CyberCode.ph · Philippines

Free AI Usage Policy Template Philippines (2026, Law-Based)

Last updated October 24, 2026 · Practical privacy, cybersecurity and technology-law guidance
Free AI usage policy template for Philippine businesses

Short answer: the Philippine government publishes almost no ready-made policy templates. For a tech company, the only official fill-in documents sit inside the NPC Privacy Toolkit (Third Edition, May 2018): a records-of-processing form, a privacy impact assessment guide, a privacy manual guide, a privacy notice guide, a consent guide, a data sharing agreement and a compliance checklist. Everything else, this AI usage policy included, you build yourself from NPC advisories. The best alternative to a generic AI template is a short policy written around your own approved tool list, your own lawful basis and your own human-review points.

Direct Answer

Any Philippine organisation whose staff use ChatGPT, Copilot, Gemini or similar tools needs a written AI usage policy. This is not branding. Under NPC Advisory No. 2024-04, the organisation stays accountable for personal data its AI use touches, and an employee pasting client records into a public chatbot is already processing personal data. Below is the Philippine legal basis for each clause, plus a full adoptable template.

For AI agents that can send, spend, change records or call other systems, a general chatbot rule is not enough. Approve the exact use case, data, connectors, action limits, human checkpoints, logs and rollback route before enabling live actions. Use the AI agent risk assessment below; keep higher-impact agents in a restricted pilot until the evidence supports release.

Before adapting this policy: complete the business AI assessment and tool approval record. Use the findings to define permitted tools, data restrictions and responsible reviewers.

Ready to introduce the policy to staff? Use the staff rollout pack for the approved-tool register, short employee rules, incident instructions and training acknowledgment.

Key Takeaways

  • NPC Advisory No. 2024-04 (19 December 2024) applies the Data Privacy Act, its IRR and NPC issuances to AI systems that process personal data.
  • Accountability does not transfer to the vendor: section 21 of RA 10173 keeps the controller responsible “including information that have been transferred to a third party.”
  • A policy saying only “be careful with AI” is unenforceable. To support discipline, a workplace rule must be reasonable, lawful, made known to the employee and connected to their duties.
  • Public availability is not consent, per NPC Advisory No. 2026-01 (13 April 2026); and a real person’s face in AI-generated images is personal data processing, per the NPC notice of 11 August 2026.
  • Cross-border AI tools raise a transfer question addressed by NPC Advisory 2024-01’s model contractual clauses.
  • The template below is a starting document requiring adaptation to your tool list, data classifications and disciplinary code.

On This Page

Clause-to-Law Mapping

This is the part most AI policy templates skip. Each clause below exists because a specific Philippine rule makes it necessary. If a clause has no legal anchor, it is housekeeping, not compliance.

Policy clause What it does Philippine legal basis
Approved tools list Restricts work data to vetted AI services RA 10173 s.20 (reasonable and appropriate organisational, physical and technical measures); IRR Rule VI ss.25-26
Prohibited inputs Stops personal data entering AI tools without a lawful basis RA 10173 ss.12 and 13; NPC Advisory 2024-04, which requires PICs to “determine the most appropriate lawful basis under Sections 12 and 13 of the DPA prior to the processing”
Confidential and trade-secret bar Prevents disclosure of company and client secrets Contractual and NDA duties; Civil Code arts. 19-21 (abuse of rights and acts contrary to morals or public policy)
Mandatory human review Keeps a competent human in the loop NPC Advisory 2024-04: PICs “shall implement mechanisms to allow for meaningful human intervention carried out by persons with the necessary competence and authority”
Accuracy verification Requires fact-checking of AI output RA 10173 s.11(c) (accuracy); NPC Advisory 2024-04 accuracy principle
Transparency to data subjects Tells people when AI touches their data RA 10173 s.16; NPC Advisory 2024-04 transparency section
Vendor and cross-border clause Controls offshore processing by AI providers NPC Advisory No. 2024-01, Model Contractual Clauses for Cross-Border Transfers of Personal Data (30 May 2024)
Scraped-data restriction Blocks feeding scraped datasets into AI work NPC Advisory No. 2026-01, Guidelines on Data Scraping of Publicly Available Personal Data (13 April 2026)
Likeness and synthetic media rule Bars generating images of identifiable people without basis NPC Notice to the Public, 11 August 2026; RA 10173 ss.12 and 25
Copyright and AI declaration Manages registration and ownership risk IPOPHL Memorandum Circular No. 2026-007 (title confirmed; see the caveat below)
Privacy impact assessment trigger Forces risk analysis before deployment NPC Advisory 2024-04, which requires a PIA as part of governance mechanisms
Named accountable officer Gives the policy an owner RA 10173 s.21; IRR Rule VI s.26 (designate a data protection officer or compliance officer)
Consequences clause Links breach to the disciplinary code Labor Code art. 282 (renumbered art. 297) just causes; Dongon v. Rapid Movers requisites for willful disobedience

Governing Law and Authorities

As of 6 September 2026 the Philippines has no dedicated AI statute in force. AI at work is governed by existing law applied to new technology, which is exactly what the NPC has done.

RA 10173, the Data Privacy Act of 2012. Section 11 sets the general principles; sections 12 and 13 the exclusive criteria for lawfully processing personal and sensitive personal information; section 20 requires reasonable and appropriate organisational, physical and technical security measures; section 21 provides that “each personal information controller is responsible for personal information under its control or custody, including information that have been transferred to a third party.” Rule VI of the IRR, sections 25 to 29, details those measures, including the section 26 duty to designate a data protection officer or compliance officer, keep records of processing activities, and bind personnel to confidentiality surviving employment.

