An AI use policy for your business: the minimum you have to write down
Your team is already using AI, with or without permission. What a policy that gets read and followed has to say, why banning it does not work and what training duty already applies in Europe.
· Applied AI training
Let us start with the uncomfortable fact: AI is already being used in your business. Somebody pastes text into a chat to write it better, somebody summarises a long document, somebody translates an email. It happens from a phone, on personal accounts, and nobody knows.
The decision, then, is not «whether we allow AI». It is whether that happens with rules or without them.
Why banning it does not work
A blanket ban has a predictable effect: use moves to the personal phone, outside any control. You lose visibility, you lose the chance to provide safe tools, and you keep all of the risk.
What does work is the opposite: offer an approved tool, say clearly what may and may not go into it, and train people.
What the policy has to say (and it fits on two pages)
1. Which tools are approved
A short, concrete list, with the corresponding company account. And who decides when a new one joins it. If the list is empty, the team will use whatever it finds.
2. What data NEVER goes in
This is the most important section and it has to be a list, not an abstract principle:
- Identifying data of customers or workers: names, identity documents, addresses, bank accounts.
- Health data, data on minors or any special category.
- Credentials, keys, tokens.
- Documents subject to contractual confidentiality.
- Unpublished code or information that is the core of the business.
And the useful counterpart: how those cases get worked on without grinding to a halt. Replace names with codes before pasting the text, work on the pseudonymised document and put the data back at the end. A minute of work that removes most of the risk.
3. What always gets reviewed before it is used
Anything going outwards — to a customer, a publication, a public body — is read by a person. And every figure heading for an official document is calculated and checked with the appropriate tool. AI drafts; it does not sign.
4. What gets labelled
When you have to state that content was produced with AI assistance. For customer-facing content it is, besides honest, a growing obligation.
5. Who answers the questions
A named person. A policy with nobody to ask becomes a document nobody consults.
The duty that already applies in Europe
The European AI Regulation brings in a duty of AI literacy: providers and deployers of AI systems must take measures to ensure a sufficient level of knowledge among their staff, taking into account their training, their context and the people the systems are used on.
It is worth being precise about its scope, because a lot of alarm circulates: it is an obligation of means — to train — not a direct penalty regime under that article. And the Regulation's general calendar was amended by the European digital simplification package, so the specific dates have to be checked in the version in force and not in an article from a year ago.
The current position, with what already binds and what was deferred, is in the AI Regulation in Spain.
The practical reading: a small business meets this part with documented basic training and a written policy. You do not need a sophisticated compliance programme; you need to be able to show that something was done and when.
The three mistakes when writing it
- Copying a template off the internet. It shows, it does not fit your tools and nobody reads it.
- Writing it in legalese. If the team does not understand it, they will not apply it. Short sentences and real examples from your own day.
- Publishing it and forgetting it. With no short training and no periodic review, in six months the approved tool list is out of date.
How to roll it out in a week
- Ask what is already being used, with no penalties. You need the real map, not the official one.
- Pick one or two tools and buy the company accounts, with their processing terms reviewed.
- Write the two pages with the five sections above.
- Run a one-hour session with real cases from the team. Record who attended and when.
- Review it every six months, or sooner if the tools change.
If this sounds like you
The policy written to fit your tools, the training session and the documentary record are AI training for teams; the approach to what to teach first is in what to teach and in what order. If you also handle customer data with AI, the legal side is in AI and data compliance and in using AI with customer data within the law.
And to decide which tasks are worth using it on — and which are not — ten real uses of generative AI.
We are Mindset & Code: automation, data and development for small businesses. You can see what we do and what it costs.
Sources: Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence, art. 4 (AI literacy); its application calendar was subsequently amended and must be consulted in the version in force. General guidance; it does not replace legal advice.