When you ask a team who uses AI at work, fewer hands go up than the number of people who actually use it. In a company of 20–30 people, 8–15 different AI tools are typically in use, mostly on free accounts, and management does not know about most of them. That on its own is not the problem. The problem is that there is not a single page anywhere saying what may be put into them and what may not.

Why a verbal agreement is not enough

A verbal rule fails on three counts. First, nobody can point to it. If someone pastes customer data into a free chatbot, there is nothing to measure that decision against afterwards. Second, it does not scale. A new joiner does not know the established practice, so they fall back on their own judgement. Third, Article 4 of the EU AI Act has, since February 2025, required AI literacy from anyone who uses AI on the company’s behalf, and in an inspection a short policy plus an attendance sheet is the simplest evidence you can produce.

A policy is not a legal shield, though. It is a working tool. A good policy is one a colleague can skim in three minutes and then know what they are allowed to do. A policy nobody reads protects you from nothing.

The seven chapters an SME needs

You do not need a forty-page document. Three to four pages with seven chapters covers the large majority of companies with 10–250 employees.

1. Scope and purpose. Who it applies to (employees, subcontractors, interns) and to what: all generative AI tools, not only the ones named.
2. Approved tools. A short list, and next to each the kind of data it may be used with. Have a one-sentence process for introducing a new tool.
3. Data classification. Three levels are enough: public, internal, confidential. Plus which level may go into which tool.
4. Human oversight. What may not leave the company without a person’s approval, even after an AI has drafted it.
5. Labelling and transparency. When you must tell a customer that AI was involved. The transparency rules in Article 50 of the AI Act have applied since 2 August 2026.
6. Roles. Who approves a new tool, who takes questions, who reports an incident.
7. Training and review. A short mandatory briefing on joining, and a one-hour review every six months.

Three sample paragraphs you can reuse

These are general wordings; adapt them to your own company. They do not replace a legal review, but starting from zero they will put you weeks ahead.

Data classification

Confidential data (customer names, contract prices, personal data, source code, business plans) may only be entered into a tool approved by the company and running on a business subscription. Confidential data must not be copied into a free or personal account. If you cannot decide which category something falls into, ask before you paste it.

Approved tools

The list of approved tools is held in the internal document store. Anyone may propose a new AI tool by email, stating what task, what data and what account they would use it with. A decision follows within five working days. Before approval, the tool must not be used with company data.

Human oversight

Text, calculations or code produced with AI may leave the company only once a named colleague has read and approved it. The approver is responsible for the content. A tool’s suggestion is never a justification, so „the AI wrote it“ is not an acceptable explanation for a faulty output.

What to leave out, and where a human is required

The most common mistake is a blanket ban. It does not work, it only makes the usage invisible: people carry on using AI, just from their phones, and they stop asking questions. The second mistake is a list of named tools. Six months later it is out of date and the policy loses its credibility. Think in categories, not in brand names.

The third mistake is a promise you cannot keep. If the policy prescribes monthly logging but nobody logs anything, that is worse than not writing it at all.

There are, however, a few areas where a human really does belong in the decision chain. Name them explicitly:

• Hiring and pay decisions. CV screening sits in the high-risk category under Annex III of the AI Act. An AI suggestion may at most rank candidates; a rejection is issued by a person.
• Price, quote, contract terms. AI can draft it, a person approves the number.
• Rejections, dismissals, closing a complaint. If a decision has to be justified to a human being, it has to be made by one.
• Finalising an accounting entry. A suggested posting is a good accelerator, but the close is a human responsibility.
• Medical, legal or safety advice to a customer. Here the cost of a wrong output is disproportionately high.

How much work it is, and when it pays back

Written as internal work, the policy typically takes 6–8 hours. In our experience the split looks like this. Treat it as a typical industry range, not a promise:

Step	Typical effort
Tool inventory and short interviews	2–3 hours
Writing the policy	3–4 hours
Management review and sign-off	1 hour
Introductory training (2×90 minutes)	3 hours per person

The payback usually does not come from reduced risk. It comes from the ad hoc questions. In a 30-person company the question „can I put this into ChatGPT?“ typically comes up 4–6 times a week, and clearing one up costs a manager 15–20 minutes. That is 60–120 minutes a week, or 4–8 hours a month. At an internal cost of 25 €/hour that is 100–200 € a month. The one-off 6–8 hours therefore tends to come back within one to two months, and onboarding new colleagues gets faster after that.

If you want to see what the number looks like for you, the calculator lets you run it on your own hours.

The first 30 days

1. Week 1: inventory. Ask team by team who uses which AI tool, and on what account. Do not punish, just collect. The list is always longer than you expect.
2. Week 2: draft. Write the three to four pages against the seven chapters. One chapter, one page at most.
3. Week 3: review. A management round plus one read from a data protection angle. If personal data is involved, get a legal eye on it here.
4. Week 4: publish and train. Two short sessions with practical examples from your own processes, and an attendance sheet. That sheet doubles as evidence for Article 4 of the AI Act.

After that, one hour every six months: update the tool list and fold in the questions that have come up. Do not plan for more, because it will not happen.

---

The policy is not the goal. It is the frame inside which automation can safely start. If you want to know which process is worth tackling first, see the other articles on the blog or the published prices.