Who this guide is for. Small businesses and professional firms that use generative AI (Claude, ChatGPT, Gemini) for everyday tasks: drafting, summarizing, translating, or analyzing documents. The EU framework applies across the European Union; references to employment law and national authorities concern Spain. It is a template to adapt, not a document that fits every company or every use. If your company is larger, the template is a starting point, but you will also need an approval process, alignment with your security and data protection policies and, where applicable, negotiation with employee representatives.
1. What an AI acceptable use policy is, and what it is for
An AI acceptable use policy is an internal guide that explains which tools the team can use, with what information, and under what supervision.
In many small businesses, AI doesn't arrive through a management decision. It can arrive because someone tries ChatGPT for a tricky email, someone else summarizes a report with Gemini on a personal account, and a third person connects an app to their inbox to save time. Nobody acts in bad faith, but the company doesn't know what information has left the building or who reviews what goes out to clients.
A policy answers three questions:
- Which tools? The ones the company has chosen, with business accounts.
- What information? Based on a simple traffic light the team can apply without asking every time.
- What supervision? Who reviews, who approves, and who to ask when in doubt.
Limits of this template. The template is a starting point for a first version. It doesn't replace a review of your contracts, your confidentiality obligations, or the rules of your industry. If your company handles sensitive data or works in a regulated sector, have it reviewed by your legal advisor or your data protection officer.
2. AI acceptable use policy template for small businesses
Copy the text and replace what appears [in brackets]. The examples are illustrative: delete anything that doesn't apply to your company.
ARTIFICIAL INTELLIGENCE ACCEPTABLE USE POLICY — [COMPANY NAME]
Version [1.0] · Approved by [role] on [date] · Next review: [date]
1. Purpose and scope
This policy explains how we use artificial intelligence tools at [Company]: with which tools, what information, and what supervision. It applies to everyone who works at or for [Company] (employees, freelancers, and external contributors) when they use AI for company tasks.
2. Approved tools
For company work, only the tools on this list are used, with the account indicated:
| Tool | Plan or account | Used for | Owner |
|---|---|---|---|
| [E.g.: Claude] | [E.g.: company Team plan] | [Drafting, summaries, document analysis] | [Name] |
| [E.g.: Gemini] | [E.g.: included in the company's Google Workspace] | [Email, shared documents] | [Name] |
No personal accounts, free or paid, are used with company information. To use a new tool, submit a request to [owner], who reviews it before approving it.
3. Information that can be used
The colors are internal rules at [Company]: some match legal obligations, others are prudent choices made by the company.
- Green: can be used in approved tools. Public information and non-confidential internal texts: no personal data, no trade secrets, and no information the company isn't entitled to share. A document without personal data is not automatically free to share.
- Amber: only if all three conditions are met. (1) The tool is approved and configured according to this policy; (2) the information is necessary for the task, and only what is necessary is used; (3) the company is entitled to share it (client contract, confidentiality agreement, professional secrecy). Examples: [internal documents, client data, quotes].
- Red, never: not entered into any AI tool. [Passwords, access keys, and credentials, including online banking; full payment card numbers and their security codes].
- Red, after review: only after a specific review. [Health data or other special categories of data; children's data; files covered by professional secrecy; third-party information under confidentiality; IBANs and other bank details of clients or suppliers]. [Management] decides after checking the legal basis, the contract with the provider, and the tool's configuration. An internal approval does not replace those conditions.
4. Uses
4.1. Prohibited by law. Uses prohibited by the EU AI Act, for example inferring people's emotions in the workplace, except for medical or safety reasons.
4.2. Not allowed at [Company]. [E.g.: making a decision about a person based solely on an AI response; sending a client AI-generated content without reviewing it; using AI to infer people's emotions, under any circumstances].
4.3. Subject to prior approval by [owner]. [E.g.: recruitment and employee evaluation; any new use involving amber information].
5. AI actions
Some tools can act on the user's behalf: send messages, edit or delete files, make purchases, or connect to other apps. At [Company]:
- connecting an AI tool to email, cloud storage, or another app requires approval from [owner];
- no tool sends external messages, makes payments, or deletes files without a person confirming first;
- [other rules].
6. Human review and transparency
All AI-generated content is reviewed before it is used outside the team, especially figures, names, dates, quotes, and legal references. The review is done by someone with the expertise needed to check the content. The person who uses it is responsible for it. We disclose that content was generated or modified with AI when the law requires it or when [Company] decides to: [e.g.: realistic images, audio, or video].
7. Training, questions, and incidents
Everyone receives training suited to their role and the tools they use [when they join / by (date)]. We keep a simple record: date, people, and content.
Questions: [owner, channel].
If information is shared without authorization (for example, amber or red information in an unapproved tool or account), or a tool takes an unexpected action, [owner] is notified immediately via [channel].
The list of tools is reviewed every [6 months]; the policy, every [12 months] or when the law or the tools change.
Want the editable version? Email me at patrik@coachiapro.com and I'll send it to you.
