In most companies, AI is already there: a salesperson writing emails with ChatGPT, an accountant summarising a contract, an assistant translating a document. Rarely with a shared rule. This is called "shadow AI": AI used outside any framework.
The risk is not the usage, it is the absence of a rule: leaks of confidential information, personal data entered into a public tool, false text published without review, protected content reused unknowingly.
A usage policy sorts this out without blocking your teams. It also meets the European regulation's requirement for AI literacy (see our article on the AI Act).
rules for a policy that fits on one page
human review before any publication
The template: ten rules to adapt
- 1. Approved tools — A list of the AI tools approved by the company, with their intended use. Any other tool requires prior approval.
- 2. Prohibited data — Never in a public tool: personal data of customers or employees, unpublished financial information, trade secrets, confidential contracts, passwords, source code.
- 3. Business accounts — Company accounts are used, not personal ones, so that privacy settings can be controlled.
- 4. Mandatory human review — Any content produced with AI and intended for a customer, a contract, the public or a decision is reviewed and approved by a competent person.
- 5. Fact and source checking — Figures, quotations, references and legal or technical claims are checked at the source before being used.
- 6. Transparency — In the cases provided for (published content, communication with a customer, official document), it is stated when AI was involved.
- 7. Respect for rights — No reproduction of protected content, no images of people without consent, and no imitation of anyone's voice or likeness.
- 8. Decisions about people — No decision on hiring, evaluation, disciplinary action or the granting of a service rests solely on an AI. A human decides and can explain the decision.
- 9. Reporting — In the event of a serious error, a leak or a doubt, the designated person is informed immediately, without fear of blame.
- 10. Training and updates — Every employee is trained in the use of AI, and the policy is reviewed regularly.
How to adapt it to your company
- Start with an inventory — Which tools are actually used, by whom, and for what? A short anonymous questionnaire is enough, without looking for someone to blame.
- Distinguish risk levels — Drafting an email does not carry the same stakes as summarising a contract or processing health data.
- Appoint a point person — Someone who can answer questions and receives reports.
- Choose suitable tools — Professional offerings generally state whether or not your data is used to train the models. Read the terms.
- Keep it short — One page that gets read is worth more than ten pages that get ignored.
The legal framework to keep in mind
- The GDPR — Any processing of personal data by an AI tool requires a legal basis, information for the individuals concerned, a contract with the supplier and security measures.
- The AI Act — Article 4 requires companies that use AI systems to take measures to ensure their staff have a sufficient level of AI literacy. A policy and training are good evidence.
- Trade secrets and contractual obligations — You may have promised a customer not to share their documents with a third party.
This template is a working basis and does not replace legal advice. For sensitive uses, have your policy validated by a lawyer.
A policy is not enough: it has to be brought to life
A policy filed away in a folder has no effect. It must be presented, explained, illustrated with concrete cases and regularly recalled. That is the purpose of our "recognising AI" training: we build the policy with you, present it to your teams and work through practical cases drawn from your daily work.
To go further on the risks linked to AI errors, read our guide on hallucinations.
Your questions about the AI usage policy
Does an SME need an AI usage policy?
If employees use AI tools, yes: it is the way to protect data and to show that you are managing AI responsibly. It can fit on a single page.
Can you ban ChatGPT for employees?
You can restrict the use of public tools, but a total ban is hard to enforce and pushes usage into the shadows. It is better to provide approved tools, clear rules and training.
What data should never go into a public AI tool?
Personal data of customers or employees, confidential or unpublished financial information, trade secrets, passwords and proprietary source code.
Who should write the policy?
Management, with a point person and representatives of the teams, ideally supported by a lawyer. A policy developed with its users is applied far better.
Set the rules before an incident does it for you.
We build your policy with you and train your teams to apply it.