Knowledge base
An AI policy for your SME: what goes in it?
By Bob Biesemans · published on
ChatGPT, Copilot and Gemini are already in use, with or without rules. A one-page AI policy for Belgian SMEs: which tools, which data, who checks, and how you know it works.
Short answer
An AI policy for an SME fits on one page with six parts: approved tools, which data may go into which tool, checking AI output, when to disclose AI use, an owner, and training and measurement. Then measure whether staff apply it in their work.
Why one page is enough
An AI policy nobody reads changes nothing. For most SMEs one page with clear rules and examples from your own work is enough. The aim is not to ban AI, but to use it safely and usefully.
The six parts
1. Approved tools: which AI tools may be used for work, with which account. Free personal accounts usually aren't among them.
2. Data: what may go into which tool. A green, orange and red scheme works well: public, internal without personal data, and sensitive.
3. Checking: AI output is a draft. Amounts, names, dates and legal statements are always checked before they go to a customer or into the books.
4. Openness: when to say that a text or image was made with AI, for example a realistic AI image or a text you publish to inform the public.
5. Owner: who answers questions, approves new tools and updates the policy.
6. Training and measurement: how staff learn to work with AI and how you check that it works.
From policy to behaviour
Signing a policy is not the same as applying it. So measure per department whether staff make the right choices in situations from their work: do they recognise sensitive data, check figures, turn a vague request into a clear instruction? What doesn't work, you address with a short lesson and a retest.
Link it to your record
The AI policy, the training and the measurements together are the measures you can show under Article 4 of the AI Act. Keep them dated in one record and review the policy at least yearly or when you introduce a new tool. General information, not legal advice.
Frequently asked questions
Does an SME need an AI policy?
The AI Act doesn't require a separate document, but a policy is the simplest way to set rules and show the measures you took for AI literacy.
Can I ban ChatGPT at work?
You can, but a blanket ban often pushes use out of sight. An approved business tool and clear data rules usually work better.
How often should I update the policy?
At least yearly, and whenever you introduce a new AI tool or the way of working changes.