What is a company AI policy and what to put in it

You don't need a long document. A good policy for a small business answers a few practical questions: which tools are approved; which data must never be uploaded; which results must always be checked by a person before they go out; when you need to tell a customer that content was generated; who to go to for a new tool or a doubt.

The policy links to obligations that already exist, such as GDPR and confidentiality, and to the new ones in the European AI regulation, which, among other things, requires you to train the people who use these systems. It should be written with the people who actually work with the tools, updated when they change, and explained, not just signed.

An example in a small business

A company that makes mechanical components writes a two-page policy. It lists the approved company assistant, bans uploading customers' technical drawings to external tools, requires every generated text to be reread before it is sent, and names Riccardo as the contact person. In a meeting they explain it to everyone, with examples taken from each department's work.

The most common mistakes

• Copying a long, generic policy from the internet that nobody will read.
• Writing it without involving the people who use the tools every day.
• Not updating it when new tools arrive or the rules change.

Why it matters to you

A clear policy reduces the risks to your data and gives you a ready answer when a customer or an inspection asks how you use AI. And it is the first building block for handling your AI Act obligations.

All the AI terms, explained simply, are in the glossary.