3. How to adapt its seven sections
Scope. Include freelancers and contributors who work with company information. According to the European Commission's questions and answers, the AI literacy measures of Article 4 also cover "other persons" acting on the organization's behalf, such as contractors or service providers.
Approved tools. The real decision isn't Claude, ChatGPT, or Gemini, but business account or personal account. Business plans offer centralized administration and specific terms on how data is used; personal accounts don't. Before filling in the table, check each plan's terms: we explain this in Is it safe to use AI with company data? and compare the plans in Claude vs ChatGPT vs Gemini.
Traffic light. Be specific: a vague ban ("don't enter sensitive information") forces everyone to decide alone what counts as sensitive. For the traffic light to work, each color needs examples from your own business. And a business plan isn't enough to move to green: the information also has to be necessary, and the company has to be entitled to share it.
Uses. Separate what the law prohibits, what your company prohibits, and what needs approval. Mixing them creates confusion: using AI in recruitment isn't prohibited, but it does require a prior review (see section 7).
Actions. This is the section that falls short fastest. Tools no longer just write: they connect to email, calendars, and shared folders, and they can act. The useful rule is simple: AI prepares, a person confirms.
Human review. Define who reviews what. In a small business, one rule is often enough: whoever sends or signs reviews, with the expertise needed to check it. Rereading isn't enough to validate a calculation or a legal reference you don't master: in that case, the review goes to someone who can check it.
Training and incidents. The record can stay simple: the Commission states that Article 4 doesn't require certificates. A typical incident is pasting a confidential document into a personal account: what matters is that the team knows who to tell, and tells them right away.
4. Three common situations, and why they are decided this way
| Situation | Light | Conditions | Who approves |
|---|---|---|---|
| A salesperson prepares a client proposal from meeting notes | Amber | Business tool configured; only the client information needed for the proposal; no data from other clients; prices and commitments reviewed before sending | The salesperson; their manager if there are special terms |
| An office manager reviews supplier invoices to spot errors | Amber (IBANs and bank details: red after review, per the template's internal rule) | Business plan configured; only the data needed; no payment without human review | The office manager |
| A law firm summarizes a client file | Red, after review | First check professional secrecy, the client's engagement, and the tool's terms | The partner in charge of the file |
Why the client proposal is amber, not green. It contains the client's name, their needs, and often prices: confidential information, even without particularly sensitive data. It's a legitimate and useful use, but with the business tool and only what's needed. What shouldn't go in are other clients' proposals used as a "model."
Why a manager can't approve just any red data alone. Entering health data or a file covered by professional secrecy doesn't depend on the company's will: it depends on whether there is a legal basis, what the contract with the provider says, and how the tool is configured. The internal sign-off comes at the end of that review; it doesn't replace it.
Why connecting an inbox needs a different review than summarizing an email. When someone pastes an email into a conversation, they choose what they share. When they connect their inbox, depending on the permissions granted and how the connector works, the tool may access messages and attachments beyond the content selected for a task, including third-party data, and sometimes act. Before approving a connection, review the permissions it requests, the provider's terms, and whether access can be limited.
5. A 90-minute workshop format for a first draft
This is the workshop format I suggest for producing a first draft, not an approved, rolled-out policy.
- Inventory (20 min). Everyone says which tools they use today, with which account, and for which tasks. No judgment: the goal is to see the situation as it is.
- Traffic light (25 min). Sort the company's types of information into green, amber, and red, with concrete examples.
- Rules (25 min). Approved tools, uses that require approval, rules for actions and for review.
- Owners and next steps (20 min). Who approves the text, who answers questions, when the team is trained, and when the policy is reviewed.
Afterward: approval by management, communication to the whole team, training suited to each role and, where applicable, informing employee representatives (see section 7).
6. What the law requires, and what it doesn't
When a company uses Claude, ChatGPT, or Gemini for everyday tasks like the ones in this guide, it normally acts as a deployer under the EU AI Act, not as a provider. The Act doesn't require a document called an "acceptable use policy," but it does require measures that a policy helps organize.
| Situation | What the company should review | Reference |
|---|---|---|
| The team uses AI to draft, summarize, or translate | Measures to support the AI literacy of the people using it, suited to their knowledge and the context. The Commission cites this exact case: people must be informed of risks such as hallucinations. Personal data processed in line with the GDPR | Article 4 of the AI Act, applicable since February 2, 2025, amended by Regulation (EU) 2026/1744 |
| AI-generated text is published to inform the public on matters of public interest | Disclose that the text was AI-generated, unless it has undergone human review or editorial control and someone holds editorial responsibility | Article 50(4), applicable since August 2, 2026 |
| Realistic images, audio, or video are generated (deep fakes) | Disclose that they are artificial, with adapted rules for creative or satirical works | Article 50(4) |
| A chatbot is set up to serve clients | Check with the provider that the system tells people they are interacting with AI, and review what data it collects | Article 50(1) (provider obligation) and GDPR |
| AI is used to recruit or evaluate employees | It may be a high-risk system, with deployer obligations from December 2, 2027. Already today: GDPR (automated decisions) and, in Spain, informing the works council | Annex III, point 4 (dates: Regulation (EU) 2026/1744); Article 22 GDPR; Article 64.4.d of the Spanish Workers' Statute |
| AI is used to infer people's emotions at work | Prohibited, except for medical or safety reasons | Article 5(1)(f), since February 2, 2025 |
What Article 4 doesn't require, according to the European Commission: a specific level of knowledge, measuring each person's level, certificates, or a particular governance structure. It does require real measures: handing out the policy isn't enough on its own.
