Blogs | AI Powersessions
Subscribe for AI Powersessions
About us | Join us Book a Demo
EN
NL
› Workshop · AI Governance · the Kodify method

AI POLICY Design the foundation
of your AI policy in two days.

AI is already in use across your organisation, often without policy, without oversight and without security. Kodify helps you put a workable AI policy in place fast, one that enables innovation within safe boundaries.

  • A workable AI policy in 2 days, not a 60-page shelf document
  • Our 7 pillars covering people, security, compliance and adoption
  • EU AI Act ready · demonstrable AI literacy (art. 4)
AI Policy leaflet · sample PDF · 16 pages · 7 pillars + sample policy
2 days · on-site or hybrid

Get the workshop leaflet

The full set-up, the 7 pillars and what you walk away with after two days.

Request the leaflet
Free Reply within 1 business day · 100+ workshops delivered
› The reality on the work floor

Things go wrong more often than you think.

Copilot, ChatGPT, Claude. Remarkable innovations, but a great deal still goes wrong. Tools hallucinate, they are not always critical, and the output is only as good as the prompt or the data behind it.

Employee skill levels vary and are on average too low to use these tools wisely. We start from the reality that AI chat is already being used inside organisations. That creates immediate risk.

! Two examples from practice
01
Data breach · Dutch Data Protection Authority

Dozens of reported data breaches caused by improper AI use

Over the past two years, dozens of workplace data breaches have been reported involving AI chatbots such as ChatGPT, Claude and Gemini.

Source: Dutch DPA Period: 2024–2025
02
Case · personnel file uploaded

Employee uploads a complete personnel file to ChatGPT

An employee asked ChatGPT for help and uploaded the personnel file along with the question. This type of breach usually happens when individual employees turn to AI models on their own initiative, known as Shadow AI.

Who: City of The Hague Pattern: Shadow AI
Conclusion
Employees are not sufficiently trained on the security of IT applications and on AI use. Banning does not work, policy and awareness do.
› What this means for your organisation

Far-reaching. Including for you as a board member.

Uncontrolled AI use creates serious exposure: director liability under the EU AI Act, substantial fines, reputational damage and exclusion from the supply chain.

Director liability

The EU AI Act requires organisations to invest in AI literacy. Failing to provide it is treated as a lack of control and compliance.

Reputational damage

Data breaches caused by AI use are scrutinised closely by citizens, customers and regulators. Lost trust takes a long time to rebuild.

Fines & sanctions

Direct fines from the data protection authority and severe EU AI Act sanctions where AI models are used irresponsibly.

Exclusion from the supply chain

Organisations that cannot demonstrate data integrity and AI safety get shut out of modern data networks and ecosystems.

Loss of control

Without central policy you get Shadow AI: employees reach for unsafe tools on their own initiative, and business-critical data ends up outside your organisation, unmanaged.

› The Kodify approach

Five layers, one coherent policy.

Each layer builds on the one before it. Together they form the foundation that lands AI safely and productively in your organisation, from policy through to tooling choices.

01
Layer 1 · Assessment

Drafting the AI policy

A What we do
  • Together with your management team and steering group we define permitted AI use, prohibited AI use and explicit substantive boundaries
  • Translate this into recognisable examples from your day-to-day practice
  • Make sure the policy is workable, not a legal document destined for a drawer
B What it delivers
  • A clear framework your people can experiment within
  • A basis for further implementation and training
  • Protection against unwanted use without blocking innovation
Step 1 of 5
› The facets of an AI policy

The 7 pillars of safe and effective AI use.

AI is a daily reality in your organisation. Rather than banning it, our policy enables innovation within safe boundaries. Route 1 organises this in two days: proven templates take you through every theme and force sharp choices on the spot.

  1. 1

    Human-centred AI

    AI supports people, it does not replace them. Human oversight is mandatory (human-in-the-loop). AI advises, and decisions always stay with a person.

    People firstHuman-in-the-loop
  2. 2

    Security & privacy

    Strict access control: users only see data they are permitted to see. Sensitive information is protected and no personal data goes into open AI tools. Privacy and data minimisation are central.

    Privacy by designAccess control
  3. 3

    Clear division of roles

    A clear split of roles between business, IT, security and users. Policy determines which data and prompts are allowed. Ownership of AI output is explicitly assigned.

    RACIOwnership
  4. 4

    AI literacy

    Employees are trained and certified before they use AI tools. Standard prompts and worked scenarios reduce mistakes. Awareness is built around hallucinations and generic prompting.

    EU AI Act art. 4Training
  5. 5

    Phased implementation

    Small pilots, structured learning, then safe scaling. A well-configured SharePoint and Teams environment makes adoption smooth. You expand iteratively so IT and security keep pace.

    Pilot-to-scaleM365
  6. 6

    Oversight & compliance

    Logging and an audit trail are mandatory, so every use of AI is traceable. A fixed escalation procedure covers breaches and incidents. The policy is evaluated and tightened regularly.

    Audit trailEscalation
  7. 7

    Practical ground rules

    Compact, understandable guidelines for daily practice. Risks named explicitly: hallucinations, Shadow AI, agent risks. Ownership of output settled clearly in a charter people actually use.

    CharterShadow AI
› The workshop · Route 1

Two days, with a checklist & worksheet per half day.

Proven templates, sharp choices, a workable policy. Not a 60-page shelf document, but a charter your people can use tomorrow.

