AI Usage Policy for Small Teams

An AI usage policy is the written house rule for how your team uses AI tools such as ChatGPT, Claude or Gemini: which tools are allowed, which data may go in, who checks the results and when something gets labelled. EU law does not require a specific document, but the EU AI Act does require measures to support your people's AI literacy, and a written rule is a simple form of that which you can point to. For a small team, one or two pages are enough.

I am a developer, not a lawyer, and this is not legal advice, just the operator's perspective, under EU and German law. My fourteen AI employees run on Claude Team, some also on open models or through the API. They work under a written rulebook. I read the legal texts at the source on 27 October 2026: the AI Act in its consolidated version on EUR-Lex, the German Works Constitution Act and the German Trade Secrets Act. More on AI in day-to-day business is collected on my AI Basics page.

Why a policy makes sense

An AI usage policy bundles obligations that apply anyway into one page that everyone understands:

• AI literacy. Under Article 4 of the AI Act, providers and deployers of AI systems "shall take measures to support the development of AI literacy" of their staff and of other persons dealing with AI systems on their behalf. You are a deployer as soon as your business uses AI professionally. There is no set format. Germany's Federal Network Agency (Bundesnetzagentur), however, recommends documenting the measures well and setting "goals and responsibilities". The details are in AI Literacy Under the AI Act: Training Staff.
• Data protection. Customer data falls under the GDPR (EU law). If an AI provider acts as a processor, meaning on your behalf, Article 28 GDPR requires a data processing agreement. Among other things, it states that the provider processes the data only on your documented instructions. The agreement is necessary, but not everything: settings and the question of which data may go in at all need settling too, and everyone needs to know the rule, not just you. My three questions before every input are in AI and Privacy: What the AI Gets to See.
• Trade secrets. Under section 2 no. 1(b) of the German Trade Secrets Act, information is only protected if, among other things, it is the subject of reasonable secrecy measures appropriate to the circumstances. A clear rule on what must not go into third-party tools can be one of those measures.
• Works council. If you have one, German law (section 90(1) no. 3 of the Works Constitution Act) requires you to inform it in good time when planning work processes, expressly including the use of artificial intelligence. For tools that can monitor behaviour or performance, it has a right of co-determination under section 87(1) no. 6. You should also check section 87(1) no. 1, which covers matters relating to the order of the business and the conduct of employees. Whether an AI usage policy falls under it is best clarified professionally. More on this in Do I Need an AI Officer?.

What belongs in the policy

Seven points cover almost everything for small businesses. This is my recommendation, not a list from any law.

1. Who is responsible. One person who answers questions and keeps the policy up to date. In a team of five, usually the owner.
2. Which tools are allowed. With name and plan, for example "Claude Team via the company account". Rule out private accounts for company data explicitly.
3. Which data may go in. Easiest as a traffic light: green for public information and your own drafts, amber for internal information and customer data, which may only go into approved tools with a data processing agreement, red for anything that never belongs in an AI tool, such as passwords and login details.
4. Who checks and approves. AI results are drafts. Whatever goes to customers, authorities or the public is checked by a person first.
5. When to label. Since 2 August 2026, the transparency obligations of Article 50 of the AI Act apply, such as disclosing deepfakes. The policy sets out how you handle that day to day.
6. What applies to other people's content. Don't upload other people's photos, logos or texts as templates unless you have the rights, and check AI results for recognisable third-party works before publishing.
7. Where mistakes and questions go. A way to report nonsense, data mishaps or uncertainty without anyone fearing trouble. Plus a date on which you review the rule.

Template to adapt

The following template is a framework for a small business without high-risk uses. Replace the brackets and delete what doesn't fit.

AI usage policy of [business], as of [date]

1. Responsible: [name]. Questions about AI tools go to this person.

2. Allowed tools: [tool and plan, e.g. via the company account]. Other tools only after checking with [name]. We don't use private accounts for company data.

3. Data: Green, allowed: public information, our own texts, anonymised examples. Amber, only in [approved tools with a data processing agreement] and only as much as needed: internal information, customer data. Red, never: passwords, login details, [others, e.g. personnel files or health data].

4. Review: AI results are drafts. Whatever leaves our business is checked by a person first for facts, figures and tone.

5. Labelling: Images, videos or audio that look real but were generated or altered with AI are labelled visibly.

6. Third-party content: We don't upload other people's works we have no rights to, and we check AI results before publishing.

7. Learning and reporting: Everyone gets a briefing on the tools they use. We report mistakes and uncertainties to [name]. We review this policy on [date].

How to introduce it

1. Ask first, then write. Ask your team which tools they already use and what for. That list is also the Bundesnetzagentur's first step: identify the need.
2. Go through it together. Half an hour with the team is enough, with one example per traffic-light colour from your own work.
3. Record who was briefed. Date, topic, participants. That is your AI literacy documentation.
4. Sharpen it. After three months, ask where the rule got in the way or was missing.

In my own business, one rule applies that I recommend to every small team: whatever leaves the business, I approve, and a separate role checks it first. That is my working rule, not a legal requirement.

What to watch out for

• Don't copy a corporate template. Nobody in a small business reads twenty pages. One page that people actually follow protects you more.
• Bans need an alternative. If you only ban things without naming an allowed tool, you invite people to use private accounts.
• Include freelancers. Article 4 also covers persons dealing with AI on your behalf.
• High risk is a different chapter. Anyone who wants to use AI to select job applicants, for example, faces considerably more obligations from 2 December 2027. A house rule is not enough for that; then you need professional advice.

Frequently asked questions

Is an AI usage policy mandatory?

The AI Act does not require a specific document. It does require measures for AI literacy, and the Bundesnetzagentur recommends documenting them. A short policy with a briefing is a simple way to do that. This is not legal advice.

What should an AI usage policy include?

Responsibility, allowed tools, a rule for data, who checks results, when to label, how to handle third-party content and a way to report mistakes. The template above covers all seven points.

Is there an AI policy template?

Yes, above in this article. It is meant for small businesses without high-risk uses and needs adapting to your tools and data.

Does a works council have to agree to an AI policy?

In Germany, if there is one, it must be informed in good time about the use of AI under section 90 of the Works Constitution Act. For tools that can monitor behaviour or performance, it has a right of co-determination under section 87(1) no. 6. A second point to check is section 87(1) no. 1 on the conduct of employees. Whether the policy itself falls under it is best clarified professionally.

Does the policy apply to freelancers too?

For AI literacy, yes: Article 4 expressly includes other persons dealing with AI systems on your behalf. The easiest way is to include the key rules in their brief.

Where to go from here

Today, write down only points 2 and 3: which tools are allowed and which data belongs in which traffic-light colour. The rest follows from talking to your team. What exactly applies to labelling is the next step: AI Disclosure Rules Under the EU AI Act. Before that on the learning path: Can You Detect AI Text? What Detectors Do. If your team is just getting started with AI, have them read AI for Beginners: What to Know First first. You will find every AI term explained briefly in my AI glossary. How other businesses write down their AI rules is what we discuss in my community Claude Practitioners. Membership does not replace a legal review.