An AI policy for your company: a structured guide
An AI policy is an internal set of rules that specifies which AI tools are permitted in the company, which data may be entered into them, how new tools are approved and how employees are trained. It does not need thirty pages: for an SME, a few clearly worded chapters that everyone in the company understands are enough. This guide provides the structure for you to adopt – section by section.
In brief
- An AI policy regulates four key questions: which tools are permitted? What must not be entered? How do new tools get onto the list? How are employees trained?
- The EU AI Regulation obliges companies that use AI to take measures to promote the AI literacy of their staff – a policy together with training is the obvious evidence.
- Without a policy, you do not get an AI-free company but uncontrolled growth: employees then use tools in an unregulated way via private accounts.
- The prohibited list is the heart of it: personal data, trade secrets and login credentials have no place in unverified tools.
- A policy only works if it is short, easy to find and covered in training – and if it offers a permitted alternative instead of just prohibiting.
Why does an SME need an AI policy at all?
Because AI is already being used – with or without rules. Texts are worded with language assistants, emails summarised, translations produced. Without guidelines, this happens via private accounts and free versions where neither the contractual basis nor what happens to the data has been clarified. The company bears the risk: if personal data ends up in an unverified tool, that is a data protection problem for the company, not for the individual employee.
There is also a legal development: since the new version of Art. 4 introduced by Regulation (EU) 2026/1744 (in force since 27 July 2026), the EU AI Regulation (often called the “AI Act”) requires companies that use AI systems to take measures to promote the AI literacy of their staff; a particular level does not have to be guaranteed. What this evidence must look like in concrete terms has deliberately been left open – a documented policy plus training is the obvious and common route. The GDPR also has an influence: anyone who enters personal data into an AI tool needs a basis for doing so and usually a data processing agreement (DPA) with the provider. An overview of how AI use and data protection fit together in Austria is given in the article AI and the GDPR in Austria. This guide provides general orientation and does not replace legal advice in an individual case; the Austrian Economic Chamber (WKO, wko.at) also provides continuously updated information on the AI Regulation.
What structure does a good AI policy have? The outline to adopt
The following outline has proven its worth for SMEs. You can use it one-to-one as a framework and fill it with the circumstances of your company:
- Purpose and scope. One paragraph: the policy regulates the use of AI tools in the company and applies to all employees and all work activities – including on private devices as soon as company data is involved.
- Permitted tools (whitelist). A concrete list of approved tools together with their purpose: which tool for texts, which for translations, which internal knowledge base for questions about company processes. Important: only via company accounts, never via private accounts. Anything not on the list is considered not approved.
- Prohibited input. A clear statement of which content does not belong in any external AI tool – for details see the next section. This list is the part every employee should know by heart.
- Approval process for new tools. Who reviews new requests, and according to which criteria? Proven criteria: server location and what happens to the data, data processing agreement (DPA), exclusion of the use of company data to train third-party models, access control. A simple “tool request” form lowers the threshold for asking officially instead of using tools secretly.
- Handling AI results. AI outputs are drafts, not truths: a duty to check the content before use, particular caution with figures, names and legal statements, labelling where agreed or required. With tools that provide sources, the source should be opened on a spot-check basis.
- Training and AI literacy. Who is trained when and how – basic training for everyone, a short refresher when things change, induction for new employees. Document attendance; this is at the same time the evidence of the promotion measures under Art. 4 of the AI Regulation.
- Responsibilities and contact person. A named person for questions, approvals and incidents. In small companies, this is often management itself – what matters is that everyone knows whom to turn to.
- Breaches, exceptions, updates. What happens in the event of breaches (clarification first, not punishment), how exceptions are approved, when the policy is reviewed. A fixed annual date prevents the document from becoming outdated.
Which input belongs on the prohibited list?
The prohibited list should be worded concretely and with examples – abstract categories alone do not help in everyday work. As a grid:
| Category | Examples | Why critical |
|---|---|---|
| Personal data | Names, addresses, health data, salary data of customers, employees, applicants | GDPR: no processing without a basis and a contract with the provider |
| Trade secrets | Cost calculations, formulations, design data, strategy and pricing documents | Protection as a secret requires appropriate confidentiality – entering it into third-party systems can jeopardise this protection |
| Contract and customer content | Quotes, contracts, correspondence with customers | Confidentiality obligations towards business partners |
| Login credentials and system information | Passwords, keys, internal network details | Security risk, regardless of data protection |
Differentiated rules may apply to approved tools with a verified contractual basis – for example that an internal knowledge base with EU data storage may well process company documents, but a public free chatbot may not. The policy should make exactly this distinction explicitly; otherwise it comes across as a blanket ban and is ignored.
How does the policy stay alive instead of remaining on paper?
Three things determine whether an AI policy works or gathers dust in the filing cabinet.
First: a permitted alternative. If you only prohibit, you create shadow use via private mobile phones. If you offer an approved, good solution – such as an internal knowledge base that answers questions from your own company documents – you give the team a legitimate route that is more convenient than the secret one.
Second: training in everyday language. One hour with real examples from your own company achieves more than ten pages of legalese. Show concretely: this request is fine, this one is not – and why.
Third: findability. The policy has to be where the work is done. It is most effective when employees can ask it questions like a colleague: “May I put the draft of a customer quote into the translation tool?” An AI knowledge base answers such questions directly from your own policy – with sources, so that anyone can read up on what the answer is based on. This turns the document into lived practice, and changes take effect for everyone immediately.
The next step is manageable: draft the eight outline points as a rough version – two to four pages are enough – and discuss them with the people who already use AI today. How you can then make the policy, manuals and the rest of your company knowledge searchable in one central place is shown on the page Process of the rollout.
Frequently asked questions
Is an AI policy required by law?
There is no explicit obligation along the lines of “every company needs an AI policy”. However, the EU AI Regulation requires measures to promote AI literacy among staff, and the GDPR requires personal data to be handled in a regulated way. A written policy is the most practical way to organise both in a traceable manner.
How long should an AI policy be?
As short as possible. For an SME, two to four pages have proven their worth: scope, permitted tools, prohibited input, approval process, handling of results, training, contact person. A document nobody reads protects nobody.
Which input belongs on the prohibited list in an AI policy?
Personal data of customers, employees and applicants, trade secrets such as cost calculations and formulations, contract contents and login credentials – at any rate for all tools without a verified contractual basis. Differentiated rules may apply to approved tools with a data processing agreement (DPA).
Who in the company should draw up the AI policy?
Management together with the people who actually use AI in everyday work – with external support on data protection questions if needed. A policy that is worded without regard to practice will be circumvented rather than followed.
How often does an AI policy need to be updated?
The tool list continuously, as soon as tools are approved or removed; the basic framework at least once a year. A fixed date makes sense, for example in January, plus an ad hoc review in the event of new legal requirements or incidents.