Skip to content
DEEN

5,0/5 Google · 167 reviewsWe do not check reviews of us on other platforms that we do not quote verbatim for authenticity. They may therefore also come from people who are not our clients. The rules of the respective platform apply. Reviews that we quote verbatim on our website, by contrast, have been checked for authenticity within the meaning of Section 5b(3) UWG (German Act against Unfair Competition): we compared the reviewers’ names with our client register. We also asked the respective platform to check the reviews for authenticity.Period: October 2016 to date · As of: 12 November 2026

Internal AI and IT policies

Without clear rules, each team decides for itself which data may go into which tool.

We draft or review internal policies on AI use, on IT and device use, and on social media. Your company receives binding rules for employees, aligned with data protection, trade secrets and the tools actually in use. The first contact is free of charge.

Upload a draftAn existing policy or internal rule, straight into the form.

Enquire without documents

Before any costs arise, we will tell you expressly.

Response on working days within 24 hours

As of: 12 November 2026

Schematic illustration of typical gaps in internal policies. Sections and markings are simplified and do not replace a review.

We prepare policies for

  • Mid-sized companies and start-ups
  • Law firms and consultancies
  • Agencies and platforms
  • Teams using AI tools
  • Companies with a public presence
Key points in brief
    For whom
    Companies that want binding rules for employees on AI, IT or social media.
    Result
    A policy draft or review report with clear rules, limits and guidance on the roll-out.
    First contact
    free of charge, to clarify the topic, responsibility and next step
    Distinctions
    Not a substitute for the AI compliance package, and no representation of individual employees.

    Reason for instruction

    What to do when teams already use AI and channels, but rules are missing?

    The need arises when tools are already in use, an incident is looming, or management and data protection require a binding line.

    A short permission to use AI “responsibly” does not steer day-to-day work.

    Employees upload documents to public models, adopt output without review, or mix private accounts with the company’s public presence. At the same time it is often unclear which internal systems are mandatory and which services remain prohibited. Without a written rule, the company lacks a demonstrable organisational framework.

    Typical occasion
    New AI tools, a growing proliferation of tools, or a specific incident.
    Risk
    Personal and client data in third-party services, loss of secrets, unclear external communication.
    First question
    Which rules already apply, and where do teams currently decide for themselves?
    Next step
    Review what is in place, draft the rules, prepare the roll-out.
    Often an IT policy already exists that does not cover social media and AI. Equally often there is a short AI approval without a ban on clearly identified data flows. We close these gaps instead of leaving three incompatible texts side by side.

    Robust rules rather than general appeals

    The aim is policies that your company can enforce internally and explain to supervisors, customers or investors. Where a comprehensive AI programme or training is needed, we refer you to the packages KI-Compliance and Data protection training.

    Review and implementation

    How are the policies produced in three steps?

    We start from what is already in place and the tools actually used, not from a generic template.

    1. Initial assessment

      You describe the tool landscape, existing rules and the occasion. We say which scope fits: an AI policy, an IT acceptable-use policy, a social media policy, or a coordinated package.

    2. Offer

      Before work begins, we tell you the scope and costs transparently. Only then do you decide whether to instruct us.

    3. Texts and roll-out

      We draft or review the policy, mark points that still need to be aligned, and give guidance on the internal roll-out. We agree the timetable with you before we begin.

    On the timetable. We agree the timetable with you before we begin. If you have a fixed date, for example a roll-out or a training session, tell us when you enquire.

    Service package

    What do we deliver in this package?

    Service package: internal AI and IT policies

    1. KI-Richtlinie

      Permitted and prohibited services, handling of personal, client and business data, review of AI output, labelling and documentation, to the extent needed for your use.

    2. IT and acceptable-use policy

      Rules on the use of devices, access, internal systems and private endpoints, and on protecting confidential information.

    3. Social media policy

      Who may speak for the company, how private accounts stay separate from the company’s public presence, and which content is subject to confidentiality.

    4. Alignment and roll-out

      Alignment with existing contracts, data-protection rules and, where you tell us, employee co-determination, plus guidance on announcing the policy in the company.

