An AI policy for your company: a structured guide
An AI policy is a set of internal rules that states which AI tools are allowed in the company, what data may be entered into them, how new tools are approved and how employees are trained. It doesn’t need thirty pages: for an SME, a few clearly written sections that everyone in the company understands are enough. This guide gives you a structure you can adopt section by section.
In brief
- An AI policy answers four key questions: which tools are allowed? What must not be entered? How does a new tool get onto the list? How are employees trained?
- The EU AI Regulation requires companies that use AI to take measures to promote their staff’s AI literacy – a policy combined with training is the obvious way to show you have done so.
- Without a policy, you don’t end up with an AI-free company but with a free-for-all: employees use tools without any rules, through private accounts.
- The prohibited list is the core of the policy: personal data, trade secrets and login credentials have no place in unverified tools.
- A policy only works if it is short, easy to find and covered in training – and if it offers an approved alternative rather than simply banning things.
Why does an SME need an AI policy at all?
Because AI is already in use – with or without rules. People draft texts with writing assistants, summarise emails and produce translations. Without guidance, this happens through private accounts and free versions, where nobody has checked the contractual basis or what happens to the data. The risk lies with the company: if personal data ends up in an unverified tool, that is a data protection problem for the company, not for the individual employee.
The law is moving, too. Since Regulation (EU) 2026/1744 introduced a new version of Art. 4 (in force since 27 July 2026), the EU AI Regulation (often called the “AI Act”) has required companies that use AI systems to take measures to promote their staff’s AI literacy; they do not have to guarantee any particular level. The regulation deliberately leaves open what the evidence should look like – a documented policy plus training is the obvious and most common route. The GDPR plays a part as well: anyone who enters personal data into an AI tool needs a legal basis for doing so and usually a data processing agreement (DPA) with the provider. The article AI and the GDPR in Austria gives an overview of how AI use and data protection fit together in Austria. This guide offers general orientation and is no substitute for legal advice on an individual case; the Austrian Economic Chamber (WKO, wko.at) also publishes regularly updated information on the AI Regulation.
What should a good AI policy include? An outline to adopt
The following outline works well for SMEs. You can use it as it stands and fill it in with the details of your own company:
- Purpose and scope. One paragraph: the policy sets the rules for using AI tools in the company and applies to all employees and all work – including on private devices whenever company data is involved.
- Approved tools (whitelist). A specific list of approved tools and what each is for: which tool for texts, which for translations, which internal knowledge base for questions about company processes. Important: company accounts only, never private ones. Anything not on the list counts as not approved.
- Prohibited input. A clear statement of which content does not belong in any external AI tool – see the next section for details. This is the list every employee should know by heart.
- Approval process for new tools. Who reviews requests for new tools, and on what criteria? Criteria that work well: server location and what happens to the data, a data processing agreement (DPA), a guarantee that company data won’t be used to train third-party models, and access control. A simple “tool request” form makes it easier to ask officially rather than use tools on the quiet.
- Working with AI output. AI output is a draft, not the truth: content must be checked before use, with particular care over figures, names and legal statements, and labelled where agreed or required. Where a tool cites sources, people should open the source now and then to check it.
- Training and AI literacy. Who is trained, when and how – basic training for everyone, a short refresher when things change, induction for new starters. Keep a record of who attended; this also serves as evidence of the measures required under Art. 4 of the AI Regulation.
- Responsibilities and contact person. A named person for questions, approvals and incidents. In small companies this is often the management – what matters is that everyone knows whom to ask.
- Breaches, exceptions, updates. What happens if someone breaches the policy (clarify first, don’t punish), how exceptions are approved and when the policy is reviewed. A fixed annual date stops the document from going out of date.
Which input belongs on the prohibited list?
Make the prohibited list specific and give examples – abstract categories alone are no help in day-to-day work. As a framework:
| Category | Examples | Why it matters |
|---|---|---|
| Personal data | Names, addresses, health data, salary data of customers, employees, applicants | GDPR: no processing without a legal basis and a contract with the provider |
| Trade secrets | Cost calculations, formulations, design data, strategy and pricing documents | A secret is only protected if it is kept appropriately confidential – entering it into third-party systems can put that protection at risk |
| Contract and customer content | Quotations, contracts, correspondence with customers | Confidentiality obligations towards business partners |
| Login credentials and system information | Passwords, keys, internal network details | Security risk, quite apart from data protection |
Approved tools with a verified contractual basis can be subject to more differentiated rules – for example, an internal knowledge base with data stored in the EU may well process company documents, whereas a free public chatbot may not. The policy should spell out this distinction; otherwise it reads as a blanket ban and gets ignored.
How do you keep the policy alive rather than just on paper?
Three things decide whether an AI policy works or gathers dust in a filing cabinet.
First: an approved alternative. If all you do is ban things, people will use AI on the quiet on their private phones. If you offer a good, approved solution – such as an internal knowledge base that answers questions from your own company documents – you give the team a legitimate route that is more convenient than the hidden one.
Second: training in plain language. One hour with real examples from your own company achieves more than ten pages of legalese. Show people exactly which request is fine, which isn’t – and why.
Third: easy to find. The policy needs to be where the work happens. It works best when employees can ask it questions as they would a colleague: “Can I put the draft of a customer quotation into the translation tool?” An AI knowledge base answers questions like this straight from your own policy – with sources, so anyone can check what the answer is based on. That turns the document into everyday practice, and any changes apply to everyone immediately.
The next step is manageable: draft the eight points of the outline in rough – two to four pages are enough – and discuss them with the people who already use AI today. The How it works page shows how you can then make the policy, your manuals and the rest of your company knowledge searchable in one central place.
Frequently asked questions
Is an AI policy required by law?
No law says in so many words that “every company needs an AI policy”. However, the EU AI Regulation requires measures to promote AI literacy among staff, and the GDPR sets rules on how personal data is handled. A written policy is the most practical way to cover both and to show what you have done.
How long should an AI policy be?
As short as possible. For an SME, two to four pages work well: scope, approved tools, prohibited input, approval process, how to treat AI output, training and a contact person. A document nobody reads protects nobody.
Which input belongs on the prohibited list in an AI policy?
Personal data of customers, employees and applicants, trade secrets such as cost calculations and formulations, contract contents and login credentials – certainly for any tool without a verified contractual basis. Approved tools with a data processing agreement (DPA) can be subject to more differentiated rules.
Who in the company should draw up the AI policy?
Management, together with the people who actually use AI in their day-to-day work – with outside help on data protection questions if needed. A policy written without regard to how people really work will be circumvented rather than followed.
How often does an AI policy need to be updated?
The tool list whenever a tool is approved or removed; the overall framework at least once a year. A fixed date makes sense – January, for example – plus an extra review whenever the law changes or an incident occurs.