NPC Advisory No. 2024-04 (19 December 2024) is the operative AI guidance. It applies “when the processing of personal data is involved in the development or deployment of AI systems, including its training and testing,” and requires governance mechanisms, privacy by design and by default, and human review of AI output. NPC Advisory No. 2026-01 (13 April 2026) covers scraped data and states that “the public availability of personal data does not constitute consent by the data subject.” NPC Advisory No. 2024-01 (30 May 2024) supplies model contractual clauses for cross-border transfers, which matters because nearly every mainstream AI tool processes offshore. The NPC Notice to the Public of 11 August 2026 states that a person’s face and likeness are personal information under RA 10173 and that generating images from a real person’s likeness is processing of personal data.

IPOPHL Memorandum Circular No. 2026-007 appears on IPOPHL’s administrative issuances list as “Revised Rules and Regulations On Copyright Registration and Copyright Related Services.” Status note, 6 September 2026: the circular’s number and title are confirmed on ipophil.gov.ph, but its full text is served from an external document store we could not read. Reports that it requires declaring generative-AI use on copyright applications and adds a human-authorship refusal ground are therefore reported, not verified here. Read the circular before relying on those provisions.

What the Policy Must Cover, Clause by Clause

Scope, approved tools and shadow AI

Cover employees, probationary staff, contractors, consultants and interns, and say expressly that confidentiality survives the engagement, as Rule VI section 26 contemplates. The realistic failure mode is not a rogue deployment but an associate pasting a client list into a free consumer chatbot on a personal account. An approved-tools list is the cheapest organisational measure available under section 20: name the tools, name the account type, say what happens outside the list.

Lawful basis, human review and accuracy

NPC Advisory 2024-04 requires the lawful basis to be identified before processing, so the policy must stop staff deciding for themselves: personal data enters an AI tool only where a named approver has recorded a section 12 or 13 basis. Where output feeds a decision affecting a person, the advisory requires meaningful human intervention “carried out by persons with the necessary competence and authority,” plus a route to question and contest decisions posing significant risk. A rubber-stamp reviewer does not satisfy this. Section 11(c) requires accuracy, and the advisory extends accuracy to the fairness of AI output, so fabricated citations and invented figures are a compliance problem, not just an embarrassment.

Confidentiality, vendors and outputs

Philippine law protects commercial secrets mainly through contract and employment duties rather than one consolidated trade-secrets statute, which makes the written policy load-bearing: an unwritten rule is far harder to characterise as willfully breached. Require documented vendor terms on training-data use, retention, deletion and processing location, with cross-border transfers covered consistently with NPC Advisory 2024-01. On outputs, separate two risks: synthetic images of identifiable people, which the 11 August 2026 notice treats as personal data processing, and ownership or registrability of AI-assisted work, where IPOPHL MC No. 2026-007 is the document to read before filing.

Exceptions and Boundaries: What This Policy Cannot Lawfully Do

A policy is not a private legislature. Several things an employer may want to write in are unenforceable or unlawful in the Philippines.

  • It cannot manufacture a lawful basis. Sections 12 and 13 of RA 10173 are exhaustive; “employees consent to all AI processing” creates no basis for processing third parties’ data.
  • It cannot authorise unlimited monitoring of communications. RA 4200 makes it unlawful for any person “not being authorized by all the parties to any private communication” to tap or record it.
  • It cannot make dismissal automatic. A breach must still be matched to a just cause under Labor Code article 282 (renumbered article 297) and proved, with due process observed.
  • It cannot punish conduct predating dissemination. Under Dongon v. Rapid Movers, the order must have been “made known to the employee.”
  • It cannot override confidentiality owed to clients. Client consent, not company policy, governs there.
  • It cannot outsource accountability, which section 21 keeps with the controller.

Hypothetical Philippine Scenarios

The following are hypothetical illustrations, not real cases or predictions of outcome.

Scenario 1: The recruitment shortlist

A Makati BPO’s HR associate uploads 400 applicant CVs to a free consumer AI tool to rank candidates, without telling applicants. On the Advisory 2024-04 framework that is AI processing of personal data with no identified lawful basis, no transparency, no PIA and no meaningful human intervention. Under section 21 the employer, not the vendor, is accountable.

Scenario 2: The pasted client contract

An analyst pastes a client’s unsigned commercial contract into a chatbot for a summary. With no personal data involved the DPA exposure is limited, but the confidentiality breach is contractual and potentially a just cause. Whether it supports dismissal turns on whether the prohibition was written, disseminated and acknowledged beforehand.

Scenario 3: The generated endorsement image

A marketing team generates a promotional image using the face of a well-known Filipino personality who never agreed to it. Following the NPC’s 11 August 2026 notice, the face is personal information and the generation is processing, so the company faces potential unauthorised-processing exposure under section 25 on top of any civil or intellectual property claim.

AI Agent Risk Assessment: Permissions, Approval, Logs and Rollback

Short answer: assess an AI agent as a system that may take actions, not merely generate text. Before deployment, define the business purpose; map affected people and possible adverse impacts; constrain every permission; require a competent human before high-impact actions; test the vendor, connectors and failure modes; log enough to reconstruct events; and prove that the agent can be paused, revoked and rolled back.