    Area of law
    IT law, AI law, data protection law
    For whom
    Companies that need binding rules for employees’ use of AI, IT and social media.
    First response
    on working days within 24 hours
    First contact
    free of charge, to clarify the topic, responsibility and next step
    Costs
    We tell you the costs transparently before you instruct us. Only then do you decide.
    Result
    A policy draft or a reviewed text with guidance on the roll-out
    Not included in the package
    A full AI compliance programme, the ongoing function as AI officer, delivering training, and representation in disputes with individual employees. Those are separate services, on request and as needed.
    Who provides what and who decides
    Management
    • Sets the intended scope and decides on approval of the policy.
    Business units and IT
    • Supply the tools actually used and the existing rules.

    ITMR

    • Drafts or reviews the texts and identifies legal gaps and points that need to be aligned.
    Data protection and HR
    • Review the fit with existing processes; a works council is involved to the extent the company provides for or requires it.
    How does the engagement work?
    1. First contact at no cost

      It is for classification, not yet for drafting the text.

    2. Transparent offer

      Before we begin, we tell you the scope and costs. You then decide whether to instruct us.

    3. No automatic follow-on advice

      Training, an AI compliance programme or individual employment-law cases are separate services and are only taken on after a separate agreement.

    Areas to regulate

    Which fields should the policy clearly regulate?

    Not every company needs the same scope. We tailor the fields to your tools and risks.

    Permitted tools

    Which AI and IT services are approved and how new tools are requested.

    Data and secrets

    Which information may not be entered into public or third-party services.

    Review and responsibility

    Who reviews AI output and publications before they are used internally or externally.

    Public presence

    Who speaks for the company on social networks and how private profiles are kept distinct.

    Typical case scenarios

    When is this package particularly worthwhile?

    The occasions differ. What they have in common is that general appeals no longer carry day-to-day work.

    Situation What typically needs to be clarified
    AI tools in the team Employees already use language models or coding assistants, without clarity on which data are not permitted.
    A growing tool landscape IT, marketing and the business units use different services. A common rule of use is missing.
    A public or platform-facing presence Teams talk on social networks about the company, mandates or products, without a clear line between official and private use.
    Existing rules out of date There is an older IT policy. AI, cloud and social media do not appear in it, or only as empty wording.

    Distinctions

    When a different service is a better fit

    Policies are the organisational framework. They do not replace every neighbouring review.

    1. KI-Compliance-Programm

      If systems, roles and evidence under the AI Act need to be built as a whole, the package KI-Compliance is the right framework. The policy can be one building block of it.

    2. Training

      We do not replace announcement of the rules with a finished training course. That is what the package Data protection training bereit.

    3. Non-disclosure agreement

      Individual confidentiality towards partners belongs in an NDA, not in the internal policy alone.

    4. Employer issues in an individual case

      Dismissal, a formal warning or a dispute with individual employees fall outside this package; depending on the situation, Employment law for employers may come into consideration.

    Preparation

    Which documents speed up the work?

    A few documents are enough to start. An honest list of tools is already worth more than a generic template.

    Existing rules
    • IT, compliance, social media or AI policies, acceptable-use rules, confidentiality rules and relevant employment-contract templates.
    Practice
    • A short overview of the AI and IT services in use, typical types of data, and whether a works council exists.

    Legal basis

    What is the legal basis for internal AI and IT policies?

    Policies are the employer’s internal steering instrument. They support organisational duties arising from data protection, protection of secrets and – where the company uses AI – the duty to ensure a sufficient level of AI literacy for the people who work with it. A policy alone does not satisfy every regime, but it makes traceable which use is permitted and which data must not reach third-party services. Where an employee representative body exists, involvement may need to be examined if rules on the use of technical facilities are concerned. We clarify this against what is actually in place, without treating the policy as a substitute for full co-determination advice.
    Sources
    • DSGVO Organisational measures, instructions to employees and protection of personal data when tools are used.
    • KI-Verordnung Among other things, the requirement to ensure a sufficient level of AI literacy; the policy can support this organisationally.
    • Trade Secrets Act Protecting secret information against unauthorised entry into third-party services and against unregulated publication.

    Your contacts

    Who will handle your policies?

    Law and practice from one source: IT law, AI law and data protection in the team. Offices in Düsseldorf and Hamburg, advice nationwide.

