AI usage policy and vendor review for companies
SMEs, law firms and service providers whose staff already use AI tools without clear rules.
Updated: 2026-10
The package puts AI use in your company into clear shape: an initial inventory of all AI tools, a short, understandable usage policy, a review of the key AI vendors for data use and contracts, a quick approval process and kick-off training that also evidences the measures under Art. 4 AI Act.
In most companies AI has long arrived in everyday work: chat assistants, writing aids, AI features in existing software. Often without an overview, with personal accounts and without clarity on which data may go in. That is a data protection and confidentiality risk and leaves the duty under Art. 4 AI Act unmet.
Bans do not help because they get bypassed. What helps is a short, practical framework: which tools, which data, which responsibility — and a way to approve new tools quickly.
What you get
AI inventory
An initial record of all AI tools and features in use with purpose, user group, data, role under the AI Act and risk classification — managed in AI Risk Check if desired.
Usage policy
A short policy with approved tools, data rules with examples, a duty to check outputs, transparency rules and an incident reporting route.
Vendor review
Review of the key AI vendors for training on customer data, processing location, retention, contracts and security, with a clear recommendation per tool.
Approval process
A lean route for teams to request new tools and for who reviews them, linked to the inventory.
Kick-off training
A compact training for all users on capabilities, limits, data rules and prompt injection, with documented attendance.
How it runs
- 1
Discovery
Short survey of teams and review of tools and subscriptions.
- 2
Policy and review
Draft the policy, review vendors, agree results with management.
- 3
Rollout
Run the kick-off training, start the approval process.
- 4
Handover
Hand over inventory, policy and review results, set a review date.
Price framing
Fixed price by scope. The range depends on team size and number of tools and is set in a short initial conversation.
Indicative, not a binding quote — the frame is confirmed during scoping.
What drives the price? → Cost guide
Parent service: EU AI Act & Compliance Advisory
FAQ
Is an AI policy legally required?
Not in a particular form. Art. 4 AI Act does require measures supporting AI literacy; a policy with training is the simplest way to implement and evidence such measures.
Do you ban tools like ChatGPT?
No. The goal is safe use: suitable account types, clear data rules and checking of outputs.
What about professional secrecy, for example in law firms?
It is addressed explicitly in the data rules. For legal assessment in individual cases we recommend consulting the relevant professional body or a law firm.
What comes after the package?
Inventory and policy are reviewed on a fixed cycle. Those wanting to integrate AI more deeply into processes or products find the next step in building AI governance.
AI usage policy and vendor review for companies
SMEs, law firms and service providers whose staff already use AI tools without clear rules.