The OECD Due Diligence Guidance for Responsible AI, published 19 February 2026, is nonbinding guidance, not a Philippine statute or NPC issuance. It adapts voluntary responsible-business-conduct due diligence to enterprises developing or using AI. Its six measures are iterative: embed responsible conduct in policies and management systems; identify and assess actual and potential adverse impacts; cease, prevent and mitigate impacts; track implementation and results; communicate how impacts are addressed; and provide for or cooperate in remediation when appropriate.

Use that process together with applicable Philippine law. If the agent processes personal data, RA 10173 and NPC Advisory No. 2024-04 require the controller to establish a lawful basis, transparency, proportionality, security, accountability and data-subject safeguards. The advisory also calls for a privacy impact assessment and meaningful human intervention where automated decisions may significantly affect rights or freedoms. Those are legal/privacy controls; the broader OECD steps remain a voluntary risk-management framework.

1. Write the agent’s permission envelope

Approve a tool-and-use-case profile, not a product name. Record which systems the agent may reach, which data it may read, which actions it may take, the maximum amount or scope per action, who may change its instructions, and when it must stop. Deny all unlisted permissions by default. Reassess when the model, vendor terms, connector, data source, purpose, action limit or affected group changes.

Permission or action Safer default Approval evidence before live use
Read public or low-risk reference material Allow only named sources; no hidden expansion to drives or inboxes Source list, purpose, test results and owner
Read personal, confidential or client data Deny until the use case, lawful basis, minimisation and access controls are documented PIA or recorded assessment, data map, access list, retention and vendor decision
Draft a reply, report or recommendation Draft only; label it as unapproved and prevent automatic sending Reviewer role, accuracy tests, prohibited claims and escalation rules
Send, publish or contact a person Human approval for each external action, at least during a bounded pilot Named approver, content checks, recipient limits and immutable action log
Create, edit or delete business records Use a sandbox or reversible staging step; prohibit bulk deletion Field-level permissions, validation, backup, rollback test and change log
Approve refunds, purchases or contracts No autonomous approval; set a low proposal threshold and require an authorised human Monetary cap, segregation of duties, fraud checks and approval record
Change users, credentials or security settings Prohibit in production except through a separately controlled workflow Least privilege, dual approval, credential isolation and emergency revocation test

2. Run eight approval gates before release

  1. Purpose and necessity: state the exact outcome and why a less autonomous tool cannot reasonably achieve it. Name the business owner and the people who could be helped or harmed.
  2. Impact assessment: test foreseeable privacy, security, discrimination, consumer, labour, intellectual-property and operational harms. Prioritise severity and likelihood, while recognising that severe impacts should not be ignored merely because they seem infrequent.
  3. Data and vendor review: list inputs, outputs, training/feedback settings, retention, processing locations, subprocessors, incident support and deletion routes. Complete the vendor decision record.
  4. Permission and connector review: verify least privilege in the real account. A drafting approval does not cover inbox access, automatic sending, payments or deletion.
  5. Human checkpoints: name a person with competence and authority to approve high-impact actions, handle exceptions and overrule the system. Define actions the agent may never take.
  6. Testing and monitoring: use synthetic or minimised data first. Test prompt injection, incorrect tool calls, fabricated facts, privilege escalation, repeated actions, unsafe content and recovery after failure. Set a review date and measurable stop conditions.
  7. Logging and evidence: record the agent/version, instructions, user or triggering event, data sources, tool calls, approvals, timestamps, output/action, errors and overrides. Protect logs from unauthorised access and retain them only as justified.
  8. Incident and remedy: document pause, credential revocation, connector isolation, rollback, vendor escalation, internal reporting, affected-person support and lessons learned. Link the route to the business incident-response checklist and, where personal data may be exposed, the NPC breach-notification guide.

3. Evidence and action

RuleOECD’s 2026 guidance is voluntary and nonbinding. Philippine privacy duties arise from RA 10173 and NPC issuances when personal data is processed.
Evidence to preserveUse-case decision, risk/PIA record, vendor terms, permission export, test results, approval thresholds, named reviewers, action logs, overrides, incidents and rollback test.
ActionKeep the agent in a restricted pilot until every high-impact permission has a human gate, logging is usable and pause/revocation/rollback have been demonstrated.
Limits and expected outcomeNo checklist guarantees safety or legal compliance. The practical result is a documented decision to approve, restrict, redesign, suspend or reject the use case, with a route to remedy harm.

4. Philippine example: an e-commerce refund agent

A Cebu retailer wants an agent to read support tickets, check orders and propose refunds. A defensible pilot lets it read only the ticket and matching order, drafts a recommendation, masks unnecessary personal data and requires a supervisor to approve every message and refund. The agent cannot change bank details, issue store credit above the recorded cap, contact anyone outside the ticket, export customer lists or delete records. Logs capture the source data, recommendation, tool calls, reviewer and final action.

If the agent begins issuing duplicate refunds or exposes customer data, staff pause the workflow, revoke its connector, preserve the relevant logs and route the event through the incident team. The privacy team then applies the separate breach assessment and notification rules; an internal AI incident is not automatically a reportable personal data breach. For an accidental upload, use the customer-data and AI containment guide.

5. Copyable AI-agent control clause

Suggested policy wording: “An AI agent may operate only under a recorded use-case approval that identifies its owner, purpose, users, data, systems, connectors, permitted actions, prohibited actions, transaction or volume limits, required human approvals, logging, monitoring, review date and incident contact. Unlisted permissions are denied. The agent must not approve its own output, expand its access, bypass a human checkpoint, alter security controls, make an employment or similarly significant decision, or execute an irreversible or high-impact action unless a separately documented legal basis and authorised process permits it. [OWNER] may suspend the agent immediately. Production use may resume only after the cause, affected records and actions, containment, corrective controls and approval to restart are documented.”

