person, and the minutes of the body's deliberation.

Link the AUP version to the training record (practice recommendation) so that it can later be evidenced which version a person signed, and provide for a refresher at onboarding as well as an annual review.

When each obligation applies

The obligations of the AI Act take effect in stages under Art. 113 — legal status 17 August 2026: AI literacy and prohibitions since 2 February 2025, GPAI provider obligations since 2 August 2025, transparency since 2 August 2026; for Annex III high-risk systems, Chapter III Sections 1–3 — including the fundamental rights impact assessment under Art. 27 — apply from 2 December 2027, and for regulated products under Annex I from 2 August 2028 (Art. 113(3)(c) AI Act as amended by Regulation (EU) 2026/1744, in force since 27 July 2026). The column "Start of application" names exclusively statutory starts of application; the postponements brought about by Regulation (EU) 2026/1744 are applicable law and are reflected there. The three rows without a clause reference (GPAI provider obligations, FRIA, regulated products under Annex I) are carried along for context.

Germany and Austria

For the AI Act you do not have to write the AUP twice: the Regulation applies directly and with identical wording in Germany and Austria — Art. 4, Art. 5, Art. 50, Annex III and the deadlines of Art. 113 are identical. Only the authority structure (Art. 70(1) and (2) AI Act: at least one notifying authority and one market surveillance authority, one of them as a single point of contact) and the sanctions regime within the framework of Art. 99(1) are governed nationally. In Germany, the Federal Network Agency (Bundesnetzagentur) has been the market surveillance authority since 29 July 2026 (§ 2(1) KI-MIG, German AI Market Surveillance and Innovation Promotion Act), insofar as sectoral authorities are not competent; as at the status of this article (17 August 2026), Austria has not designated an authority under Art. 70 AI Act — the RTR AI service point is an information and advisory body without supervisory powers.

Flanking law has to be thought of separately. In the recruitment case (clause 4), discrimination liability runs in Germany via the German General Equal Treatment Act (AGG) and in Austria via the Austrian Equal Treatment Act (GlBG); prima facie evidence under § 12(12) or § 26(12) GlBG takes the place of § 22 AGG, and the compensation claim including minimum amounts under § 12 GlBG or § 26 GlBG takes the place of § 15 AGG. Data protection supervision differs too: in Germany, the authorities competent under Land law supervise non-public bodies (§ 40(1) BDSG, German Federal Data Protection Act) and the Federal Commissioner for Data Protection (BfDI) supervises federal public bodies (§ 9(1) BDSG), while in Austria it is the Austrian Data Protection Authority (Datenschutzbehörde) (§ 18(1) DSG, Austrian Data Protection Act).