AI Usage Policy for SMEs: Template and Steps

Why an AI usage policy has become essential for SMEs

In most Belgian SMEs, AI is already in the building, even if nobody decided it should be. A sales assistant drafts customer replies with a free chatbot. An accountant pastes part of a spreadsheet into an online tool to get a summary. A marketing manager generates visuals, a workshop lead summarises a specification. Everyone acts in good faith with the tool at hand, and nobody knows exactly which data is leaving the company or who checks what comes back.

This is what we call "shadow AI". It does not come from bad intent; it comes from the absence of a framework. A company AI usage policy answers a simple need: telling your people, in two or three readable pages, what is allowed, what is forbidden and what needs sign-off. It protects your customers, your data and your reputation, and it reassures your team, who finally know how far they can go without fear of getting it wrong.

The regulatory backdrop makes this more pressing. According to Eurostat, 20.0% of EU enterprises with 10 or more employees used AI technologies in 2025, up from 13.5% a year earlier. The most common use is analysis of written language (11.8% of enterprises), which is exactly what your staff do when they paste an email or a contract into a tool. Adoption is moving fast, and it almost always runs ahead of internal rules.

In this article I propose a practical method to write your policy in about thirty days: what European law actually expects from you, the six topics to cover, a document outline, and the mistakes to avoid. If you want to place your company first, also read our guide to the EU AI Act for Belgian SMEs, which this policy complements on the practical side.

What the EU AI Act really requires from your SME in 2026

Let us clear up a common misunderstanding first: the European AI regulation does not oblige you to write a policy. It asks for something else, and a policy is simply the cheapest way to deliver it.

Article 4 of Regulation (EU) 2024/1689 deals with "AI literacy": companies that develop or use AI systems must act so that their staff understand what they are handling. It has applied since 2 February 2025. It was softened in July 2026: Regulation (EU) 2026/1744, known as the "AI Omnibus", published in the Official Journal on 24 July 2026 and in force from 27 July, turned the duty to "ensure" a sufficient level of AI literacy into a duty to take measures to support its development, according to the analysis by White & Case. The same text pushed back the high-risk obligations to 2 December 2027 (Annex III systems) and 2 August 2028 (safety components of regulated products).

Two points deserve your attention. First, the European Commission states in its AI literacy Q&A that no certificate is needed and that no training is imposed in any particular form: organisations may keep an internal record of trainings and other initiatives. Second, supervision and enforcement rules have applied since 2 August 2026, through national market surveillance authorities. In other words, "we will deal with it later" is no longer a tenable strategy.

A practical consequence follows. To show that you have taken proportionate measures, you need traces: a reference document, an information session, an attendance record. The usage policy is that reference document. It does not shield you from everything and it does not replace a legal analysis of your situation, but it proves a structured approach, which counts for far more than a perfect file nobody reads.

One last reminder: some transparency obligations (Article 50) continue to apply from 2 August 2026, for example when you make a conversational agent available to the public. If your website uses a chatbot, the policy should say how users are told they are talking to a machine.

The six topics of an effective AI usage policy

A good policy fits into six topics. Each answers a question your staff are already asking: which tools, which data, who reviews, what do we say externally, what do we do when something goes wrong, and how does the team learn.

Topic 1: approved, tolerated and forbidden tools

The heart of an effective policy is a clear list of tools sorted into three categories. This "traffic light" approach is easy to understand and easy to enforce.

Approved tools are those the company has assessed, configured and, where relevant, paid for: for example a business version of an AI assistant with a contractual commitment not to reuse your data for model training. For each tool, the policy states the covered uses (drafting, translation, summarising, analysis), who is responsible for the configuration and which type of account to use. Free personal accounts have no place in this category.

Tolerated tools are accepted for low-risk uses only, with no internal data and no personal data: brainstorming headlines, rewording a public text, explaining a concept. The point of this category is to avoid a blanket ban that nobody would respect. A realistic framework beats a rule that is ignored.

Forbidden tools are those you cannot assess or whose terms of use are unacceptable: unknown browser extensions that read page content, apps that demand access to the whole mailbox, services with no clear statement on where data is hosted.