Source status checked 9 October 2026. The OECD framework is guidance and does not replace sector rules, contracts, professional duties or case-specific legal review.

Records and Documentation That Make the Policy Enforceable

A policy nobody can prove was communicated is worth very little in a labour case or an NPC inquiry. Keep the following.

  • Signed acknowledgement receipts, dated and naming the policy version.
  • Dissemination proof: the email or HRIS log showing the circulation date, plus a photo of any posted copy.
  • Training logs with attendee names, date, duration and materials.
  • The approved-tools register, with approval date and approver per entry.
  • Privacy impact assessments per AI use case involving personal data, which NPC Advisory 2024-04 places within required governance mechanisms.
  • Records of processing activities, required by IRR Rule VI section 26, and exception approvals showing who authorised each departure.
  • Version history, so you can prove which text was in force on a given date.

How to Adopt, Disseminate and Enforce It

  1. Inventory actual AI use first. A policy written against imaginary usage is unenforceable.
  2. Read the primary sources. Start with NPC Advisory No. 2024-04 and NPC Advisory No. 2026-01.
  3. Assign the owner. Name the DPO or compliance officer required by IRR Rule VI section 26.
  4. Adapt the template below and replace every bracketed field.
  5. Run a PIA for each AI use case that touches personal data.
  6. Align with the disciplinary code, mapping each prohibited act to an existing offence classification.
  7. Consult, then issue with a prospective effectivity date.
  8. Disseminate and collect acknowledgements, keeping the proof.
  9. Train with real examples of what not to paste, then enforce consistently; uneven enforcement is the fastest way to lose a case built on the policy.
  10. Review at least annually and whenever the NPC or IPOPHL issues something new. Check privacy.gov.ph advisories and IPOPHL administrative issuances.

Consequences and Realistic Outcomes

Labour consequences

A policy breach can support discipline, but a policy alone does not create a valid dismissal. The employer must show a just cause under Labor Code article 282 (renumbered article 297), whose grounds include serious misconduct or willful disobedience, gross and habitual neglect of duties, and fraud or willful breach of trust. For willful disobedience, Dongon v. Rapid Movers and Forwarders (G.R. No. 163431, 28 August 2013) requires the conduct be willful and that “the order the employee violated must have been reasonable, lawful, made known to the employee, and must pertain to the duties that he had been engaged to discharge.”

Procedure is a separate hurdle. King of Kings Transport v. Mamac (G.R. No. 166208, 29 June 2007) requires a first written notice specifying the grounds with reasonable opportunity to explain, an opportunity to be heard, and a second written notice of termination; “a verbal appraisal of the charges against an employee does not comply with the first notice requirement.” Where the cause is valid but procedure was skipped, Agabon v. NLRC (G.R. No. 158693, 17 November 2004) held the dismissal is not nullified but the employer must indemnify the employee, awarding P30,000 nominal damages there.

Administrative consequences

The NPC can investigate, order compliance and issue directives against the controller; Advisory 2024-04 places accountability for AI outcomes on the controller, not the tool.

Criminal consequences

Sections 25 to 32 of RA 10173 create personal criminal liability. Section 25, unauthorised processing of personal information, carries imprisonment of one to three years and a fine of P500,000 to P2,000,000, rising to three to six years and P500,000 to P4,000,000 for sensitive personal information. Sections 31 and 32, malicious and unauthorised disclosure, are the provisions most likely to be in play when an employee leaks data through an AI tool. Confirm the figures against the statute text before relying on them.

Civil consequences

Civil Code articles 19, 20 and 21 support damages claims for abusive or wrongful acts; article 26 requires every person to “respect the dignity, personality, privacy and peace of mind of his neighbors and other persons”; article 32 allows a separate civil action for interference with the privacy of communication and correspondence.

Common Mistakes

  • Copying a US or EU template that cites the GDPR or EU AI Act and has no Philippine hook.
  • Banning AI outright, which drives usage onto personal accounts where you have no visibility and no logs.
  • Assuming the AI vendor’s terms discharge your obligations. Section 21 says otherwise.
  • Treating publicly scraped data as free to use, which NPC Advisory 2026-01 directly contradicts.
  • Writing “employees consent” clauses instead of identifying a section 12 or 13 basis for the actual processing.
  • Never collecting acknowledgement receipts, then trying to dismiss someone for breaching a policy you cannot prove they received.
  • Leaving bracketed placeholders in the adopted version, or citing an advisory number from memory instead of confirming it on privacy.gov.ph.

The Full AI Usage Policy Template

How to use this template. Everything in square brackets is a field you must replace. Annotations appear as italic notes below each clause and should be deleted before adoption. This is a starting document for a Philippine private-sector employer and requires review against your own systems, contracts, sector regulation and disciplinary code. It is not legal advice.

BEGIN TEMPLATE — ARTIFICIAL INTELLIGENCE USAGE POLICY

1. Title, Owner and Effectivity

This Artificial Intelligence Usage Policy of [COMPANY NAME] takes effect on [DATE] and supersedes prior guidance on the same subject. Policy owner: [NAME AND POSITION OF DPO OR COMPLIANCE OFFICER], [EMAIL], [PHONE]. Version [X.X].