We start from current reality: where is AI already being used, what risks does that carry, and what is the leadership ambition? This sets the strategic frame for the rest of the workshop.

Checklist · concrete actions
  • Map current AI use, including Shadow AI
  • Risk picture: privacy, security, legal, reputation
  • Ambition and scope choices for this policy
  • Stakeholder RACI: leadership, IT, security, business
Worksheet · questions for your team
  • Which AI tools are genuinely in use here right now?
  • Which processes must AI stay away from today?
  • What is our ambition for the next 6 months?
  • Who owns the AI policy internally?

Using our templates we work through the first four pillars: human-centred, security and privacy, division of roles, and AI literacy. We make sharp choices, with no "let us come back to that later".

Checklist · concrete actions
  • Set the human-in-the-loop principles
  • Access control and data minimisation rules
  • RACI for business, IT, security and users
  • AI literacy programme (EU AI Act art. 4)
Worksheet · questions for your team
  • Which decisions stay 100% with a person?
  • Which data must never enter an open AI tool?
  • Who reviews new prompts and use cases?
  • How do we make training measurable?

Implementation, oversight and the daily ground rules. How do you move from pilots to scale without losing control? What logging and escalation do you put in place? Which rules fit on a single page?

Checklist · concrete actions
  • Phased adoption plan, from pilot to scale
  • Set up audit trail, logging and monitoring
  • Escalation and incident protocol
  • One-page ground rules for employees
Worksheet · questions for your team
  • What is our first pilot, and with which group?
  • How will we know the policy actually works?
  • What happens in a data breach, and who calls whom?
  • Which 5 ground rules will people remember tomorrow?

We close on roll-out: how do you communicate the policy, which training goes where, and what does the next 90 days look like? Everyone leaves the workshop with their own action list.

Checklist · concrete actions
  • Communication plan for employees and management
  • 90-day roadmap with an owner per step
  • Templates for repeatable training
  • Review moment and adjustment cycle
Worksheet · questions for your team
  • How do we present this policy to employees?
  • Which 3 quick wins will they see in the first 30 days?
  • When do we evaluate, and against which KPIs?
  • Who is responsible for follow-up?
› From policy to behaviour

Workshops & training.

An effective AI policy stands or falls on how it is applied in practice. Our programmes meet the EU AI Act and build AI literacy at every level, from operational teams to the board.

A

AI literacy workshops

Interactive sessions where employees learn to work with AI inside the boundaries of your policy.

  • Recognise the risks and limits of AI
  • Handle data and privacy responsibly
  • Assess AI output critically (human-in-the-loop)
  • Work within the boundaries of the AI policy
Half a day · max. 16 participants Book a session →
B

In-company training

Practical, tailored training where theory is applied directly to your own use cases.

  • Effective prompting and output validation
  • Working safely with AI inside existing IT structures
  • Applying policy in day-to-day processes
  • Sector-specific scenarios: HR, logistics, healthcare
2 to 4 half days · in-company Shape your programme →
EU AI Act, Article 4: AI literacy. Our programmes are built to demonstrably meet the literacy obligation for providers and deployers of AI systems.
Kodify team during a workshop session
The world in 2040

Data and AI as the ultimate instruments of power. AI as trusted advisor, entire sectors fully automated.

› Finally · our vision

Building the future together.

Fifteen years from now the world is divided into power blocs in which data and AI are the ultimate instruments of power. In an ageing society with a severe shortage of people, AI is integrated everywhere as a trusted advisor and entire sectors are fully automated.

Our purpose: keeping work human in a world that keeps getting more technical.

We free people from manual hassle and complexity, so there is room for creativity and human responsibility. At KODIFY we build a foundation where technology strengthens people rather than replacing them.

› Our core values

Translated straight into results for your organisation.

Value 01

Helping together

We are one team. We absorb the peaks and never leave you struggling with a problem on your own.

Value 02

Radical honesty

We give feedback to move forward, not to be right. Honest about what works, even when that is commercially inconvenient.

Value 03

Learning & applying

We make time structurally to experiment with new AI tools, turning theory straight into working solutions.

Value 04

Just DO it

A deal is a deal. We do not deliver patchwork, but future-proof solutions that make your work lighter.

› Frequently asked questions

FAQ.

For decision-makers and key users who shape the AI policy together: leadership, IT, security, privacy and CISO, HR and a delegation from the business. A mixed group of 8 to 12 participants works best.

A workable AI policy document, a gap assessment against the EU AI Act, a communication plan for the roll-out, sample prompts and guidelines, an escalation and logging protocol, and a 90-day adoption roadmap.

Especially then. We connect directly to your existing Copilot or M365 environment. Route 1 helps you embrace and secure the use that already exists, rather than clamping down on it after the fact.

The workshop is built around the obligations in the AI Act, in particular AI literacy (art. 4), risk management and transparency. We deliver a gap assessment and a demonstrable plan. Actual compliance also depends on how you implement it.

On-site works best: two consecutive days, off-site or in your own working environment. Hybrid is possible. We advise against running this particular workshop fully remote.

› Plan your workshop

Ready to lay the foundation of your AI policy?

Two days. One workable policy. EU AI Act ready. Not a 60-page shelf document, but a charter your people can use tomorrow.

#LetsGetKodified
Reply within 1 business day

Get the workshop leaflet

Leave your details and we will send the leaflet straight to your inbox.