The watch point for an SME is maintaining this list. It needs an owner (often the managing director or whoever looks after IT) and a review date, quarterly at minimum, because the tool landscape moves quickly. Also provide a simple way to request a new tool: a one-page form and an answer within a week are enough to discourage workarounds. To compare the assistants on the market before sorting them, our guide to integrating ChatGPT in your business details the selection criteria.

Topic 2: which data may go into an AI tool

This is the most important rule in the whole policy, and the one that prevents the costliest incidents. Define three levels of data and say what is allowed for each.

Green: public or non-sensitive data. Website text, press releases, a marketing brief with no customer names, a general question. This data may go into all approved and tolerated tools.

Amber: internal, non-personal data. Procedures, price lists, specifications, anonymised meeting notes. It may only go into approved tools, meaning those with contractual confidentiality guarantees.

Red: personal data, health data, identifiable financial data, trade secrets, information covered by a non-disclosure agreement. By default, it does not go into an AI tool, unless there is prior written approval and a verified legal basis. This is where GDPR meets the policy: entering personal data into a third-party service is processing, with the obligations that come with it. Our article on GDPR and AI for Belgian SMEs covers this side.

A tip from the field: illustrate each level with three examples drawn from your business. A tradesperson will cite a named quote (red), a supplier price grid (amber) and the description of a typical job with no address (green). An abstract rule is easily forgotten; a recognisable example sticks. Add one common-sense sentence everyone can apply in ten seconds: "when in doubt, treat it as red". For the technical side of protection (access, hosting, logging), see our guide to data security with AI.

Topic 3: human review, or who answers for the result

An AI tool produces plausible text, not true text. It can invent a legal reference, get a figure wrong or strike the wrong tone. The policy must therefore set a non-negotiable principle: the person who uses an output is responsible for it, exactly as if they had written it themselves.

To make this operational, offer a review scale based on the stakes. An internal draft that nobody outside will see needs a quick read. An email to a customer needs a careful read for substance and tone. A document that legally binds the company (contract, firm offer, official letter) or financially binds it (figures sent to a bank or an accountant) needs review by a second competent person, and a check of the sources. Decisions that affect people, in particular in human resources, are never made on the basis of an AI output alone.

Add three reflexes to write down in black and white: check every figure, date and quotation before reusing it; never present as certain a piece of content whose source you cannot trace; report any error you spot internally so the team learns collectively.

Here is a deliberately hypothetical example, not drawn from any client: a services SME sends an offer whose lead time was "reworded" by an assistant, which turned "subject to availability" into a firm delivery commitment within ten days. Nobody re-read it because the text looked fine. A double-read rule for binding documents would have caught the discrepancy. This kind of situation is not an exception: it is the ordinary risk of unmanaged use.

Topic 4: transparency towards customers, partners and staff

A policy does not only look inward. It also says what you tell the outside world about your use of AI, which builds trust and, in some cases, supports compliance.

Start with a general principle: you do not hide the use of AI when the other party is entitled to know. If a conversational agent answers visitors on your website or your customers, it must identify itself as such. If generated content is published (images, videos, informational texts), check the labelling obligations that apply to your situation and, at the very least, avoid any misleading presentation, such as a "testimonial" or a "photo" that corresponds to no reality. Customer reviews, in particular, must never be invented or written by a machine to look authentic.

Then inform your own teams. Say clearly which tools are used, for what, and what is (or is not) logged. If an AI tool plays a part in work organisation, rosters or appraisal, employment-law rules and consultation of staff representatives where required must be checked before rollout: this goes beyond what a policy can settle and warrants specific legal advice.

Finally, anticipate requests from your larger customers. More and more buyers ask about AI use in their supplier questionnaires: which tools, which data, what oversight. An up-to-date policy lets you answer in a day rather than two weeks and turns a constraint into a selling point. It makes your SME a more credible partner than a competitor who improvises.

Topic 5: incidents, reporting and responsibilities

No policy removes risk; it organises the response. Define what an AI incident means in your company: confidential data entered into an unapproved tool, an erroneous content sent to a customer, a discriminatory result, a suspected leak, abnormal behaviour of an automated agent.

