What is an AI policy?
An AI policy is a short document that sets out how your business uses AI: which tools are allowed, which data may go into them, who checks the output and who to contact with questions or mistakes. The example further down this article fits on two A4 pages.
Many businesses do not have one yet. Research by ABN AMRO and MWM2 among 777 Dutch organisations found in June 2026 that 78 percent of SMEs use AI and that 9 percent have a formal policy for external AI tools (Dutch IT Channel). The Exact SME Barometer, carried out by Markteffect among more than 1,700 business owners, found 70 percent AI use in August 2026. Of those business owners, 47 percent do not yet know how to use AI effectively and 48 percent hesitate to let employees work with company data in AI applications (MKB Servicedesk).
Without agreements you get shadow AI: employees using AI tools on their own initiative that the business does not know about or has not approved, often with a free personal account. An AI policy makes those tools visible.
Are you required to write an AI policy?
No law requires a document called an AI policy. A few rules do ask for agreements that you record in one:
- AI literacy (Article 4 AI Act). Since 2 February 2025, organisations that use AI must take measures to develop the AI literacy of their people. Since Regulation (EU) 2026/1744 entered into force on 27 July 2026, the law sets no fixed level for this. According to the European Commission's questions and answers, you need no certificate and no specific governance structure. You can keep an internal record of the training and other measures you have taken.
- Agreements on input (Dutch Data Protection Authority). The Autoriteit Persoonsgegevens (AP) warned in August 2024 about data breaches caused by employees entering personal data of customers or patients into AI chatbots. Its advice: decide whether employees may use such tools and, if so, which data they may and may not enter. In July 2026 the AP published a tool for organisations that want to deploy generative AI. Its first question is whether you can use generative AI without processing personal data.
- Transparency (Article 50 AI Act). Since 2 August 2026, transparency rules apply to AI that communicates with people and to content made with AI. The European Commission published guidelines on Article 50 on 20 July 2026.
- Data breaches (Article 33 GDPR). If personal data ends up in a tool where it does not belong, that can be a data breach. Under the GDPR you report it to the AP within 72 hours, unless the breach is unlikely to pose a risk to the people involved.
No Dutch authority has been designated yet for AI Act fines; the implementation act is planned to go to the Dutch House of Representatives in the second quarter of 2027 (as of November 2026). The full timeline is in the EU AI Act explainer.
What goes into an AI policy template?
An AI policy for an SME has nine sections:
| Section | What you record | Why |
|---|---|---|
| 1. Purpose and scope | Who the policy applies to and for which work | Freelancers and interns know where they stand too |
| 2. Approved tools | Which tools and subscriptions are allowed, and how to request a new tool | Makes shadow AI visible |
| 3. Data | What may go in, what may not, and what only in anonymised form | AP advice and the GDPR |
| 4. Human review | Who checks output before it leaves the business | AI makes mistakes; decisions about people should not rest on a system alone (Article 22 GDPR) |
| 5. Transparency | When you tell customers AI was used | Article 50 AI Act |
| 6. AI literacy | Onboarding, training, a test and a record of who did what | Article 4 AI Act |
| 7. Roles | Owner of the policy and a contact person | One fixed point for questions and grey areas |
| 8. Incidents | What to do when something goes wrong and within what time | Breach notification, Article 33 GDPR |
| 9. Review | Date of the next review | Tools and rules change |
On transparency: telling people they are communicating with AI is a duty of the system's provider, and if you build your own AI agent for your website, you can be that provider. If you create realistic images with AI (deepfakes), you disclose that. You disclose AI-generated text on matters of public interest, unless a person has reviewed it and holds editorial responsibility for it.
AI policy example: text to copy
Copy the text below, fill in the parts in brackets and delete what does not fit your business. The example is written for an SME that uses AI assistants for writing, summaries and customer contact. If in doubt, have a lawyer review it.
AI policy [Company name], version [date]
1. Purpose and scope. This policy describes how we use AI tools at [Company name]. It applies to everyone who works for us: employees, freelancers and interns, in the office and at home.
2. Approved tools. For work you only use these tools, with the company's business account: [tool 1 and subscription], [tool 2 and subscription]. You do not use personal or free accounts for work. If you want to try a new tool, ask [contact person] first. They will let you know within [5 working days] whether the tool goes on the list.
3. Data. In an approved tool you may enter public information, your own drafts and anonymised data. You never enter: citizen service numbers (BSN), medical data, passwords and login codes, customers' financial data or [confidential contracts]. You only enter customer data with names or contact details in tools we have a data processing agreement with: [tool].
4. Human review. You are responsible for everything you create with the help of AI. Check facts, figures, names and sources before a text goes to a customer or out of the business. Decisions about people, such as applicants, customers or colleagues, are always made by a person.
5. Transparency. When customers communicate directly with one of our AI systems, we make clear at first contact that it is AI. Images, video and audio made with AI that look real are labelled as AI-generated. [Optional: we mention our use of AI in our privacy statement.]
6. AI literacy. Everyone who works with AI gets an introduction to this policy and the tools within [one month] of starting. Every year we do [the AI literacy test or a training] and we record in [document] who has completed which training.
7. Roles. The owner of this policy is [name, role]. Questions about tools, data or grey areas go to [name], via [email address or channel].
8. Incidents. Did you accidentally enter data that does not belong in a tool, or has an AI mistake reached a customer? Report it to [name] within [24 hours]. They assess whether it is a data breach and, where needed, report it to the Autoriteit Persoonsgegevens within 72 hours.
9. Review. We review this policy every [6 months], and whenever we approve a new tool. Next review: [date].
How do you roll out the AI policy in your team?
A policy works when your team knows it and the list matches what people actually use. These steps fit into a few weeks:
- Ask around first. Have everyone write down which AI tools they use now, including on their phone. That maps your shadow AI before you fix the list.
- Choose the tools and subscriptions. Pick one tool with a business account per task. Which subscriptions do not use your input to train models is covered in AI and privacy. What to arrange with the provider is in using AI within the GDPR.
- Discuss the policy in a team meeting. Walk through the data rules using examples from your own work.
- Measure AI literacy. The free AI literacy test has 55 questions and gives a certificate at 70 percent or higher. You can add the result to your internal record of Article 4 measures.
- Put the review in your calendar. Link the date from section 9 to a fixed meeting.
Frequently asked questions
Is an AI policy mandatory for SMEs? No law requires a separate document with that name. Since 2 February 2025, Article 4 of the AI Act has required measures for AI literacy, and the Dutch Data Protection Authority advises recording which data employees may enter into AI tools. An AI policy is where you record those agreements.
What goes into an AI policy? Nine sections: purpose and scope, approved tools, which data may go in, human review of output, transparency towards customers, AI literacy, roles and contact person, incidents and a review date. The example in this article fits on two A4 pages.
What is shadow AI? Shadow AI is employees using AI tools that the business does not know about or has not approved, often through a free personal account. According to ABN AMRO and MWM2, 78 percent of SMEs use AI and 9 percent have a formal policy for external AI tools (June 2026).
Do you need a certificate for AI literacy? No. According to the European Commission, Article 4 of the AI Act does not require a certificate. You can keep an internal record of the training and other measures you have taken.
How often should you update an AI policy? Plan a fixed review, for example every six months, and update the policy whenever you approve a new tool or the rules change.
Help with your AI policy
Want to see where your business stands with AI first? The free AI readiness scan has 7 questions. If you want to go through your own AI use together with a coach, you can do that in the 1-on-1 AI training: 3 hours with Tarik Eraslan, from €449 excl. VAT, with a 30-minute follow-up call.