Note: naming an accountable individual reflects IRR Rule VI section 26. Effectivity must be prospective.

2. Purpose

This policy states how personnel of [COMPANY NAME] may use artificial intelligence tools, including generative AI, in company work. It protects personal data, confidential information, client interests and company systems, and gives effect to the Data Privacy Act of 2012 and NPC issuances including NPC Advisory No. 2024-04.

3. Scope

This policy binds all employees, probationary, project and fixed-term personnel, interns, consultants, contractors and any other person granted access to [COMPANY NAME] systems or information. It covers AI use on company devices, on personal devices used for company work, and on any account used for company purposes. Confidentiality obligations continue after the engagement ends.

4. Definitions

AI tool means any system that generates text, code, images, audio, video, analysis, ranking or recommendations using machine learning, including generative AI assistants and AI features embedded in other software. Personal data has the meaning given in RA 10173. Company information means information owned by, entrusted to or generated for [COMPANY NAME].

5. Approved Tools

Personnel may use only the AI tools listed in the Approved AI Tools Register maintained by [OFFICE], and only through accounts provisioned by [COMPANY NAME]. As of [DATE] the approved tools are: [TOOL 1], [TOOL 2], [TOOL 3]. Personal or free consumer accounts must not be used for any company information. Requests to add a tool go to [APPROVER] and require review of the tool’s terms on training-data use, retention, deletion and location of processing.

Note: this is your primary organisational security measure under section 20 of RA 10173.

6. Prohibited Inputs

Personnel must not enter any of the following into an AI tool without prior written approval under clause 8:

  • personal data of employees, applicants, customers, patients or any other individual;
  • sensitive personal information as defined in section 3(l) of RA 10173;
  • passwords, access codes, API keys, tokens or other credentials;
  • client information covered by a non-disclosure agreement, contract or professional duty of confidentiality;
  • unpublished financial results, pricing models, source code, designs or other trade secrets;
  • personal data obtained by scraping publicly accessible sources;
  • images, audio or video of an identifiable person for the purpose of generating synthetic likenesses.

Note: the scraping and likeness items track NPC Advisory No. 2026-01 and the NPC public notice of 11 August 2026.

7. Lawful Basis for Personal Data

Personal data may be processed using an AI tool only where [DPO OR APPROVER] has recorded, before processing begins, the section 12 or section 13 criterion that permits it, the purpose, the retention period and the data subjects concerned. Personnel acknowledgement of this policy is not a lawful basis for processing any other person’s data.

8. Approvals and Exceptions

Any departure from clauses 5 to 7 requires prior written approval from [APPROVER], stating the tool, data, lawful basis, duration and controls, filed with [OFFICE].

9. Privacy Impact Assessment

Before an AI tool is deployed for a use case involving personal data, [OFFICE] must complete a privacy impact assessment covering the nature, scope, context and purposes of the processing and the risks to the rights and freedoms of data subjects, reviewed at least [FREQUENCY] and whenever the use case materially changes.

10. Human Review and Contestability

AI output must be reviewed by a qualified person before use in any decision, external communication, published content, legal or financial document, or technical implementation. Where output contributes to a decision significantly affecting an individual, the reviewer must have the competence and authority to change that decision, and the individual must be able to question and contest it through [CHANNEL].

Note: implements the meaningful human intervention requirement in NPC Advisory No. 2024-04.

11. Accuracy

Personnel must independently verify facts, figures, citations, legal references, calculations and technical conclusions produced by an AI tool. Unverified output must not be presented as company work product.

12. Transparency

Where AI is used to process personal data, [COMPANY NAME] will inform affected data subjects of the nature, purpose and extent of the processing through [PRIVACY NOTICE LOCATION], in clear and plain language.

13. Confidentiality and Intellectual Property

Company information entered into an AI tool remains confidential and the property of [COMPANY NAME] or its clients. Personnel must not use output they know or reasonably should know infringes a third party’s rights. Where AI has materially contributed to a work [COMPANY NAME] intends to register or publish, personnel must disclose that to [OFFICE] before filing or publication.

Note: check IPOPHL MC No. 2026-007 for current declaration requirements before any copyright filing.

14. Vendors and Cross-Border Processing

Where an approved AI tool processes personal data outside the Philippines, [OFFICE] must ensure written contractual protection consistent with NPC Advisory No. 2024-01 and record the countries involved.

15. Security

Personnel must not use AI tools to bypass security controls, generate or deploy malicious code, test systems without written authorisation, or disclose vulnerabilities outside the process in [INCIDENT POLICY REFERENCE].

16. Incident Reporting

Any person who enters prohibited information into an AI tool, or suspects exposure of company information or personal data through one, must report to [CONTACT] within [NUMBER] hours. Good-faith reporting will not itself be treated as an offence; concealment will be.

17. Records

[OFFICE] will maintain the Approved AI Tools Register, approval records, privacy impact assessments, records of processing activities, training logs, acknowledgement receipts and version history, retained for [PERIOD].

18. Consequences of Breach

Breach may result in withdrawal of access and disciplinary action under [COMPANY DISCIPLINARY CODE REFERENCE], applied with due process. Nothing here dispenses with the requirement of a valid cause and procedural due process under Philippine labour law. Breach may also give rise to personal criminal liability under the Data Privacy Act of 2012 and other laws.

19. Review

Reviewed at least annually and whenever the NPC, IPOPHL or another authority issues relevant guidance. Next scheduled review: [DATE].

