Checklist: an AI usage policy that people actually follow
For: SMEs, law firms and teams using AI tools day to day
Updated: 2026-10
An effective AI usage policy sets out, briefly and clearly: which tools are approved, which data may go into them and which may not, that people check and own outputs, when AI use is disclosed, how new tools are approved, what training exists, how incidents are reported and when the policy is reviewed.
In almost every company, employees already use AI tools, whether or not there are rules. A policy does not forbid this; it makes it safe and traceable. It is also a central building block of AI literacy measures under Art. 4 of the AI Act and of lean AI governance.
This checklist describes what belongs in a policy that is actually read and followed. Each step states how you know it is done.
The checklist
- 01
Define approved tools
Keep a short list of approved AI tools with the permitted purpose for each, such as text drafts, translation, code or research. Provide company accounts with a contract rather than personal accounts.
Done when: A current list of approved tools with purpose and account type exists and is known to everyone.
- 02
Formulate clear data rules
Set which data may go into which tools: public information yes, confidential business information and personal data only into tools with a contract, training excluded and a known processing location, sensitive data and professional secrets in principle not. Concrete examples help more than abstract categories.
Done when: The policy contains a simple classification of data types with examples and the permitted tool class for each.
- 03
Assign responsibility for outputs
State that people check and own AI outputs before they are used, sent or published — especially professional, legal and numerical statements. AI outputs are drafts, not sources.
Done when: The policy names the duty to check and the areas where it applies particularly strictly.
- 04
Define transparency
Set when AI use is disclosed: chatbots and automated replies to customers, published text on matters of public interest without editorial review, images and video imitating real people or events. This corresponds to the transparency obligations under Art. 50 AI Act.
Done when: The policy lists the disclosure cases and a standard wording for them.
- 05
Regulate approval of new tools
Set a simple, quick route for employees to request new tools and who reviews them: data use, processing location, contract, cost. Every approval is recorded in the AI inventory.
Done when: A request route with a responsible person is described, and new tools appear in the inventory after approval.
- 06
Plan training
Provide a short introduction for all users on capabilities, limits, hallucinations, data rules and prompt injection, deeper for roles with particular responsibility. Document attendance; this also evidences the measures under Art. 4 AI Act.
Done when: A training plan per role exists, and attendance is recorded with dates.
- 07
Report incidents
Set what to do if confidential data has accidentally gone into an unapproved tool, an AI output has caused harm or a tool behaves unexpectedly. Blame-free reporting encourages incidents to surface.
Done when: A reporting route with a contact person is described and linked to the data breach process.
- 08
Set a review
Review the policy on a fixed cycle and on significant change: new tools, new regulations, lessons from incidents. Keep it short — a policy nobody reads has no effect.
Done when: A review date and a responsible person are set; the policy runs to a few pages.
Common mistakes
- —A policy that bans all AI use and is therefore quietly bypassed.
- —Abstract data categories without examples, so nobody knows in practice what is allowed.
- —Personal accounts used for work data because company accounts are missing.
- —An approval process taking weeks, so teams go their own way.
- —Training without documentation, missing as evidence under Art. 4.
What this checklist does not cover
- —This checklist is not legal advice. Professionals bound by secrecy, such as lawyers, doctors or fiduciaries, have additional duties to be checked separately.
- —It does not replace an employment law review, for example on employee representation or workplace monitoring.
- —For companies that themselves provide AI systems or deploy high-risk systems, a usage policy is not enough; further obligations apply.
- —It reflects the legal position as of October 2026, including the version of Art. 4 as amended by the Digital Omnibus.
Parent service: EU AI Act & Compliance Advisory
Matching offers
AI Act literacy training
Article 4 of the EU AI Act requires measures to support AI literacy among staff. This training meets that obligation practically and by role: the people who deploy and oversee AI understand what the systems do, where their limits lie, and when an output should be questioned.
Building AI governance
AI governance gives your handling of AI a repeatable structure: an AI policy, a risk inventory, clear roles and a lifecycle process — oriented to ISO/IEC 42001. The result is the organisational backbone that produces the records the AI Act requires, audit-ready and durably.
FAQ
Is an AI usage policy legally required?
The AI Act prescribes no particular form. Art. 4 does require measures supporting AI literacy, and a policy with training is the simplest way to implement and evidence such measures.
May employees use ChatGPT or similar tools?
Yes, if the policy allows it and the data rules are followed. For confidential information and personal data, company accounts with a contract and training excluded should be used.
How long should a policy be?
Short enough to be read — usually a few pages with concrete examples. Details such as the list of tools can sit in a separate, easily updated annex.
What if confidential data has already gone into a tool?
Report the incident, check which data is affected and whether the provider stores it or uses it for training, and assess whether there is a data breach requiring notification.
More checklists
Checklist: vetting AI vendors and AI features before use
Before using an AI service, clarify ten questions: is your data used for training, where is data processed, how long are inputs stored, is there a data processing agreement, how is security evidenced, what is your role under the AI Act, what documentation does the vendor provide, how are model changes announced, how are costs capped and how do you exit.
Checklist: using AI safely in law firms and fiduciary offices
AI can save law firms and fiduciary offices a lot of time but touches professional secrecy and data protection directly. Use becomes safe with clarified secrecy duties, tools with a contract and no training on client data, minimised data, checking of every statement and citation, transparency towards clients, and a policy with training.
Checklist: website relaunch for law firms and fiduciaries
A law firm relaunch succeeds when practice areas and people are clearly structured, old addresses are cleanly redirected, content is factual under professional rules, the contact form is designed for confidentiality, structured data and local details are correct, and indexing and enquiries are measured after launch.