AI policy template for EU SMEs, aligned with the EU AI Act

October 13, 2026

A good AI policy template for an EU SME covers ten things: scope, roles, approved tools, data rules, allowed and prohibited uses, checking output, transparency, training, incidents, and acknowledgement and review. The template below covers all ten, with example clauses to copy and adapt.

The EU AI Act does not require most businesses to have a written AI policy, but a short one is the simplest way to support AI literacy under Article 4.

New hires often ask on day one: “Can I draft this offer in my own ChatGPT account?” The template answers in one line: draft offers are amber, so company accounts only.

Status as of October 13, 2026. Not legal advice. Have the finished policy reviewed by your data protection officer or legal adviser.

How to use this AI acceptable use policy template

• Replace everything in [square brackets] with your own details. Example Ltd is a placeholder.
• Keep it short. Two to four pages suits most SMEs. Every clause should answer “can I do this?” for someone in customer service, sales, HR, finance or field work.
• Adapt the data rules first. The traffic-light data classes in section 4 do most of the work.

Rather answer questions than edit a document? In the Aigen Campus AI policy builder, you answer a short questionnaire about your tools and data, and an AI assistant drafts a policy for you to review, edit and publish.

The AI policy template: 10 sections

1. Purpose and scope

This policy explains how [Example Ltd] uses AI tools at work. It helps us use AI well and safely, protect our customers’ data and our own, and meet our obligations under the EU AI Act, the GDPR and [other applicable law].

The policy applies to all employees, temporary staff, interns and contractors who use AI tools for [Example Ltd]. It covers AI assistants (such as [ChatGPT, Copilot, Gemini]), AI features inside other software, and any AI system we build or buy.

Our guiding rule: AI prepares, people decide.

2. Roles and responsibilities

• Policy owner ([name, role]) maintains and reviews this policy (section 10).
• AI contact person ([name]) answers questions, keeps the list of approved tools and handles requests for new ones.
• Data protection contact ([name or DPO]) reviews any use of AI with personal data.
• Managers make sure their team knows this policy and completes the training in section 8.
• Everyone follows this policy, asks when unsure and reports problems under section 9.

3. Approved AI tools and accounts

Use only the tools and accounts listed here for work.

The account decides: a consumer version may handle your input under different terms than a business version, so never use a personal account for work data.

Ask [AI contact person] before you adopt a new AI tool, install an AI browser extension, or connect an AI tool or agent to company email, files or systems.

4. Data classes: the traffic light

• Green: any approved tool. Public information and general text with no customer, employee or company details.
• Amber: approved company accounts only. Internal documents, non-sensitive customer correspondence, draft offers and meeting notes.
• Red: not in AI tools, unless [data protection contact] has approved a specific tool for that specific use. Personal data about customers or employees, contracts, unpublished financial information and trade secrets.
• Never, in any AI tool: passwords and access keys, personal identity numbers, health data, payment card details, or anything a customer has asked us to keep confidential.

When unsure, treat the data as one class higher, or remove the details before you paste.

5. Allowed, approval-only and prohibited uses

Allowed with approved tools and within the data rules: drafting and editing text, summarizing, brainstorming, translation drafts, spreadsheet formulas, and code assistance that a person reviews.

Only with written approval from [policy owner]:

• any use that affects decisions about people, such as recruitment, performance reviews or credit decisions (several of these become high-risk uses under the AI Act from December 2, 2027);
• customer-facing chatbots or automated replies;
• AI agents that act in our systems, send messages or make purchases.

Never:

• the AI Act’s prohibited practices, including emotion recognition of employees at work (except for medical or safety reasons) and social scoring;
• decisions about a person based solely on AI output;
• deepfakes of real people without their consent, or AI content intended to mislead;
• using AI to get around security controls or this policy.

6. Checking output and responsibility

You are responsible for everything you send, publish or decide, whether or not AI helped. Confident doesn’t mean correct: AI can invent facts, figures and sources.

Before you use AI output, check:

• facts, figures, names and dates against a reliable source;
• that any cited source exists and says what the AI claims;
• legal, financial, safety and medical statements with an expert or an official document;
• tone, fairness and possible bias, especially in texts about people.

