Your employees are already using AI. ChatGPT for drafting supplier emails. Claude for reviewing contracts. Copilot for summarising meeting notes. It started quietly, one person at a time, and now it's everywhere.
The question is not whether your procurement team uses AI. The question is whether they're using it safely — and whether you'd know if they weren't.
"We'll write the policy later" is the most common reason AI governance fails. Later never comes. And when something goes wrong — a supplier's confidential pricing data in a public AI tool, a contract summarised incorrectly — the absence of any guidance is the first thing everyone notices.
This guide is about writing something practical. Not a legal framework. Not a compliance exercise. Something your team will actually read and use.
The one-page version vs. the full framework
Most organisations need two things, not one.
The employee guide is 2–3 pages. Plain language. Covers what you can and can't do today. Which tools are approved. What data stays out. Who to ask when you're not sure. Most people only need this.
The management framework is the full formal document. Risk classification. Governance roles. Compliance mapping against EU AI Act, ISO 42001:2023, GDPR. Audit procedures. This is what legal and compliance want on file. You need it by end of 2026.
Start with the employee guide. Get it to people now. Build the framework in parallel — but don't let the complexity of the framework delay the guide by three months. The guide is what changes behaviour.
The 5 sections your policy must have
Whether you write one page or ten, these five things need to be in it.
1. Data classification — the traffic light
Most people don't know what data they're allowed to put into an AI tool. Give them a simple colour code.
| Classification | Examples | AI tools allowed? |
|---|---|---|
| Green | Public supplier information, published price lists, general market research, your own drafts without sensitive data | Yes — approved tools only |
| Yellow | Internal process documents, aggregated spend reports (no supplier names), general contract templates, anonymised RFQ data | Yes — with caution, approved tools only, no external sharing |
| Red | Specific supplier pricing, commercial terms under NDA, personal data (contacts, salaries), customer data, M&A related information | No — never in public AI tools |
This table takes ten minutes to build. It saves your team from guessing. Put it on page one.
2. Approved tools list
A short table. Tool name, approved use cases, data classification allowed, who approved it. Update it when something changes. The point is not to restrict everything — it's to remove ambiguity.
Common approved tools in procurement: Microsoft Copilot (if your org has it deployed), Claude for business, ChatGPT Enterprise. Common restrictions: free consumer versions of the same tools, because they use your inputs for training by default.
3. Five red flags
Tell people when to stop and ask. These five situations should always trigger a check before proceeding:
- You're about to paste a document marked Confidential or Restricted into any AI tool
- The AI output will be sent directly to a supplier or external party without human review
- You're using AI to make a supplier selection or exclusion decision without documenting why
- A supplier is asking whether AI was used in your sourcing process or evaluation
- You found a new AI tool you'd like to use that isn't on the approved list
4. Decision flowchart — "Can I put this in AI?"
Some people prefer a logic tree to a table. Give them both.
5. Who to call
Name a person. Not a department. Not a mailbox. A person. This is the most underrated part of any policy. When people have a specific question and no one to ask, they skip the check.
In most procurement teams, this is either the procurement manager, the IT business partner, or someone from legal. Whoever it is, they need to be prepared to answer in 24 hours — otherwise people stop asking.
EU AI Act — what procurement teams actually need to know
The EU AI Act (Regulation 2024/1689) starts applying in August 2026. It covers AI systems by risk level — and some of what procurement teams use sits in the high-risk category. Specifically: AI used in supplier selection, creditworthiness assessment of suppliers, or evaluation in competitive procurement processes. If you're using AI to score suppliers or shortlist vendors, the regulation applies to you.
The practical implication is not panic — it's documentation. You need to know which AI tools you're using, what decisions they influence, and whether the vendor can explain how the system works. Procurement teams should add "AI Act compliance" to their vendor due diligence checklist. If a supplier of AI tools can't tell you whether their system qualifies as high-risk under the regulation, that's a red flag in itself. The Act is also the reason to build your management framework now rather than late 2026 under pressure.
The 3 most common policy mistakes
Writing it for lawyers, not for buyers
A 30-page policy with section references and legal definitions will not change anyone's behaviour. The people who need to read it are buyers, category managers, and sourcing specialists — people who are busy, not looking for a compliance exercise. If they can't find the answer to "can I paste this contract into Claude?" in under 30 seconds, the policy has failed.
No approved tools list — just a list of banned ones
Telling people what they can't use without telling them what they can use creates a vacuum. They'll keep using whatever they were using before, just more quietly. The approved list is what drives the behaviour you actually want.
Treating it as a one-time document
AI tools change faster than policy review cycles. A policy written in January 2026 may already be outdated by June. Build in a quarterly check — not a full rewrite, just: has anything changed in the approved tools list? Has a new regulatory requirement kicked in? Is the contact person still correct? Twenty minutes, once a quarter.
Get the free template
The templates below cover both versions — the employee-facing guide and the full management framework. They're built around the five sections above and already mapped to EU AI Act, GDPR, and ISO 42001 requirements. Edit them to fit your organisation. Both versions are available in English and Czech.
Free AI Policy Template
Two versions: the 2-page employee guide and the full management framework. Pre-filled with data classification tables, approved tools structure, red flags, and EU AI Act mapping. Ready to edit in Word or Google Docs.