Staff AI use policy template for small EU businesses (EU AI Act and GDPR starting point)
Short answer: the EU AI Act does not require a document called an "AI policy". But since 2 February 2025, Article 4 has required providers and deployers of AI systems to take measures so that staff who use AI on their behalf have sufficient AI literacy. For a small team, a one-page set of rules that people have read, plus a list of approved tools and a briefing date, is a simple, dated way to show what you did. Copy the template below, fill in the brackets, and review it every 6 months.
Why a one-page policy is worth 30 minutes now
- AI literacy (Article 4) and the banned practices (Article 5) have applied since 2 February 2025. Rules for general-purpose AI model providers have applied since 2 August 2025; those mainly concern the companies that build the models, not the businesses that use them.
- Transparency duties (Article 50) for chatbots and AI-generated content apply from 2 August 2026. Staff need to know when to tell people they are dealing with AI.
- GDPR still applies. Pasting customer or employee personal data into an AI tool is processing personal data. If the vendor processes it for you, you need a data processing agreement (GDPR Article 28) and a lawful basis.
For the full timeline, including what the Digital Omnibus on AI moved, see EU AI Act in 2026: what applies now. Official text: Regulation (EU) 2024/1689.
Before you write it: 5 facts to collect
- Which AI tools are paid for or switched on (SaaS invoices, Microsoft 365 / Google Workspace AI features, website chatbot)
- Which staff use free personal AI accounts for work
- Whether any tool touches hiring, credit, staff monitoring or biometrics (flag for a lawyer)
- Which vendors have a data processing agreement on file
- Who will own the policy (a named person, not "IT")
If you have not listed your tools yet, start with the SME AI inventory template.
The template (copy, edit, sign)
[COMPANY NAME] - Staff AI use policy Version [1.0] · Effective [DATE] · Owner [NAME, ROLE] · Next review [DATE + 6 months] 1. Purpose and scope This policy covers every employee, contractor and freelancer who uses AI tools (chat assistants, writing, image, transcription, coding or analytics tools) for [COMPANY NAME] work, on company or personal devices. 2. Approved tools Only these tools may be used for work: - [Tool 1] - for [purpose] - data allowed: [public / internal / personal data with DPA] - [Tool 2] - for [purpose] - data allowed: [...] Want a new tool? Ask [OWNER] first. It is added to our AI register before use. 3. You may use approved AI tools to - draft emails, posts and documents that you then check and edit - summarise public or internal non-personal material - brainstorm, translate and proofread - [other approved uses] 4. You must not - paste customer, employee or supplier personal data, passwords, bank details or confidential contracts into any tool not marked "personal data with DPA" above - use AI to decide on hiring, firing, pay, credit or customer eligibility without a named person reviewing the decision; raise any such use with [OWNER] first - use AI to manipulate people, exploit vulnerabilities, score people socially or read emotions at work (these uses can be banned under the EU AI Act) - present AI output as checked fact, legal, tax or medical advice without review - sign up for new AI tools with a company email without approval 5. Human check A person reads and corrects every AI output before it goes to a customer, a public channel, an authority or a contract. The person who sends it is responsible for it. 6. Telling people about AI - Our website or support chatbot tells users they are talking to an AI. - Images, audio or video made or edited with AI that could look real are labelled. - If unsure, ask [OWNER]. 7. Mistakes and incidents Report wrong, harmful or leaked AI output, or personal data pasted by mistake, to [OWNER] the same day. No blame for honest reports. 8. Training (AI literacy) Everyone who uses AI for work reads this policy and attends a short briefing on how our tools work, their limits and these rules. Dates are recorded below. 9. Review [OWNER] reviews this policy every 6 months and whenever we add an AI tool. Read and understood: Name ______________ Role ______________ Date ______________ Signature __________
How to roll it out in one week
- Day 1: fill in sections 2 and 3 from your tool list. Keep it to one page.
- Day 2: check each approved tool's data terms and note which ones have a data processing agreement.
- Day 3: run a 20-minute briefing: what each tool is for, where it goes wrong (made-up facts, outdated answers, bias), and the "must not" list.
- Day 4–5: collect signatures and record the briefing date per person.
- Ongoing: every new tool goes through section 2 before anyone uses it.
What to keep as evidence
| Record | Why it helps |
|---|---|
| Signed policy, dated, with version number | Shows the rules staff were given and when |
| Briefing date and attendees | Supports the AI literacy measures expected under Article 4 |
| Approved tool list with owner and data level | Links the policy to your AI inventory |
| Vendor data processing agreements | GDPR Article 28 for vendors that process personal data for you |
| Incident notes and fixes | Shows the policy is used, not just filed |
A signed policy is not proof of EU AI Act compliance. Do not claim a certification you do not have. If any tool touches hiring, credit, education, biometrics or staff monitoring, get specialist advice. Spot an error in this guide? Write to mininglife7@gmail.com.
For accountants and tax advisers
This template is easy to hand to SME clients alongside the year-end pack: it takes one conversation, it surfaces which AI tools the client pays for, and it gives you a reason to book a review. Pair it with the 60-minute client AI inventory workshop. Stay inside your professional rules and pass legal questions to a lawyer.
Where to keep the tool list and evidence
A shared spreadsheet works. If you want each AI system, its risk notes and evidence dates (policy version, briefing dates, vendor replies) in one browser tool with no account and no upload, the EURO AI Register free edition covers up to 3 AI systems and 10 evidence records. A paid membership removes those limits. You can also join free and refer others to earn via the open affiliate programme on Gumroad (up to 50% of each referred sale; Gumroad pays partners directly). Neither tool is legal advice or proof of compliance.
Free start: add your first approved AI tool and today's briefing date to the EURO AI Register free edition. Related: Article 4 literacy · Article 5 banned practices · Article 50 checklist · 12 AI vendor questions.
Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.