AI usage policy for SMEs: rules for a small team

One responsible point. Name one person or role as the AI coordination point. In a small business, this is often the owner or the office manager. This person does not need technical expertise. But they collect all requests for new tools, keep the inventory and know whom to ask about a legal question.

Why one person is enough. Without a fixed responsibility, accounts with different providers appear that nobody tracks. One person can ask early: Is there a contract? Which data goes in? Who checks the results? Also record who stands in for the coordinator during holidays or illness.

The inventory is a simple table. It covers not only large projects but also writing assistants, translations, transcriptions and AI features in existing software. The table below shows six columns and the question each column answers.

The columns are our practical recommendation, not a list required by law. But the inventory supports several duties: the contract under Art. 28 GDPR, the classification under the AI Act and the training under Art. 4. An inventory that nobody maintains does not help much. Make it a rule that every change to a tool goes into the table first.

The approval step. A new tool goes into productive use only after a short approval by the AI coordination point. Until then, the team tests only with invented or publicly available data. Real data goes only into approved systems. This rule is easy to explain and easy to check.

What to clarify before approval. Check the plan and the provider's contract terms. If the service processes personal data on your behalf, Art. 28(3) GDPR requires a contract with specified content (GDPR on EUR-Lex). For services such as ChatGPT, Microsoft 365 Copilot, Claude or Mistral, the terms differ by plan. Our article on ChatGPT for business and the GDPR shows these differences for one provider.

New review after changes. An approval applies to the described purpose. If the team later wants to use a tool for a new task, new types of data or automatic actions, that needs a new approval.

A general rule such as “do not enter sensitive data” leaves too much open. Describe concretely what is allowed with which tool and when someone must ask first. The table below shows an example with three levels.

The examples have a legal basis. Art. 9 GDPR protects special categories of personal data, for example health data. Art. 22 GDPR gives people the right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects, with exceptions set out in law (GDPR on EUR-Lex). The three levels are our recommendation. Adapt the examples to your sector. In professions with a duty of confidentiality, additional rules can apply.

Art. 4 AI Act requires providers and deployers to take measures that support the development of AI literacy among their staff. It does not require a guarantee of any specific level of literacy for any individual (Art. 4 at the AI Act Service Desk). The training should follow the approved tools and the real tasks. A person who prepares invoices with AI needs different exercises from a person who answers customer requests. The policy itself is good training content: Which tools are approved, which data may go in, and whom do you ask? More in our article on AI literacy under Art. 4 AI Act.

The AI Act sets duties according to the intended use. For a small business that uses ready-made tools, three questions matter most. You find the application dates in our article on the EU AI Act for SMEs.

Prohibited practices. Art. 5(1)(f) prohibits AI systems that infer the emotions of a person in the workplace or in education institutions. Systems intended for medical or safety reasons are excepted (Art. 5 at the AI Act Service Desk). So also check add-on features of meeting or call-centre software that analyse mood or emotions.

High-risk uses. Annex III point 4 lists AI systems for the recruitment or selection of people, in particular to analyse and filter job applications and to evaluate candidates. It also lists systems for decisions on promotion or termination, for allocating tasks based on individual behaviour and for monitoring and evaluating performance and behaviour (Annex III at the AI Act Service Desk). Art. 6 contains conditions under which such a use is nevertheless not considered high-risk. This needs a case-by-case check. Employers that use a high-risk system at the workplace must inform workers' representatives and the affected workers first (Art. 26(7)).

Other office tasks. Drafting texts, summarising documents or translating is listed neither in Art. 5 nor in Annex III. For such uses, the main AI Act duties for the business are Art. 4 and, depending on the use, the transparency duties under Art. 50. Data protection, employment law and copyright apply independently.

Art. 50 AI Act has applied since 2 August 2026 and contains several separate duties (Commission FAQ on Art. 50).

