Writing an AI Usage Policy for Your Staff: What to Include, With a Model Outline

Key Takeaways

• An AI policy tells your team which tools they may use, for what, with which data, and who checks the results.
• The core is a set of data rules with examples from your own work, for instance in three classes: green, amber and red.
• For an SME, two to four pages are usually enough, as long as they're concrete and name a contact person.
• A ban with no approved alternative leads to AI being used quietly on private accounts.
• Introduce the policy with a training session and review it regularly.

An AI usage policy sets out which AI tools your team may use for which tasks, what data may go into them and who checks the results. For a Swiss SME, two to four pages are usually enough, as long as they're concrete: a list of approved tools, data rules with examples, a review rule and a named contact person. Below you'll find what belongs in it and a model outline you can adapt.

The outline is a working aid and not legal advice, especially if your business is bound by professional secrecy.

Why does an SME need an AI policy?

Because your team is very probably using AI already, with or without rules. Without them, customer data ends up in private accounts, unchecked texts go out to customers, and nobody is quite sure what's allowed. With a policy, everyone knows where they stand and can use AI with a clear conscience.

There are legal reasons too. As an employer you may issue general instructions on how work is carried out, and your employees follow them in good faith (Art. 321d of the Swiss Code of Obligations). Under the Data Protection Act you remain responsible for the personal data your team enters into tools, as we explain in AI and data protection in Switzerland. And if the EU AI Act applies to you, you must take measures to support your team's AI literacy. A policy combined with training is the natural way to do that.

What belongs in an AI policy?

Everything your staff need to know to do the right thing without having to ask. These points belong in it:

• Purpose and scope: who the rules apply to, including apprentices, temporary staff and freelancers, and which tools, including AI features in software you already use.
• Approved tools: which tools are cleared for which tasks, and how to request a new one.
• Data rules: what may go into which tool, with concrete examples.
• Review and responsibility: who checks results before they leave the business.
• Transparency: when customers are told that AI was involved.
• Decisions about people: AI may prepare them but not make them alone.
• Incidents, training, a contact person and regular review.

Our guardrails checklist shows how to scale rules for AI to the risk involved. The policy is the version of those rules that everyone on your team can follow.

How do you write the data rules?

With examples from your own business. A sentence like ‘don't enter confidential data’ doesn't help much, because everyone reads something different into it. Three classes work well:

• Green: public and non-critical content with no personal data, such as website texts, general templates or ideas for a customer event. Allowed in all approved tools.
• Amber: internal information and ordinary personal data, such as a customer email with a name and address, or internal minutes. Only in tools with a data processing agreement and checked data location, and only as much as needed.
• Red: sensitive personal data such as health information or criminal proceedings, data covered by professional secrecy, payroll and personnel files, passwords and login details. Only in systems specifically approved for it, or not at all.

Which tools qualify for amber and red depends on where the data is held and on the contract. The criteria are in where your data goes. An example: in a painting business with twelve people, the office manager writes a website text about facade renovation in any approved tool (green). She summarises a customer inquiry with a name and address only in the business account of the approved assistant (amber). An employee's doctor's note doesn't go into any AI tool (red).

A good AI policy answers the question someone asks on a Monday morning: am I allowed to paste this in here?

A model outline you can adapt

This outline suits businesses with five to a hundred people. Replace the examples with your own and cut whatever doesn't apply to you.

1. Purpose.A sentence or two on why you use AI and what the policy is for, for example: saving time on routine work without putting data or quality at risk.
2. Scope.Who it covers (all employees, apprentices, temporary staff, freelancers) and which tools, including AI features in your email, office suite or industry software.
3. Approved tools.A table with each tool, its purpose and the data class it's cleared for. Private accounts are off limits for business data. New tools are requested through the contact person.
4. Data rules.The three classes, green, amber and red, each with three to five examples from your daily work.
5. Review and responsibility.Every result is checked before it's used, especially figures, names, deadlines, quotations and legal statements. Whoever uses or sends the result is responsible for it.
6. Transparency.When you tell customers about AI, that chatbots identify themselves as such, and that no realistic fake images or voices of real people are created without labelling.
7. Decisions about people.Rejections, assessments and other decisions about applicants, employees, tenants or customers are always made by a person. AI may prepare them.
8. Accounts and access.Business accounts only, two-factor sign-in, no shared logins. Access is closed when someone leaves.
9. Reporting incidents.Who to contact if data has gone into the wrong tool or an AI result has caused harm. Reporting quickly matters more than who was at fault.
10. Training and contact person.An introduction for everyone, new starters included, and a named person for questions, such as an AI champion in the team.
11. Review.Who owns the policy and when it's reviewed, for example every six months. The tool list can be updated more often.

How do you introduce the policy?

In a way that makes it stick. Write it with two or three people from different parts of the business so the examples ring true. Present it in a short session where everyone tries the approved tools on real tasks, for example in one of our team training sessions. Keep the policy where people will find it, and ask them to confirm they've received it. Collect questions over the first few weeks and add to the examples. After a few months, check whether the rules are being followed and still fit.

Which mistakes should you avoid?

• A ban with no alternative. People who aren't allowed to use AI officially often use it quietly on private accounts.
• Rules without examples. Everyone has a different idea of what ‘confidential data’ means.
• A template from a large corporation. Nobody in a business of 15 people reads 20 pages.
• An out-of-date tool list. Tools and their terms change, and the list has to keep up.
• No contact person. People who don't know whom to ask will decide for themselves.

Our page on AI in your team shows how we help businesses bring rules, tools and training together.