    Contact person

    Dr. Alexander Pleh

    Rechtsanwalt (lawyer) · Partner · Fachanwalt für IT-Recht (certified specialist lawyer for IT law) · IT law and AI law · AI Officer [DEKRA]

    Pleh profile

    Contact personJean Paul P. Bohne, LL.M., MM

    Rechtsanwalt (lawyer) · Partner · Fachanwalt für IT-Recht (certified specialist lawyer for IT law) · Fachanwalt für Urheber- und Medienrecht (certified specialist lawyer for copyright and media law) · AI Officer [DEKRA]

    Bohne profile

    TOP lawyer 2027 · Business lawyers · Intellectual property

    F.A.Z.-Institut and QuantiQuest. Based on recommendations from fellow lawyers and assessments by in-house counsel. Source (opens in a new tab)

    Reviews

    What clients say

    5,0 von 5 · 167 Google reviewsPeriod: October 2016 to date · As of: 12 November 2026

    5,0 out of 5 · 71 reviews on anwalt.dePeriod: October 2018 to date · As of: 12 November 2026

    “… Mr Bohne really responded to all our ideas and expectations and guided us through this media/copyright jungle. He drafted an adaptable freelancer contract, a non-disclosure agreement and a data protection document for us. We are very satisfied with the result and the cooperation. …” (translated from German)
    P. M. · anwalt.de (opens in a new tab) · 21 May 2020 · “Contract drafting”
    “I can only say positive things about Mr Bohne. He helped me with a matter and was always friendly, reachable, clear, competent, and provided very good, committed advice. A clear recommendation!”
    Johann Thiéry · Google
    “I had an initial consultation with Mr Bohne and can highly recommend him. He responded to my needs and wishes and advised me very well. Many thanks for that.” (translated from German)
    Taner Kötemen · Google

    FAQ

    Frequently asked questions on internal AI and IT policies

    Does every company need its own AI policy?

    Not every company needs the same scope. As soon as employees can use AI services with internal, personal or confidential information, however, a clear written rule is regularly advisable. It can often be bundled with IT and social media rules in one coordinated text.

    Is the existing IT policy enough?

    Only if it actually covers AI services, data flows into third-party models, the review of output and the handling of social networks. Many older IT policies do not. We review what is in place and add only what is missing, rather than creating parallel texts.

    Does the policy replace an AI compliance programme?

    No. It steers employees’ conduct. Duties under the AI Act on system roles, high risk, transparency and governance belong in the package KI-Compliance. Beide Leistungen können aufeinander Bezug nehmen, ersetzen einander aber nicht.

    What about the works council?

    Where an employee representative body exists, involvement may come into question if rules on the use of technical facilities are concerned. We take this into account to the extent you tell us what is in place, and we flag points that need to be aligned. A full co-determination negotiation is not automatically part of this package.

    Does the social media policy also apply to private accounts?

    It can address private profiles where employees create a recognisable link to the company there, or where confidential information is concerned. The policy does not replace an individual investigation of a specific case. The aim is a clear separation of the company’s public presence and private use.

    How are the policy and training connected?

    The policy sets the text. For it to take effect, the teams must know it. Delivering training is a separate package: Data protection training. Im Richtlinienpaket geben wir Hinweise zur Bekanntgabe, führen die Schulung aber nicht selbst als enthaltene Leistung durch.

    What is not included in the package?

    A full AI compliance programme, the ongoing role as AI officer, delivering the training, and representation in disputes with individual employees. We offer such steps only after a separate agreement. We tell you the costs transparently before you instruct us.

    Is the first contact free of charge?

    It is for classifying the topic, responsibility and the next step. Before any costs arise, we will tell you expressly. Before work begins, you receive a transparent offer.

    Next step

    Align internal rules before each team decides for itself

    Whether an AI policy, IT use or social media: describe the occasion and the tools already in use. We get back to you within 24 hours on working days.

    Classify the need for policies now

    Align internal rules

    Your contact details

    Your message

    e.g. deadline from an Abmahnung (formal warning letter)

    Attach files

    Upload relevant documents (optional)

    FilesOptional

    Helpful are existing policies, IT or social media rules, a short description of the AI and IT tools in use, and whether a works council exists.

    Related services