20. Acknowledgement

I, [NAME], [POSITION], confirm I received the Artificial Intelligence Usage Policy of [COMPANY NAME], version [X.X], dated [DATE]; that its contents were explained to me; and that I understand breach may lead to disciplinary action and personal liability under Philippine law. Signature: ____________ Date: ____________
END TEMPLATE

AI Staff Rollout Pack: From Approval to Everyday Use

Added 3 October 2026. Adapt these materials after completing the AI approval record. Replace every bracketed field before issuing them. These are suggested internal controls, not prescribed government forms or a substitute for the full policy.

Approved-tool register · Employee rules sheet · Incident instructions · Training checklist · Acknowledgment

1. Approved AI Tools Register

Maintain one entry for each approved tool and use case. A product name alone is not approval for every feature, account or dataset. Share the current permitted-use summary with staff; keep vendor contracts, security evidence and detailed PIAs in restricted records.

  • Register ID / status: [approved / restricted pilot / suspended / retired].
  • Tool, vendor, plan and company workspace: [exact product and account route].
  • Business owner and authorised users: [role/team].
  • Permitted tasks and actions: [specific purposes; enabled integrations].
  • Allowed data: [categories and required minimisation].
  • Prohibited data and actions: [restrictions from the approval/PIA].
  • Required review: [who checks output; before which action].
  • Controls: [access, training-use settings, retention and connector limits].
  • Approval evidence: [approval ID, PIA and vendor decision references].
  • Approver, approval date, expiry/review date: [complete].
  • Change triggers and incident contact: [complete].

Fictional example: AI-001, restricted pilot; Example AI Vendor’s company workspace; Support Manager owns it; three named agents may draft replies using invented customer messages only. No live customer data, inbox connection, automatic sending or refund actions. A supervisor checks drafts. The pilot expires after two weeks unless reviewed. This mirrors the worked PIA’s hold on live processing; it is not approval of a real vendor.

2. Short Employee Rules Sheet

[COMPANY] — AI at Work. Policy version [VERSION], effective [DATE]. Current tool register: [LOCATION]. Help and incident reporting: [CONTACT/CHANNEL]. Manager: [CONTACT]. Copy this section into a one-page handout and check the final layout.

  1. Check the register first. Use the listed company account for the listed task. If the tool or use is absent, suspended or expired, ask before using it.
  2. Check the data before uploading. Use only the categories allowed for that use case. Do not enter personal data, client-confidential information, source code or other restricted material unless the recorded approval specifically permits it with the required controls. Never paste passwords, access tokens or API keys into prompts.
  3. Keep permissions within approval. Do not connect email, cloud drives, calendars or business systems, enable training/feedback options or let an AI agent take actions unless those features are approved.
  4. Review before relying on output. Verify facts, calculations, citations, disclosure risks and third-party rights. Get the designated human review before external communication, publication, decisions or implementation. Do not let the tool approve its own work.
  5. Ask when the task changes. Approval for drafting does not cover hiring decisions, profiling, meeting recording, new data categories or automatic sending. Follow the exception process before starting.
  6. Report mistakes promptly. Stop the affected activity and use the incident channel below. Do not hide an accidental upload or spread its contents through group chats.

These are proposed company rules to align with your adopted policy. A manager’s permission does not replace a lawful basis for processing or other legal requirements.

3. Accidental Upload or Unsafe AI Action: What Staff Should Do

  1. Stop the affected activity. Do not upload more information or repeat the event to test it. If safe and within your authority, pause the agent or workflow; contact IT for containment you cannot perform.
  2. Report immediately through [SECURE INCIDENT CHANNEL]. If unavailable, use [BACKUP CONTACT]. Give discovery time and time zone, tool/workspace, what happened, data categories, possible recipients and actions already taken. The company should set an internal escalation target that supports its incident process; staff should not wait for that target to expire.
  3. Preserve the minimum useful evidence securely. Record relevant message IDs, URLs, settings and timestamps. Do not delete logs or histories on your own, forward sensitive prompts to broad groups, or create unnecessary copies. Follow the response team’s preservation and removal instructions.
  4. Let authorised responders coordinate containment. IT can revoke exposed credentials or permissions, and the privacy/security team can contact the vendor, investigate data use and arrange deletion while preserving necessary evidence. Do not use a new AI tool to analyse the exposed data.
  5. Wait for documented restart approval. The designated incident lead decides when the affected use may resume. Staff should not make promises about deletion, harm or legal notification.

The privacy/incident team separately assesses whether regulator or affected-person notification is required and applicable deadlines. Internal reporting is not an NPC filing. Use the accidental customer-data upload guide and breach-response checklist for that follow-through.

4. Manager’s Launch and Training Checklist

  • Before access: approve the policy/version and use-case register; resolve PIA and vendor conditions; fill in working help/incident contacts; configure permissions and named accounts.
  • Explain the rules: show where the current register lives, what data is allowed and who reviews output. Use an accessible format and language the team understands.
  • Practise with invented data: demonstrate an approved task, a rejected upload and the reporting route. Do not use live customer records for training.
  • Check understanding: ask each participant to work through the three scenarios below; explain corrections and record any follow-up training needed.
  • Record completion: participant, role, date, trainer, policy/register versions, exercise outcome, unanswered questions and acknowledgment status. Limit access and apply a justified retention schedule.
  • After launch: owner checks that actual settings and usage match approval. Retrain on material changes; suspend or remove access when required, including role changes or departure.
Exercise 1: A customer spreadsheet would make the answer better. Can you upload it?

