AI usage policy for companies — with a template

Why write it now?

For three reasons, and two of them aren’t legal.

The first is data. Whatever someone pastes into an AI tool leaves the company and goes to an outside provider. What happens to it there — whether it is stored, whether it is used to train the model — depends on the tool and the type of account. Individual free accounts and business plans typically differ on this. Without a rule, an employee doesn’t weigh any of that; they simply paste in the customer’s details because it’s quicker.

The second is shadow AI. Where there is no rule, either everyone experiments on their own initiative, or — if management only says “don’t use it” — they do it in secret. Both end in the same place: you don’t know which tools are running in your operation, or who is using them for what.

The third is the EU AI Act. Since 2 February 2025, every company that uses an AI system has had to take measures to ensure AI literacy among its staff — so that they understand what the tool does, what it is not good for, and when a human has to decide. The regulation prescribes no particular form: there is no mandatory course and no certificate. The test is whether what you do is proportionate to how you use AI, and whether it is documented. A written policy that your team has been walked through is one of the simplest, most tangible ways to show that — not the only one, but a good starting point.

For more detail on which parts of the regulation apply to a Hungarian SMB: The EU AI Act for Hungarian SMBs.

What a policy solves, and what it doesn’t

It makes sure everyone works from the same rules: which tools can be used, what data can go into them, and what has to be checked before AI-assisted material leaves the company.

What it won’t solve is not knowing where you use AI today. The policy is built on that inventory; it doesn’t replace it. Nor does it replace legal advice when you have to decide about a specific system — whether it counts as high-risk, for example.

What should it cover?

Eight parts, most of them a paragraph or two.

1. Who and what it covers

Every employee, subcontractor and intern working on the company’s behalf, and every AI tool — both the ones officially introduced and the ones someone started using on their own. That last part is the point: the policy works because shadow AI falls within its scope too.

2. List of approved tools

A short list, by name: which tool, with which type of account (business or personal), and for what. Anything not on the list needs approval first. Don’t hard-code the list into the policy text; keep it as an annex, because it changes more often than the policy itself.

3. What data can go in, and what can’t

This is the most important part of the policy. It helps to think in three categories:

• —Free to use: public information, your own non-confidential working material, general questions.
• —Only with an approved business account: internal documents, quotes, non-personal business data.
• —Prohibited: personal data (customers, staff, candidates), trade secrets, passwords, access credentials, and anything covered by a confidentiality obligation.

For personal data, the GDPR applies anyway: if you pass it to an outside provider, you need a legal basis and a contract behind it. The policy doesn’t solve that; it only stops someone from doing it without thinking.

4. Human review

Anything made with AI that leaves the company — a letter to a customer, a quote, a draft contract, published text — is reviewed by a person before it goes out. AI can be wrong with complete confidence: it can invent a figure, a name, a legal reference. Responsibility stays with whoever sends it.

5. Transparency towards customers

If an AI system of yours talks directly to a customer or an employee — a chatbot on your website, for example — the other party has to know they are talking to a machine, unless that is obvious anyway. This has been mandatory since 2 August 2026, with no grace period. The same goes for artificially generated content depicting real people, places or events: it has to be labelled.

6. What we don’t use it for

It is worth stating what the company does not use AI for. For an SMB, two things typically matter:

• —Decisions about people. Recruitment, CV screening, performance reviews, monitoring employees: under the EU AI Act these are high-risk areas, and the rules for them apply from 2 December 2027. Until then, a sound principle is that a human makes these decisions and AI at most prepares them.
• —Emotion recognition in the workplace. This has been prohibited since 2 February 2025 (except for medical or safety purposes). A company rarely walks into it deliberately; it usually arrives as a feature of a tool it bought — worth asking the vendor.

7. Owner and reporting

One named person who keeps the list, approves new tools, and whom people can tell when something has gone wrong — say, someone pasted in customer data after all. In a small company, this can be the managing director. What matters is that it has a name, not just a role.

8. Training and review

Everyone gets to know the policy and receives a short introduction to the approved tools: what they are good for, what they aren’t, and where they typically go wrong. New joiners in their first week. This also serves as documentation of the AI literacy obligation: it is worth recording who received it and when.

And the policy itself is worth revisiting once a year, or whenever a new tool is introduced. AI tools change faster than most company rules.

What to leave out

• —A blanket ban. A “no AI whatsoever” rule doesn’t get followed; it just moves the use out of your sight.
• —A multinational’s thirty-page policy. If an employee at a 15-person company won’t read it to the end, it regulates nothing. Two or three pages are enough.
• —Click-by-click instructions for specific tools. That belongs in training, not in the policy, and it goes out of date every six months.

How to roll it out

1. 01Start with the inventory. Ask the team — without judgement — who uses which AI tools, and for what. That becomes the first version of the annex.
2. 02Adapt the template to your company. Strike out whatever doesn’t apply to you, and fill in the bracketed parts.
3. 03Walk the team through it in a short meeting. A half-hour conversation is worth more than a circular email, and it shows straight away what isn’t clear.
4. 04Make it easy to find. Put it where the team already works, not deep in some folder.