Skip to content
Neural Soft
Contact us Español (View this page in Spanish)

Regulation

An AI usage policy for your company: what to include and how to put it in place

What a company AI usage policy should include: approved tools, permitted data, human review, transparency and training, with a step-by-step plan.

Round traffic signs for prohibitions, speed limits and mandatory routes piled together.

Neural Soft 5 min read

Key points

  • An AI usage policy states which tools can be used, with what data and with what controls.
  • It is the most practical way to tame shadow AI and to show the AI literacy the AI Act requires.
  • The key part is the data table: what can go into each tool and what never can.
  • Better short (one or two pages), known to everyone and reviewed when the tools change.

Almost every company already uses AI, even if nobody decided to: someone summarises contracts with ChatGPT, someone else translates emails with a browser extension and the sales team is trying out a presentation generator. Each with their own account and their own judgement.

An AI usage policy brings order with simple rules: which tools can be used, with what data and with what controls. You do not need a thirty-page document; you need one the whole team knows and understands.

Visual guide · AI usage policy

The road signs
of AI
at work

A good usage policy reads like the highway code: what is forbidden, what is mandatory, what calls for caution and where to ask.

01 · Forbidden

What is never done

  • Personal or confidential data in unapproved tools
  • Passwords, keys or bank details, ever
  • Deciding about people based only on what the AI says
  • Passing off a chatbot or generated content as human

02 · Mandatory

What is always done

  • Use only approved tools, with the company account
  • Check everything before using or sending it
  • Tell customers when they are talking to an AI
  • Get trained for your role

03 · Caution

What calls for slowing down

  • It can make up facts with total confidence
  • Copyright in texts and images
  • Bias in what it suggests
  • Outdated information

04 · Information

1-2
pages

A policy people read in full. Everything else goes in annexes.

  • List of approved tools
  • Who to ask
  • How to report an incident
Neural Soft

neuralsoft.es · An illustrative example: each company adapts its own.

Download the infographic (PNG)

Why it is worth having one now

  • AI Act: since 2 February 2025, companies that use AI must take measures so that their staff have a sufficient level of AI literacy (Article 4). The policy, together with training, is the clearest evidence that you have done so. We explain it in mandatory AI literacy.
  • GDPR: putting personal data into a tool is processing. You need to know which tool, under what contract and on what legal basis.
  • Confidentiality: contracts, quotes or customer data in personal accounts are a business risk, even without personal data.
  • Quality: AI makes mistakes with total confidence. Without a review rule, errors end up in documents and emails to customers.

What it should include

  • Purpose and scope

    Who it applies to (external collaborators too) and what counts as an AI tool, including AI features inside other software.

  • Approved tools

    A short list, always with a company account, and how to request approval for a new one.

  • Which data can go in

    A simple table: public, internal, confidential and personal data, and which tools each can go into.

  • Human review

    Whoever uses AI is responsible for the result. Everything is checked before use, especially if it goes to a customer or decides something about a person.

  • Transparency

    Telling customers when they talk to a chatbot and when published generated content could be mistaken for real.

  • Training, incidents and review

    What training each role receives, how to report a problem and how often the policy is reviewed.

The everyday question: can I use this tool with this data?

The most consulted part of any policy is the data section. This tree summarises a common way of framing it; each company adjusts the categories and the tools.

Can I use this tool with this data?

Is the tool on the approved list, and are you using the company account?
What are you going to put in?

Think about attachments and anything you copy and paste too.

Result

Go ahead

Use it normally and check the result before using it.

Result

Go ahead, carefully

Procedures, drafts or non-confidential business data:

  • only what the task needs;
  • check the result before sharing it.
Is the tool specifically approved for personal or confidential data?

For example, the assistant built into the company email, with a data processing agreement.

Result

Yes, with the minimum needed

Before putting it in:

  • remove what is not needed (names, ID numbers, accounts);
  • do not use it to decide about people without human review;
  • check the result with particular care.

Result

No

That information cannot go into that tool. Anonymise it or use a tool approved for personal or confidential data.

Result

Not yet

Ask for the tool to be assessed. Meanwhile, use one of the approved ones.

  • No personal accounts with company information.

An illustrative example: each company defines its data categories and approved tools in its policy.

How to write it and put it in place

  1. Inventory of real use

    A short, anonymous survey: which tools are used, what for and with what data. There are usually surprises.

    Inventory of tools and uses

  2. Choose the approved tools

    A few, on business plans with a data processing agreement. Cover what the team was already doing, so it does not go back to personal accounts.

  3. Write one or two pages

    With the data table, the review rule and who to ask. Technical details go in annexes.

    Policy approved by management

  4. Communicate and train

    A short session for the whole team with examples from their own work, and deeper training for those who need it.

  5. Review

    Whenever a new tool or use is added, and at least once a year.

Next step

In an AI consulting engagement we run the inventory, write the policy with you and link it to the training plan. To go deeper, the AI governance and compliance course covers the full framework, the AI literacy course prepares all staff and the data protection and AI course focuses on the GDPR.

Frequently asked questions

Is an AI usage policy mandatory?
The AI Act does not require a document by that name, but it does require companies to take measures so that their staff have a sufficient level of AI literacy (Article 4), and the GDPR requires being able to show how personal data is protected. A usage policy, together with training, is the simplest way to do both.
Who should write it?
Ideally a small group: someone from management, whoever handles data protection, IT and one or two people who use AI every day. Management approves it and it is communicated to all staff.
Do employee representatives need to be informed?
If the policy includes monitoring how tools are used or affects working conditions, it is advisable to inform them and check with your employment adviser. If AI is used to make decisions about people (recruitment, assessment), the AI Act adds specific obligations.

Related service

  • AI consulting for SMEs

    We help small and medium-sized businesses find where AI can add value, which cases are worth testing and how to start without investing in solutions they do not need.

Related training

  • AI governance and compliance course

    A practical framework for using AI in an orderly way and meeting the AI Act without stifling innovation.

    • Duration: 8 hours
    • Format: In-company, on-site or live online

  • AI literacy course for all staff

    The common foundation the AI Act requires so the whole team uses AI with judgement.

    • Duration: 3–4 hours
    • Format: In-company, on-site or live online

  • Data protection and AI course (GDPR)

    Use AI with personal data while complying with the GDPR by design.

    • Duration: 6–8 hours
    • Format: In-company, on-site or live online

More articles

Want to apply this in your company?

Tell us about your case and we will tell you, with no commitment, whether AI makes sense and where to start.

Request an AI assessment