Expected response: check whether that data and task are explicitly approved. If not, do not upload it. Ask the owner for a reviewed route or use invented/minimised data within existing approval. Removing names alone does not guarantee anonymity.

Exercise 2: The approved drafting tool offers to send replies automatically. Can you enable it?

Expected response: no, unless that action has separate recorded approval. Keep the human review and send process; request reassessment of the new capability.

Exercise 3: You pasted a client document into the wrong account. What now?

Expected response: stop, report via the secure channel, preserve identifiers and timestamps, and follow containment instructions. Do not conceal it or delete the history before the response team assesses preservation.

5. Receipt and Training Acknowledgment

Copyable wording: “I, [NAME/ROLE], received [COMPANY]’s AI usage policy version [VERSION] dated [DATE], the employee rules sheet and the location of the current approved-tool register. The permitted uses, data restrictions, human-review and incident-reporting process were explained to me. I know where to ask questions and request clarification. Questions or further training needed: [DETAILS/NONE]. Acknowledged on [DATE] by [SIGNATURE/RECORDED METHOD]. Trainer: [NAME/DATE].”

This records receipt and the stated training, not proof of compliance. It does not create consent to process customer or employee data, waive rights, establish misconduct or authorise automatic disciplinary action. Apply the adopted policy and applicable processes fairly; do not record an acknowledgment that was not actually given.

Keep the documents aligned: full AI usage policy → use-case approval → vendor decision → staff register and training. Update affected materials when the approval changes.

Sources checked for this targeted addition: NPC Advisory 2024-04 on AI personal-data accountability and governance; DPA IRR on security and breach response. The register, exercises and acknowledgment are editorial implementation aids. The existing legal discussion retains its separate review date.

Policy templates a Philippine tech company actually needs

There is no official library of Philippine business policy templates. The National Privacy Commission is the only regulator that publishes anything close to one, and it is a single document: the NPC Privacy Toolkit, Third Edition, May 2018. The Commission separately maintains a Forms page, but it carries only three fillable PDFs: a complaint affidavit, a service request and assessment form, and a training provider application. None of them is a policy template.

The table below maps the documents a Philippine technology company is realistically asked to produce, against the official starting point for each and the Cybercode guide that works it through.

Policy document Why it matters Official starting point Cybercode guide
Privacy manual The core document the NPC expects a personal information controller to produce when asked. NPC Privacy Toolkit, Privacy Manual Guide, pages 82 to 89. Data Privacy Act compliance checklist
Records of processing A written inventory of what personal data you hold, why, and who receives it. NPC Privacy Toolkit, records of processing form, pages 33 to 35. Data Privacy Act compliance checklist
Privacy impact assessment Required governance step before a new system or AI deployment touches personal data. NPC Privacy Toolkit, PIA guide, pages 45 to 58, with NPC Advisory No. 2017-03. AI and data privacy in the Philippines
Privacy notice and consent What you publish to data subjects, and how you capture consent where that is your basis. NPC Privacy Toolkit, privacy notice guide and consent guide, pages 90 to 96. Online business compliance checklist
Data sharing agreement Governs disclosure of personal data to another organisation. NPC Privacy Toolkit, pages 116 to 125, read with NPC Circular No. 2020-03 and Advisory No. 2025-01. AI vendor due diligence checklist
AI usage policy Sets which tools staff may use, on what data, with which human review points. No official template exists. Build it from NPC Advisory No. 2024-04. This guide, and the full template further down the page.
Employee cybersecurity policy Carries the organisational security measures RA 10173 Section 20 requires you to adopt. No official template exists. RA 10173 Section 20 sets the duty. Employee cybersecurity policy template
Password and access rules The control most often missing when the NPC reviews a breach. No official template exists. Treated as a security measure under Section 20. Password policy guide

Two warnings about the Toolkit, because it is the document most Philippine companies are pointed to. It was published in May 2018 and has not been reissued. Its registration chapter is built on NPC Circular No. 17-01, and its security material predates NPC Circular No. 2023-06. Its data sharing chapter is the furthest out of date: NPC Circular No. 2020-03 superseded Circular No. 16-02 in full, and NPC Advisory No. 2025-01 then confirmed that a data sharing agreement is optional, confers no legal basis for processing, and needs no NPC review or approval. Use the Toolkit for structure, and check each rule against the current issuance before you adopt it.

One more correction worth making, because the title misleads. NPC Advisory No. 2024-01 is called Model Contractual Clauses for Cross-Border Transfers of Personal Data, and many companies expect clause text they can paste into a contract. It contains none. Section 6 states that the guidance is intended for voluntary adoption and imposes no additional rights or obligations, and Section 6(A) states that the Commission does not require contractual parties to adopt the use of model contractual clauses. The advisory compares seven sets of clauses published elsewhere; it does not supply them.

Alternatives to a generic AI policy template

A downloaded AI policy written for a US or EU employer fails in the Philippines for a specific reason, not a stylistic one. NPC Advisory No. 2024-04 places duties on your organisation that no external drafter can discharge for you: identifying the most appropriate lawful basis under Sections 12 and 13 of the Data Privacy Act before processing begins, explaining your own system inputs, outputs and risks to data subjects, running a privacy impact assessment, providing meaningful human intervention by competent authorised people where an automated decision significantly affects rights, and being able to demonstrate compliance through your own documented policies. A generic template fills none of those in.

