AI usage policy template for SMEs: a page you can copy

An AI usage policy template for SMEs, in eight clauses

An AI usage policy template for an SME needs eight clauses, and they fit on two pages: purpose and scope, approved tools, data classes, human review, labelling, responsibilities, training, and a review date. Copy the template below, replace the square brackets with your own tools and people, and have management sign it. Filling it in takes an afternoon. Which tools you allow is the decision the template cannot make for you.

This is for owners, managing directors and office leads in a Swiss SME with 5 to 80 people and no in-house legal team. Staff already use ChatGPT, Copilot or Gemini, and nobody has written down what is allowed. You are not the exception. According to the AXA SME labour-market study, cited by DeepCloud, only 34 percent of companies have set clear rules on which data employees may enter into AI tools. Among firms with fewer than ten employees it is 23 percent. Those are the study’s figures, not ours.

The template is a working document for the office. It is not legal advice.

Which law the policy rests on

You do not need to wait for a Swiss AI act before you write this page. The FDPIC states that the Federal Act on Data Protection (FADP, nDSG in German) is technology-neutral and applies to AI-supported data processing. Your policy is the practical form of duties you already have.

Two points from the FDPIC’s position shape the template. Those who use AI systems have to be transparent about the purpose, the functionality and the data sources of the processing. And people have a right to know whether they are speaking or corresponding with a machine. That is why labelling gets a clause of its own, even in a firm whose only AI contact point is a chatbot on the website.

If you process health data, let software make decisions about people (applications, credit, dismissals) or sell into the EU, the template is only a starting point. Take it to your data-protection adviser or lawyer before anyone signs.

The template to copy

• 1. Purpose and scope. This policy sets out how AI tools are used for work at [company]. It applies to everyone who works for us, including apprentices and freelancers, on company and private devices, whenever work content is involved.
• 2. Approved tools (allow-list). Only these tools may be used for work: [tool 1, company account], [tool 2, company account]. Private and free accounts are not allowed for work content. [Name] decides which tools are added or removed.
• 3. Data classes. Public (website copy, published prices): allowed in approved tools. Internal without personal data (process notes, templates): only in approved tools with a company account. Personal and customer data: only in [tool] and only for [purpose, e.g. drafting replies to customer emails]. Never in any AI tool: health data, salaries, identity documents, passwords and access credentials, [client files]. If in doubt: never.
• 4. Human review. Anything that leaves the company (email, quote, report, figure, post) is read first by a person who takes responsibility for it. AI drafts, a person sends. AI does not decide about people on its own, for example on applications or dismissals.
• 5. Labelling. Where customers or applicants communicate directly with an AI system (chatbot, automatic reply), this is clearly stated. AI-generated images, voices or videos of real people are labelled as such, or not used.
• 6. Responsibilities. Owner of this policy: [name, management]. Contact for questions and new tools: [name]. Incidents (wrong data entered, a wrong output sent) go to [name] the same day, without blame.
• 7. Training. Everyone who uses an approved tool has attended the introduction ([length]) and read this policy. New employees do both in their first week.
• 8. Review. [Name] reviews this policy every [six] months, and whenever a vendor changes its terms or someone requests a new tool. Version and date are at the top of the page.

Sign it, date it, give it a version number. Two pages in the words your office already uses do more than twenty pages nobody opens. Name the tools by the product people actually have open, not by a category such as “generative AI solutions”.

How to fill it in: one afternoon, one example

Start with what is already in use, not with a market overview. The template only works if clause 2 names the tools people really use and clause 3 uses examples from your own inbox.

An example: an engineering office with around 25 people, everything on Microsoft 365. The managing director asks in the Monday meeting which AI tools people use for work, and on which account. No consequences for honest answers. The replies: several private ChatGPT accounts, one person with a paid private plan, two people using the chat inside Microsoft 365, one translation website.

For clause 2, the office approves Copilot Chat, which comes with its Microsoft 365 subscription, used with work accounts, and nothing else for now. For clause 3 it takes three real items from last week: a press release (public), a checklist for site visits (internal), and a client’s email about a defect, with name and address (personal). Those three go into the text as examples, because “personal data” is abstract and “the defect email from last Tuesday” is not. The office manager becomes the contact in clause 6. The managing director signs. The walkthrough with the team takes 30 minutes.

The less comfortable result: under clause 2 the paid private plan cannot stay for work content. Say so plainly and name the approved tool in the same sentence.

What does not belong in the policy

Admin settings, tool comparisons and prompt collections stay out, because they change faster than the policy should.

• Click paths and settings. They belong with whoever administers your Microsoft 365 or Google Workspace. The policy says which tool. The settings make that true. Approving the tools is a separate step with its own checklist.
• Prompts and tips. They go into training material, not into a document people sign.
• Copied legal text. Link the FDPIC page instead.
• A blanket ban. A ban without an approved tool moves work chat onto private phones you cannot govern.
• The vendor contract. A policy does not replace the data processing terms with the vendor. Those exist on the business account, which is one reason clause 2 excludes private accounts.

Who should not adopt the template unchanged

Firms whose data or decisions carry higher risk should use the eight clauses as a structure and have the content reviewed.

• Medical practices, therapy and care providers. Health data is sensitive personal data, and clause 3 needs professional input.
• Anyone who uses software to screen applications or assess people. Clause 4 then carries legal weight, not just good practice.
• Firms with customers or an establishment in the EU. EU rules can apply alongside Swiss law.
• Firms bound by confidentiality duties towards clients that go beyond ordinary business discretion.

For everyone else, the template as written is a reasonable start.

Next step: the page first, then the team

The page gets signed in an afternoon. Getting 15 or 20 people to apply it on an ordinary Thursday is a different job: knowing which tool fits which task, what AI does reliably and where it breaks, and how to check a draft before it goes out. That is what the AI in Business workshop is for: half a day or a full day, up to 20 participants, on site or hybrid in Switzerland, practised on real tasks from your team. Your draft policy is useful material for the preparation.

If what you actually have is one recurring task that should run differently, not a team question, that is the Process Check: one task, 30 minutes, and you leave with a case and a price range. How to pick that task first: which process to automate first.