AI policy for companies: getting started pragmatically and effectively
An AI policy shouldn’t stop employees from working sensibly. It creates a clear framework: which tools are allowed, which information stays out and when does a person have to check or decide? That turns isolated experiments into traceable use in everyday work.
Short answer
A usable AI policy names approved tools and purposes, governs how data is handled, requires professional review of important results and assigns responsibilities. It should be short enough for teams to apply and specific enough that it is clear who decides when in doubt.
The assessment at a glance
Allow
For clearly defined tasks such as drafts, summaries, brainstorming or structuring non-sensitive content.
Important: Use only approved accounts and tools; the purpose and responsible person must be traceable.
Review
When a result affects customers, contracts, quotes, professional statements or internal decisions.
Important: AI output is a draft. Professional accuracy, sources, tone and consequences are always checked by a responsible person.
Refrain or get approval
With personal, confidential or particularly sensitive information and with new, unclear use cases.
Important: Don’t just copy it into a public tool. First clarify data flow, legal basis, access rights and approval.
Why a short policy is better than a blanket ban
Employees often already use AI for research, drafts or summaries. A blanket ban easily shifts that use into private accounts and makes it invisible. A clear policy, by contrast, creates a safe route for sensible tasks and a stop line for risky cases.
It is not a legal opinion and does not replace an assessment of the individual case. But it ensures that not every team member has to interpret data protection, quality and responsibility on their own.
The six building blocks of a practical AI policy
The best start is a document of one to two pages, supplemented by a contact person. It doesn’t have to anticipate every future tool. It has to make the recurring everyday decisions unambiguous.
- Approved tools and accounts: which services and company accounts may be used for which tasks?
- Permitted use cases: which recurring tasks are uncritical and explicitly welcome?
- Data rules: which customer, personnel, contract or access data must never be entered without a clarified process?
- Review duty: who checks content, figures, sources, decisions and communication before results are used?
- Responsibility and approval: who decides on new use cases, problems or exceptions?
- Training and updates: how are teams introduced, and how is the policy adapted for new tools?
Don’t judge data by gut feeling
The most important sentence for everyday work is: not every piece of information belongs in an AI tool. Whether a specific use is permissible and sensible depends, among other things, on the service used, the contract, the data flow, the purpose, access rights and the people affected. With personal or confidential information in particular, a route clarified in advance is therefore needed.
In practice a simple traffic-light system helps: public and already approved material may be used for a permitted purpose. Internal information is only processed in systems approved for it. Personal, contract, access and particularly sensitive data stay out until the specific case has been reviewed and approved.
Human review is not an optional last step
A plausibly worded text can be factually wrong, incomplete or unsuitable for the context. For quotes, customer communication, calculations, legal or professional statements, it must therefore always be clear who is responsible for the result. AI can prepare; responsibility is not handed on automatically.
This rule also protects quality: a good team uses AI to get to a first draft faster and invests the time gained in review, professional assessment and better decisions.
From paper to practice: a sensible first month
Start with a few clear use cases and a small group of employees. Document what works well, where questions arise and which data flows are actually needed. Only then are tools or automations rolled out more widely.
- Week 1: identify existing use, processes and sensitive data.
- Week 2: define two to three permitted pilot use cases and the data rules.
- Week 3: introduce the team, practise examples and name a contact person.
- Week 4: evaluate results, error cases and open questions; refine the policy.
Why training and context belong to it
The European AI Act requires providers and deployers of AI systems to take measures, in their respective context, to ensure a sufficient level of AI literacy among the people involved. What is appropriate depends on the use, prior knowledge and possible effects.
For small companies this does not automatically mean a large compliance project. However, a documented introduction tailored to the actual tools and tasks is considerably more robust than a vague instruction to use AI “carefully”. In cases that are sensitive in terms of data protection or employment law, expert advice should be involved.
From insight to a concrete decision
We look at your starting point and clarify whether and where an implementation really makes sense.