Never send AI output to a customer unread.

7. Transparency and labeling

The AI Act’s transparency obligations (Article 50) have applied since August 2, 2026.

• When people talk to a chatbot we provide, we tell them they are interacting with AI, unless it is obvious.
• We label images, audio and video that we create or alter with AI and that could pass as real (deepfakes).
• If we publish AI-generated text to inform the public on matters of public interest, we disclose it, unless a person has reviewed it and we take editorial responsibility.
• We follow guidance from [our national authority].

8. Training and AI literacy

• Everyone completes [basic AI training] within [30 days] of starting, and before getting access to [Copilot].
• Roles with higher risk ([HR, customer service, finance]) complete [role-specific training].
• Everyone takes a refresher every [12/24] months and when this policy changes significantly.
• [AI contact person] keeps a record of training and policy acknowledgements.

9. Incidents and reporting

Report to [AI contact person] straight away if:

• personal or confidential data has gone into a tool or account not approved for it;
• an AI error has reached a customer or a decision;
• you suspect a deepfake, a scam or an AI tool acting outside its instructions.

Honest reporting is never punished. Personal data breaches follow our [data breach procedure], including notifying the data protection authority within 72 hours where the GDPR requires it. We always confirm requests to change payment or bank details through a second channel.

10. Acknowledgement, review and versions

• Everyone acknowledges this policy when they start and within [14 days] of each new version.
• [Policy owner] reviews the policy at least every 12 months, and sooner when we add a major tool or the law changes.

Tip: The Aigen Campus AI policy builder is free, including publishing, acknowledgements and version history. Create a free account and have a first draft ready in about 10 minutes.

How to roll out your AI policy

1. Draft with the people who will use it. Ask one person from each main role to flag what is unclear.
2. Have it reviewed. A template or AI-generated draft is a starting point, not legal advice. Ask your DPO or legal adviser to check the data rules and prohibited uses.
3. Inform or consult employees where national law requires it. In many EU countries, tools that change how people work trigger information or consultation duties, for example under the Co-operation Act in Finland (in full for employers with 50 or more employees) or the Co-determination Act (MBL) in Sweden (employee consultation rules in the EU).
4. Publish it where people work, such as the intranet or onboarding materials, with a one-page summary of the traffic-light rules.
5. Walk teams through it and train everyone. A 15-minute session with examples from their own work beats an email. For what Article 4 expects, see EU AI Act Article 4 after the Digital Omnibus.
6. Review after three months, then at least once a year.

How to collect acknowledgements

An acknowledgement confirms that a person has received and read the policy. It is not a test, and electronic confirmation works well. Record:

• the person’s name and role;
• the policy version;
• the date of acknowledgement;
• how it was given, for example in your learning platform or HR system.

Ask for a new acknowledgement when the content changes, such as a new tool or data rule, not for typo fixes. Bring contractors in through the same process or a contract clause. Keep acknowledgements with the rest of your AI literacy evidence pack.

Aigen Campus records acknowledgements by policy version. With the annual license, once you publish your policy, 5 of the 30 final exam questions are generated from it, so the exam also checks that people know your own rules.

Frequently asked questions

Does the EU AI Act require a company AI policy?

Not for most businesses. The AI Act requires no written AI policy from deployers of ordinary AI tools, but a policy is a practical way to support AI literacy under Article 4 and to stay within the prohibited practices and transparency obligations.

What should an AI acceptable use policy include?

Scope, roles, approved tools, data rules, allowed and prohibited uses, checking output, transparency, training, incident reporting, and acknowledgement and review. The template above covers all ten.

Do employees have to sign the AI policy?

No handwritten signature is needed. An electronic acknowledgement recording the person, the version and the date works well and is easy to repeat when the policy changes.

How often should we update our AI policy?

Review it at least once a year, and sooner when you add a major AI tool, start a new kind of use or the rules change.

Get started

Copy the template above, or let the free Aigen Campus AI policy builder draft one from your answers in about 10 minutes, with traffic-light data classes, approved tools, versions and acknowledgements. You get a draft to review, not legal advice. Build your AI policy.