For each type of incident, the policy states three things: who to report to (a named person, with a deputy), within what time (ideally the same day) and what happens next (assessment, correction, possible notification of the people concerned). The atmosphere in which reporting happens matters as much as the procedure: if the employee who admits a mistake is punished, the next mistakes will stay hidden. State explicitly that good-faith reporting carries no sanction, except in the case of deliberate and repeated breaches of the policy.

Also appoint an AI lead. In an SME this is not a new job: it is a role given to one person who keeps the tool list, answers questions, collects incidents and organises information sessions. Their contact details appear in the policy. In a very small business, the AI lead can be the owner.

Finally, specify the scope: the policy applies to employees, but also to freelancers, interns and contractors who work with your tools or data. A subcontractor who uses an assistant to process your files without telling you creates a risk that you carry. Include a clause in your contracts or purchase orders.

Topic 6: training, records and review

A policy is only worth what people understand of it. This is where Article 4 and your team's daily life meet: you demonstrate your measures through awareness actions suited to roles.

A proportionate approach for an SME comes in three steps. First, a 60 to 90-minute presentation for everyone, with concrete cases from the company (what can be pasted, what never is, how to review). Then targeted add-ons for exposed roles: a workshop for people who handle customer or employee data, another for those who write offers, a third for management on risks and responsibilities. Finally, a short refresher twice a year, folded into an existing meeting. Our article on training your team for AI adoption goes into the formats that work best.

Keep a simple record: date, content, attendees, material used. A table is enough, and it matches what the Commission describes as an internal record. Also keep the successive versions of the policy, with their date and the reason for each change.

Lastly, set the review: at least once a year, and whenever something important changes (a new tool, a new type of data, a regulatory change). The regulation itself already changed in 2026; a frozen policy quickly becomes wrong. Write the date of the next review into the document so it does not depend on anyone's memory.

A policy outline and a 30-day plan

Here is a typical structure you can adapt. It fits in two to three pages: purpose and scope; general principles (usefulness, responsibility, caution); list of approved, tolerated and forbidden tools; data rules (green, amber, red, with examples); human review according to the stakes; internal and external transparency; incidents and AI lead; training and records; review and effective date; signature or acknowledgement of reading.

For rollout, a realistic four-week calendar is enough for an SME of a few dozen people.

Week 1: map. Ask your teams, without judgement, which tools they use and for which tasks. The aim is to see the real situation, not to find culprits. You will almost always discover uses you did not know about, and often good ideas worth spreading.

Week 2: decide. Sort the tools, define the three data levels, name the AI lead, choose the review rules. Have the draft approved by management and, if possible, by legal counsel for sensitive points (personal data, employment law).

Week 3: write and test. Write the policy in plain language, then submit it to two or three colleagues from different roles. If a rule raises questions, it is too vague: reword it.

Week 4: train and deploy. Run the presentation session, collect acknowledgements, open a channel for questions and note the date of the first review.

This plan needs no software budget. It mainly needs management time and consistency. And if you lack one or the other, that is precisely the moment to get support: at Aïves Consulting, we help SMEs in Wallonia and Brussels audit their uses and put this framework in place, as part of our AI consulting and strategy work.

Mistakes to avoid, and where to start

Four mistakes come up often. The first is copying a large group's policy: thirty pages of jargon that nobody reads, unrelated to your daily work. A short text that is applied beats a long one that is ignored. The second is banning everything: a total ban pushes use into the shadows, out of any control, and deprives you of the real gains AI can bring. The third is writing without consulting the teams: a policy imposed from above will be bypassed, whereas one built with its users will be defended by them. The fourth is never updating it, when tools, prices and rules change several times a year. For other classic pitfalls, see our analysis of AI integration mistakes in business.

Keep in mind, finally, the limits of this article: it offers a working method, not legal advice. Precise obligations depend on your tools, your data and your sector, and European regulation keeps evolving: always check the texts in force and, for delicate cases, consult a lawyer.

Where to start this week? Take an hour, list the AI tools your people already use, and ask for each one: what data goes in, and who checks what comes out? The answers will give you half of your policy. If you would like an outside view or support to write it and train your teams, get in touch for a first conversation, or explore all our services and our approach to AI integration in SMEs.