What should a one-page AI use policy contain for your SME or practice?
An AI use policy tells everyone what they can do with AI, with which tools, and above all which data must never go into it. One page is enough if it covers the essentials: the approved tools and their accounts, the data that is off limits (patients, staff, contracts, passwords), the duty to check every output, a contact person and a short training session. Once explained to the team, it also helps show that you have taken steps to train your staff, as Article 4 of the EU AI Act requires.
The scenario in brief
Example, made up for illustration. At a fictional physiotherapy practice, the receptionist has to summarise a long letter from a specialist doctor. She copies the text, including the patient's name, date of birth and diagnosis, into a consumer AI assistant open in her browser, on her personal account. The summary is very good. Nobody had told her this was not allowed, or why.
Nothing seems wrong that day. But health data has gone to an online service the practice never chose, on an account whose settings it does not control. The problem is not AI: it is the lack of a clear rule. A one-page policy fixes that.
Why write a policy now
AI is already in the office. According to Eurostat, 20% of EU businesses with 10 or more people used at least one AI technology in 2025, up from 13.5% a year earlier. That figure only counts uses organised by the business. It does not count the employee who opens a free tool on their own to save time, and that is often where the risk lies.
EU law points the same way. Since 2 February 2025, Article 4 of the EU AI Act has required organisations that use AI systems to take steps to build their staff's AI literacy. Amended in July 2026, it no longer demands a set level for each person, but the duty to act remains, and the EU and member states must give particular support to SMEs. The European Commission explains in its questions and answers that a business whose employees use a generative AI tool (an AI that produces text or images on request) to write or translate must tell them about its risks, such as ‘hallucinations’: made-up answers presented with confidence.
- No certificate needed: your teams do not have to sit any exam.
- An internal record is enough: the signed policy and the date of the briefing session.
- No set structure: no committee needed, one contact person is enough in a small business.
- Checked by national authorities since 2 August 2026: you can be asked for this record today.
A policy does not replace training, but it is the foundation: it is the document you explain to the team in 30 minutes and then keep close at hand.
The eight sections of a one-page policy
An effective policy fits on one page, in short sentences. If it runs to five pages, nobody will read it. Here are the essential sections, with a sample sentence for each:
| Section | What you write | Sample sentence |
|---|---|---|
| 1. The principle | AI is encouraged, within clear rules | ‘Use AI to write, summarise and translate, following the rules below.’ |
| 2. Approved tools | The list of permitted tools, with a work account | ‘Only the tools on the list, with your work email address. No personal accounts.’ |
| 3. Off-limits data | What must never be pasted into an AI tool | ‘Never a patient's name, a medical record, staff data or a password.’ |
| 4. Anonymise | Remove anything that identifies a person | ‘Replace names with “the patient”, “the client”, “the supplier”.’ |
| 5. Check | AI can be wrong with total confidence: a person checks everything | ‘Nothing goes out unchecked: figures, names, dates, legal references.’ |
| 6. Decide | AI suggests, a person decides | ‘No decision about a patient, client or employee rests on an AI answer alone.’ |
| 7. The contact person | Someone to ask questions and report problems to | ‘If in doubt or if something goes wrong, tell [name] the same day.’ |
| 8. Updates | A review date and a record of the training | ‘Policy read and explained on [date]. Next review: [date].’ |
Data: green, amber, red
This is the most important section, and the one your teams will remember if it is visual. The idea is simple: the more personal or confidential a piece of information is, the less it belongs in an online AI tool.
| Colour | Type of information | Rule |
|---|---|---|
| Green | Public texts, blank templates, ideas, rewording a text with no names | Free to use, with an approved tool |
| Amber | Internal document with no personal data: procedure, standard quote, staff memo | Approved tool and work account only, after removing sensitive figures |
| Red | Patient data, health data, staff records, contracts, bank details, passwords, unpublished figures | Never in an online consumer AI tool |
To help everyone decide, Belgium's Data Protection Authority (DPA) suggests a very simple question in its April 2026 brochure: ‘If I were at a dinner with unfamiliar people, would I be comfortable sharing this information about myself or someone else?’ If the answer is no, the information does not go into the tool.
The special case of healthcare practices
In a medical, dental or allied health practice, the red zone is large. The DPA points out that health data is sensitive data: processing it is prohibited in principle, with specific exceptions such as providing care. Pasting a patient file into a consumer AI assistant, on a personal account, does not count as providing care.
