The good news: the minimum fits on two pages. This article describes what belongs in it — and what you can safely skip.
What actually goes wrong without a policy
No doomsday scenarios, just the three cases that genuinely occur. An employee uploads a customer list into a private, free AI account — free services are often allowed to use inputs for training, and at that point convenience becomes a data protection incident. A quotation goes out with an invented technical specification because nobody reviewed the AI-drafted wording. And the design department discusses details of a customer project with a chatbot while the NDA states that exactly this information must not leave the building.
All three cases share one cause: nowhere was it written down what’s allowed and what isn’t.
The five building blocks of the minimum
1. Approved tools, by name. A short list: these tools are permitted in their business editions; everything else needs approval. The core reason for business licences is in the contract: inputs are not used for model training. Free personal accounts for company data are off limits — that is the single most important rule in the whole document.
2. Data classes, in plain language. Not legalese, but everyday terms: Public information — free to use. Internal information — approved tools only. Personal data, customer data, design and contract data — only in tools explicitly cleared for it; when in doubt, not at all. Three categories are enough; whoever defines seven ensures that nobody applies any of them.
3. A review obligation, unambiguous. AI output is a draft. Everything that leaves the building — quotations, calculations, customer communication — is reviewed by a person who carries professional responsibility for it. This one paragraph prevents the most embarrassing incidents.
4. An approval path for new tools. Whoever wants to use a new tool asks a named contact — and receives an answer within a defined period. The second half of that sentence is the crucial one: if approvals take weeks, shadow AI emerges and the policy becomes worthless.
5. A contact person and a known location. One name for questions, one place where the document lives. Sounds trivial; is missing surprisingly often.
Two mandatory appointments sit outside the document itself: the data protection officer sees the policy before it takes effect, and if there is a works council, it is involved early — AI use regularly touches co-determination topics, and a jointly supported set of rules works better than a decreed one anyway.
What you can skip
A forty-page AI governance handbook in year one. Ethics committees before the first productive use case. And detailed regulation of tools you don’t even use yet. The EU AI Act belongs on your radar — for most mid-sized use cases (drafting assistance, internal analytics) the obligations are manageable, but check your own case rather than ignoring or dramatising it. A policy that is lived beats a framework that sits on a shared drive.
Rollout: a culture question, not an announcement
The difference between a policy that works and one that gets ignored rarely lies in the text. It lies in how it lands. A short training session with real examples from your own company — what went well, what nearly went wrong — achieves more than any all-staff email. And the message has to be right: the rules exist so that everyone can use these tools, not so that nobody does.
Whether a policy is your first step, or whether the next one is already waiting behind it, is what our Data Readiness Check sorts out in five minutes. And if, while reading, you realised that shadow AI already exists in your company: no cause for alarm — just a good reason to write those two pages now.