New from December 2, 2026: Regulation (EU) 2026/1744 adds to the prohibited practices, among others, the use of AI systems to generate realistic intimate images, video, or audio of an identifiable person without their consent.
In Spain, the Spanish Agency for the Supervision of Artificial Intelligence (AESIA) oversees the application of the AI Act, together with other authorities such as the Spanish Data Protection Agency (AEPD). The draft organic law on the proper use and governance of AI, approved by the government in May 2026, lapsed on October 6, 2026, according to its record at the Congress of Deputies (121/000096), following the dissolution of Parliament (Royal Decree 806/2026 of October 5). The general election is on November 29, 2026; it will be up to the new legislature whether to take it up again. In the meantime, the EU AI Act applies directly.
This section is for information only and does not constitute legal advice.
7. Cases that need a specific review
Human resources. Screening résumés, assigning tasks, or evaluating performance with AI affects people's rights. Beyond the GDPR, in Spain the Workers' Statute gives the works council the right to be informed of the parameters, rules, and instructions of algorithms or AI systems that affect decisions on working conditions, access to employment, and job retention, including profiling (Article 64.4.d), and to issue an opinion on introducing systems for organizing and monitoring work (Article 64.5.f). The procedure depends on the project: review it before you start.
Professional secrecy and confidentiality. Law firms have their own ethical obligations. Advisory and consulting firms may have confidentiality obligations under contract or under their professional rules, to be checked case by case. For professional services: AI for professional services firms.
Sensitive data. Special categories of data (health, for example) and children's data are two separate matters, each with its own rules. By default: red after review, with your data protection officer if you have one.
Agents and connectors. A tool connected to email or shared folders can access more information than the user shows it. Approve each connection and check its permissions.
8. Common mistakes
- Banning everything. A blanket ban can encourage unauthorized use, on personal accounts and without rules.
- Copying a twelve-page template. A document that's too long can be hard to apply. Better a short text with examples from your own company.
- Not defining what counts as sensitive information. Without examples, everyone decides alone.
- Forgetting actions. A policy limited to what people type into the chat falls short as soon as someone connects an app.
- Never reviewing it. Tools change every few months; the list of approved tools should keep up.
9. Frequently asked questions
Is an AI acceptable use policy mandatory?
The EU AI Act doesn't require a document by that name. Since February 2, 2025, it does require measures to support the AI literacy of the people who use AI (Article 4). A written policy is a simple way to organize those measures and keep a record of them.
Do we have to inform employee representatives?
It depends on the use. In Spain, if AI is involved in decisions that affect working conditions, access to employment, or job retention, the works council has the right to be informed (Article 64.4.d of the Workers' Statute). In other countries, national employment rules apply. Review it case by case.
Can we use the free version of ChatGPT, Claude, or Gemini?
For public information, it may be acceptable if your policy allows it. For company information, a business plan is the better choice, as its terms on data use and account administration are different.
How often should it be reviewed?
The list of tools, every six months as a guide; the full policy, once a year or when the law, the tools, or the uses change.
Who should approve it?
Management. Drafting it with the team helps it reflect day-to-day use.
Is the policy enough to comply with Article 4?
No. The policy organizes use, but Article 4 calls for measures suited to the people involved: training, support, or resources depending on their role and tools.
We adapt this policy to your team's tools, data, and tasks, and help you train the team and put it into practice. Book an intro call: 30 minutes, free, and a tailored proposal within 5 business days. Prefer to start with the editable version of the template? Email me at patrik@coachiapro.com.
Sources (accessed October 21, 2026)
- Regulation (EU) 2024/1689 on artificial intelligence, Articles 4, 5, and 50 and Annex III — AI Act Service Desk, European Commission.
- Regulation (EU) 2026/1744 (Digital Omnibus on AI) — EUR-Lex.
- European Commission, AI Literacy – Questions & Answers — digital-strategy.ec.europa.eu.
- Spanish Workers' Statute (Estatuto de los Trabajadores), Article 64 — BOE.
- Government of Spain, draft organic law on the proper use and governance of AI — La Moncloa.
- Congress of Deputies, record 121/000096, status "Concluido – Caducado" (concluded – lapsed) — congreso.es.
- Royal Decree 806/2026 of October 5, dissolving the Congress of Deputies and the Senate — BOE.
- Google Cloud, Office of the CISO, How to craft an Acceptable Use Policy for gen AI (2024) — cloud.google.com.