AI use policy for your company: a one-page template

An employee pastes a client’s email into ChatGPT because they want to write a reply quickly. On another day they upload a table of prices and margins to “tidy it up”. They do it in good faith, but the company doesn’t know what went into an external tool.

In this guide you get rules that fit on one page: what may be pasted and what may not, how to talk to your team, and a policy template to copy. It is not legal advice, and I describe the situation as of 28 October 2026. If in doubt, consult a lawyer or a data protection officer.

Why a small business needs an AI policy

Without rules, each employee decides alone. One uses a paid company account, another a free private account, a third a plugin nobody has heard of. It is then hard to say where client data has gone.

The document has three jobs:

• it protects the data of clients, employees and the company itself,
• it gives people clarity about what they can do without asking,
• it shows clients and counterparties that you have the topic under control, which some of them may require in contracts.

The policy is not meant to be a 20-page rulebook. One page that someone actually reads works better than a thick folder in a drawer.

What the law says: the AI Act and GDPR

Art. 4 of the AI Act (Regulation (EU) 2024/1689) concerns AI literacy. It has applied since 2 February 2025 and covers not only providers of AI systems but also entities that use them at work, that is, also a small business whose team writes quotes in ChatGPT. The Digital Omnibus package (Regulation (EU) 2026/1744, in force since 27 July 2026) softened this provision: a company no longer has to “ensure” a particular level of knowledge, but must take measures supporting the AI literacy of its employees and other people who operate AI on its behalf. So it is not a requirement to “have a policy”, but training and clear rules help meet it. The European Commission, in its questions and answers on AI literacy, explains that a certificate is not needed, and a company can keep an internal training record.

The second pillar is the GDPR (in Poland: RODO). Personal data also means a name with an address, a phone number, an email or the content of an email from a specific person. Pasting them into an external tool is processing of data. So you need a legal basis, a purpose and usually a data processing agreement with the provider. You will find guidance on the website of UODO (Urząd Ochrony Danych Osobowych, Poland’s data protection authority): uodo.gov.pl.

The third element is trade secrets: price lists, margins, contracts, code, plans. The Act on Combating Unfair Competition (ustawa o zwalczaniu nieuczciwej konkurencji) protects a company’s trade secret only if the company takes due care to keep it confidential (Art. 11(2)). Written rules for using AI are one such measure, and data that has already left the company usually cannot be recovered.

Free or business plan: where the difference lies

The most important question is: does the provider use what you paste to train its models. The answer depends on the plan and the settings, and providers change them. So check the current terms on the day you introduce the policy.

The general pattern is this:

This is a generalization, not a guarantee. Before deciding, read the terms of the tool you choose. I compared subscriptions in the guide ChatGPT or Gemini for business.

What is allowed and what isn’t: three colors

The simplest way is to divide data into three groups. An employee will remember colors faster than paragraphs.

Green: you can paste

• public texts, e.g. descriptions from the company website,
• general questions (“how to write a quote for window installation”),
• your own text drafts without client data,
• anonymized data from which a person or a company can’t be identified.

Yellow: only in a business plan and after anonymizing

• internal procedures and instructions,
• contract excerpts with the names of the parties removed,
• anonymous sales summaries,
• the content of emails after replacing data with labels such as “Client A”.

Red: never paste

• personal data of clients and employees (name, address, phone, PESEL (Polish national ID number), email),
• health data and other special categories of data,
• passwords, API keys, access credentials to systems,
• wholesale price lists, margins, contracts with counterparties that are covered by confidentiality,
• code and documentation that must not be disclosed,
• card data, account numbers.

A one-question test: would I be OK with what I’m pasting ending up on a competitor’s or a client’s screen? If not, I don’t paste it.

How to anonymize a text in 2 minutes

Most tasks can be done without real data. Replace it with labels:

1. Replace first and last names with “Client A”, “Client B”.
2. Replace company names with “Company X”.
3. Remove addresses, phone numbers and emails entirely.
4. Round amounts or replace them with sample ones.
5. Read the text once more, looking for details by which someone could be recognized (a rare job title, an unusual project).

Only then paste the text prepared this way into the tool. Fill in the real data in the answer outside of it.

Other rules: check, label, ask

An AI policy isn’t only about input data. Add a few rules about what comes out:

• A human checks the output. AI is wrong in a confident tone: it invents numbers, regulations and company names. Nothing goes to a client without being read.
• We don’t cite AI as a source of facts. Prices, deadlines and legal requirements are verified in official sources.
• We label where needed. Since 2 August 2026, Art. 50 of the AI Act requires a chatbot on a website to say that it is AI, and some AI-generated content, such as deepfakes, must be labeled. Details in the guide on an AI chatbot and the AI Act.
• Everyone knows whom to ask. Name one person who settles doubts.
• We report slips without punishment for honesty. If someone pastes something they shouldn’t have, they should say so right away.

A one-page AI policy template

Below is a draft to copy. Adjust the tool names and the contact person.

AI use policy at [company name] In force from [date]. Person responsible for the rules: [full name, contact].

1. Permitted tools: [e.g. ChatGPT Business on company accounts]. We do not use other AI tools for work without permission.
2. Accounts: for work we use only company accounts, not private ones.
3. Green data (public, general questions) may be pasted.
4. Yellow data (procedures, anonymized texts) we paste after removing personal data and names.
5. Red data we never paste: personal data, health data, passwords, keys, contracts and price lists covered by confidentiality.
6. We check the output. Nothing from AI goes to a client without being read by a human.
7. We label AI content and chatbots where the law requires it.
8. Doubts and slips we report immediately to [person]. Nobody is punished for an honest report.
9. We review the rules every 6 months and after changing tools.

How to implement the policy in a week

1. Day 1: list the AI tools your team already uses. Ask outright, without judging.
2. Day 2: check the privacy settings and terms of the selected tools, including the option of training on data.
3. Day 3: choose the permitted tools and set up company accounts.
4. Day 4: adapt the template above to your company.
5. Day 5: run a 30-minute meeting with examples from your own work and write down who attended. Such a list helps demonstrate care for the team’s AI literacy.

If you want to go further, I help with implementing AI in your business, and I can move your clients’ personal data to a separate database on a server in Poland or the EU.

Summary

An AI policy doesn’t have to be long. A list of permitted tools, a division of data into green, yellow and red, and a person you can ask are enough. You can implement the template above in a week.

If you want me to analyze where AI will really help in your business, or adapt your chat and materials to the requirements of the AI Act, write to me. I reply within 24 hours, and new clients get 20% off their first order.