The advisory adds three duties that are easy to miss and are almost never in an imported template. Section 2(C) bans AI washing, meaning overstating the role AI plays in your product. Section 2(E) requires you to exclude, by default, any personal data unlikely to improve the system. Section 3 requires working mechanisms for the rights to object, to rectification and to erasure or blocking, with an explanation to the data subject whenever a request cannot be met.

So the practical question is not which template to download, but which route to take instead. Four work in Philippine conditions.

Alternative What it involves When it fits
Build from the advisory Work through NPC Advisory No. 2024-04 section by section and write a clause for each duty it names. You process personal data with AI and have no policy at all.
Annex to your privacy manual Add an AI section to the manual you already maintain, so one document governs and one owner updates it. You already have a privacy manual the NPC has seen.
Start with a tools register List approved tools and the data each may touch, then write a one-page staff rules sheet from it. Staff are already using AI tools and you need control this month.
Let a PIA write the policy Run a privacy impact assessment first and draft the policy around the risks it actually surfaces. You are deploying a specific AI system that makes or shapes decisions about people.

First concrete action. Whichever route you pick, start with the approved tools register in the rollout pack below, because every other document depends on knowing which tools are in use. Write down the tools staff already use, the data each one touches, and who approved it. That register takes an afternoon, it is the evidence the NPC asks for first, and it tells you immediately whether your exposure is a policy problem or a shadow AI problem.

Frequently Asked Questions

What are the best policy templates for a Philippine tech company?

The only official ones are inside the NPC Privacy Toolkit, Third Edition (May 2018): records of processing (pages 33 to 35), a privacy impact assessment guide (45 to 58), a privacy management programme guide and checklist (59 to 81), a privacy manual guide (82 to 89), a privacy notice guide (90 to 93), a consent guide (94 to 96), a data sharing agreement (116 to 125) and a compliance checklist (137 to 142). The NPC Forms page carries no policy template, only three fillable PDFs for complaints, service requests and training provider applications. For an AI usage policy, an employee cybersecurity policy or a password policy, no Philippine government template exists and you build from the governing issuance instead.

What are the top alternatives to using generic AI policy templates for a PH company?

Four, in rough order of how quickly they produce something defensible. Build the policy clause by clause from NPC Advisory No. 2024-04. Add an AI annex to the privacy manual you already maintain. Start from an approved tools register and a one-page staff rules sheet, then formalise. Or run a privacy impact assessment first and let its findings set the policy. A generic imported template is weakest because the advisory places organisation-specific duties on you, including identifying your lawful basis under Sections 12 and 13 before processing, providing human intervention over significant automated decisions, and excluding by default personal data unlikely to improve the system.

Is the OECD responsible-AI due diligence guidance binding in the Philippines?

No. The OECD guidance published on 19 February 2026 describes voluntary responsible-business-conduct due diligence for AI. It is useful as a governance process, but it does not itself create a Philippine statutory duty. Apply Philippine laws and NPC issuances separately when the agent processes personal data or creates another regulated risk.

Is an AI usage policy legally required in the Philippines?

No statute names an “AI usage policy” as a required document, but section 20 of RA 10173 requires reasonable and appropriate organisational security measures and NPC Advisory No. 2024-04 requires governance mechanisms and documented policies where AI processes personal data. For most organisations a written policy is the practical way to meet both.

Can we just ban AI instead?

You can, but a ban with no approved alternative pushes usage onto personal accounts, which is where uncontrolled disclosures happen. A narrow approved-tools list is usually more defensible than a prohibition nobody follows.

Does the AI vendor become the responsible party once data is uploaded?

No. Section 21 of RA 10173 keeps the personal information controller responsible for personal information under its control or custody, including information transferred to a third party.

Can we dismiss an employee for pasting client data into ChatGPT?

Possibly, but not automatically. You need a just cause under Labor Code article 282 (renumbered article 297), proof the rule was reasonable, lawful and made known to the employee, and observance of the twin-notice procedure. A policy never disseminated or acknowledged is a weak foundation.

Do we need to declare AI use when registering copyright?

IPOPHL Memorandum Circular No. 2026-007 revised the rules on copyright registration and related services. As of 6 September 2026 its number and title are confirmed on IPOPHL’s issuances list but its full text was not readable, so treat any specific declaration or human-authorship requirement as reported and confirm with IPOPHL before filing.

Is data that is already public free to use in AI work?

No. NPC Advisory No. 2026-01 states that the protections of the DPA apply to publicly available personal data and that public availability does not constitute consent.

Official Sources

Verification note. The Supreme Court E-Library was unreachable from both of this run’s retrieval tools on 24 October 2026, so the four Supreme Court and Civil Code references above are listed by citation without a link rather than through a non-official host. The Department of Labor and Employment page cited above confirms Department Order No. 147-15 as the issuance governing termination due process; the detailed notice requirements were not re-verified this run.

Sources rechecked as of: October 24, 2026

Disclaimer

Important: This article provides general educational information about Philippine law, regulation, cybersecurity, technology, or business compliance. It is not legal advice and does not create an attorney-client relationship. Laws, agency procedures, technical standards, platform rules, and the facts of each situation may change the result. Verify current requirements through the cited official sources and seek qualified professional advice when your rights, deadlines, money, safety, or legal exposure may be affected.

CyberCode updates

Get practical updates on Philippine technology law, data privacy, cybersecurity, and AI.

Email activity tracking

Unsubscribe any time. See our privacy policy below.