Chatbots. Under Art. 50(1), providers must design AI systems that interact directly with people so that the people are informed that they are interacting with an AI system, unless this is obvious (Art. 50 at the AI Act Service Desk). A chatbot on your website or a phone assistant should therefore identify itself as AI at the start. Whether your business is the provider or the deployer depends on the specific setup.

Published texts. Under Art. 50(4), deployers must disclose that a text is AI-generated if it is published with the purpose of informing the public on matters of public interest. The duty does not apply if the text has undergone human review or editorial control and a person holds editorial responsibility. According to the Commission guidelines on Art. 50, a spelling or formal check is not sufficient. The review must engage with the content, with fact-checking as a minimum (paragraphs 134 and 135).

Business emails. The guidelines name private interpersonal correspondence, also for professional purposes, and organisation-internal texts as examples of texts that are not published (paragraph 131). An email to a customer that a person writes with AI help and sends personally is therefore not covered by Art. 50(4). The guidelines also exclude from Art. 50(1) the case where staff use an AI assistance tool to communicate with people (paragraph 30). This can be different if an AI agent writes and sends emails itself. For this case, the guidelines give an AI label at the top of the email as an example (paragraph 36).

Recording and transcribing meetings. A recording processes personal data and needs a legal basis under Art. 6 GDPR. The German Data Protection Conference states in its guidance on video conferencing systems that the legal basis for recordings must be examined separately. Without a specific documentation requirement, a separate consent to the recording is regularly needed. In addition, recording non-public spoken words can be a criminal offence, for example under Section 201 of the German Criminal Code or Section 120 of the Austrian Criminal Code. So before you use a transcription tool, check the legal basis and inform all participants before the start.

Copyright and licences. Before an upload, check whether the licence terms allow use in an AI tool. This applies especially to purchased or licensed material, for example technical standards, specialist databases or studies. Some licences exclude copying into third-party systems or machine analysis. If the terms are unclear, ask the rights holder before you upload the material.

Expert review. A person who understands the subject checks every result that leaves the business or prepares a decision. Language models can produce confident answers with wrong content. They can also fail at tasks that look simple, for example counting the letters in a word. A well-written text is therefore no proof of correct figures, names or deadlines.

Aids for the review. A checklist with the most important fields helps, for example recipient, amounts, dates and sources. A second model can check a draft for contradictions and raise questions. Both aids find errors, but not all errors. The responsibility for the result stays with the person who approves it.

Own instructions for each person. Many tools offer permanent personal instructions, for example custom instructions in ChatGPT or personalisation in Claude. Let each person write their own profile for their role, instead of one shared profile for everybody. Accounting needs different instructions from sales. Good content is: role, typical tasks, the preferred form of the answer and the rule not to invent information.

Questions first, then work. For larger tasks, ask the tool to ask its questions first and to start the work only after that. This way you clarify missing information before a long draft is built on wrong assumptions.

Per-user subscriptions are easy to plan. With usage-based billing, costs depend on the number of tokens processed. Agents that carry out many steps on their own and long tasks with large documents can use many tokens. Set a budget for every usage-based account, use spending limits where the provider offers them, and check usage at fixed intervals. The AI coordination point records the costs in the inventory.

The table below is a template for a one-page AI usage policy. It lists ten rules, the responsible role and how each rule is checked. Adapt the roles and intervals to your business.

Add the training under Art. 4 to the template. Record who received instruction on which tool and when.

No. This article gives a general overview based on the linked official sources, as of 3 October 2026. It does not replace legal advice or a review of your specific use. Depending on the country, sector and tool, further rules can apply, for example from employment law, professional rules or national data protection law. Have uses with HR data, job applications or special categories of data reviewed by a qualified person.

These articles cover the adjacent legal questions in more detail:

• EU AI Act for SMEs: duties and current deadlines
• AI literacy under Art. 4 AI Act: what SMEs must do after the omnibus
• ChatGPT for business: GDPR, licences and costs for SMEs
• AI in tax firms and the duty of confidentiality