AI use policy template for small and medium-sized businesses (SMEs)

AI use policy for [organisation name]

Version [1.0], adopted on [date] by [name/job title].

1. Purpose

This policy describes how employees of [organisation name] use AI tools in their work. The aim is to make use of the benefits of AI without putting the privacy of customers and colleagues, confidential information or the quality of our work at risk.

2. Who it applies to

This policy applies to all employees, interns, temporary workers and freelancers who work for [organisation name] and use AI tools in doing so.

3. Permitted tools

We only use these AI tools for our work: [for example: ChatGPT Business, Microsoft 365 Copilot with your work account], with these settings: [for example: use for training switched off]. We do not use personal accounts for work, even if you pay for them yourself. Want to use a different tool, or have a question about a tool? Ask your manager [or: name/job title] first.

4. What you never enter

In a chatbot or any other general AI tool, a business version included, you never enter:

• Personal data of customers, job applicants or colleagues, not even a name on its own, a customer or staff number, an address, or details about health or salary
• Passwords, access codes and keys
• Confidential contracts, supplier quotes and legal documents
• Non-public financial information
• [Other confidential information specific to your organisation]

Only these AI features in software we already use for that data are approved: [the assistant in our email program, AI in our CRM or accounting package]. They may work with it, but only like this: [agreement per feature]. We only use a new AI feature in existing software once [name/job title] has approved it.

Internal documents without personal data, properly anonymised questions and drafts that are not yet public only go into [approved tool], and only for [tasks].

In doubt? Then do not enter it, or make your question general first.

5. Check before use

AI makes mistakes, even when the answer sounds convincing. You check facts, figures, names and sources before you use or send anything. You remain responsible for what you do with AI output.

6. Transparency

We are honest about our use of AI. If a customer communicates directly with an AI system, for example a chatbot on our website, we let them know. Images, audio or video made with AI that look real are clearly labelled as such. We never let an AI-generated person appear as a customer. If we publish an AI text to inform the public on matters of public interest, we say so, unless an employee has genuinely checked the content and the facts and we take editorial responsibility for it.

7. Copyright

We do not publish AI output that may infringe other people's work, such as text or images that closely resemble existing work or that contain other parties' brand names and logos. We only put material into an AI tool that belongs to us, or that we are sure we are allowed to use.

8. What we do not do

We do not use AI for purposes that the AI Act prohibits, such as recognising employees' emotions in the workplace. We only introduce applications that affect people, such as assessing job applicants, after consulting [name/job title].

9. Training

Every employee who uses AI tools completes AI literacy training when they start, followed by the updated version every year. We keep track of who has completed which training.

10. Something gone wrong?

Have you accidentally put confidential information or personal data into an AI tool? Report it straight away to our privacy contact: [name, phone, email]. If you don't know who that is, report it to your manager. We can then assess whether it is a data breach that we must report to the Dutch Data Protection Authority within 72 hours.

11. Review

[Name/job title] owns this policy and reviews it at least once a year, or sooner if we start using new tools or the rules change.