Removing the name is not always enough. A rare disease, an age and a town can be enough to identify someone. The DPA advises using pseudonyms where possible, or hiding the details that identify a person: names, addresses, age. For a practice, the simplest rule is still: no patient information in any online AI tool that the practice has not chosen and set up.
Choosing and setting up the approved tools
Banning things without offering an alternative pushes people to get round the rule. It is better to choose one or two tools, set them up properly and make them available to everyone. Before putting them on the list, ask these four questions:
- Are your conversations used to train the tool? The DPA advises checking the privacy settings, such as chat history or AI training, which are often switched on by default.
- Who manages the accounts? A work account, created with the office email address, can be closed when someone leaves. A personal account leaves with the person, history included.
- Where is the data kept, and for how long? The answer is in the terms of use of the business plan. If it is unclear, ask the supplier in writing.
- Does the tool connect to your email or your files? The more access a tool has, the more carefully you need to check who sees what before turning it on.
These answers fit on one line per tool in the policy: the tool's name, the type of account, and what can go into it (green or amber).
Making the policy binding in your business
A policy nobody knows about protects nobody. Have it read, explain it and keep a record: a signature or an attendance list from the briefing session. For freelancers, interns or temporary staff who use your tools, ask for a signature too.
If you want to be able to sanction a breach, you need to go further. The FPS Employment (page in French and Dutch only) points out that the work rules must state the penalties and the breaches they apply to, and that changing them follows a set procedure. Without a works council, the draft is posted and employees have 15 days to record their comments in a register. If there are any, the Social Law Inspectorate tries to reach an agreement. A copy of the work rules must then be filed with the Social Law Inspectorate (online) within 8 days of their entry into force. Your payroll provider can handle this and add the AI rules.
The model policy, to adapt
Here is a starting point that fits on one page. Fill in the brackets and remove anything that does not apply to you.
- Yes to AI for writing, summarising, translating, rewording and finding ideas, with the tools on the list: [tool, type of account].
- Work accounts only, created with your office email address. No personal accounts for work.
- Never in an AI tool: a patient's name or file, health data, staff data, contracts, bank details, passwords, unpublished figures.
- Anonymise everything else: replace names with a role (‘the patient’, ‘the client’).
- Check everything before use: AI can make up figures, names or references. You remain the author of what you send.
- AI does not decide: no decision about a person rests on its answer alone.
- Say so when a document given to a client or patient was largely written with AI, if that may matter to them.
- No new tools (browser extensions, apps, tools connected to email) without [contact person]'s approval.
- A voice or a video is not proof of identity: any unusual request for payment or data is checked through another channel, on the number you already know.
- Any doubt, mistake or data shared by accident: tell [contact person] the same day. A mistake reported quickly can be fixed; a hidden one gets worse.
Monday morning: five steps
- Ask the team, without judging, which AI tools each person already uses and for what. You will start from reality.
- Choose one or two approved tools and create the work accounts.
- Adapt the model policy above and name a contact person.
- Present it in 30 minutes at a team meeting, with examples from your line of work, and have it signed.
- Set a review date in six months: tools change fast, and so should the policy.
A one-page policy needs no budget and no big IT project. It lets your teams use AI with confidence, and lets you know where your data goes.
Frequently asked questions
Is an AI use policy mandatory?
No law requires a policy as such. But since 2 February 2025, Article 4 of the EU AI Act has required organisations that use AI to take steps so that their staff learn how to use it and understand its risks. A policy explained to the team, with a record of the session, is the simplest way to do this and to show it.
Do my employees need an AI training certificate?
No. The European Commission states that no certificate is needed. Keeping an internal record of the training or guidance given is enough, for example the signed policy and the date of the briefing session.
Can my employees use a free consumer AI assistant?
For public content or content with no personal data, yes, if the policy allows it. For patient data, staff data or confidential documents, no: the settings of these tools, such as chat history or training on your conversations, are often on by default and the business does not control them. It is better to offer an approved tool with work accounts.
Can a patient file be anonymised and used with AI?
Removing the name is not always enough: a rare disease, an age and a town can identify someone. Health data is sensitive data, and processing it is prohibited in principle, with some exceptions. For a practice, the safest rule is to put no patient information into any online AI tool that the practice has not chosen and set up.
Can I sanction an employee who does not follow the policy?
To be able to sanction, the penalties and the breaches they cover must appear in the work rules, and changing these follows a procedure set by law (without a works council: posting the draft, 15 days for comments in a register, then filing a copy with the Social Law Inspectorate). Your payroll provider can help you add the AI rules.