Writing an AI usage policy your team will actually read

Most AI usage policies fail for the same reason: nobody reads them. They are twelve pages of borrowed legal language, copied from a template built for a company ten times your size, listing tools you do not use and scenarios you will never face. It sits in a shared drive, unread, until an auditor or a nervous client asks for it. That document does not change how anyone behaves, and behaviour is the whole point.

A good AI usage policy for a small team is short, specific, and tied to the tools you actually open every day. It tells people what they can use, what they must never do, and who to ask when they are unsure. One page, written in plain language, that a new hire can absorb in five minutes. This guide walks through what to put in it, how to keep it accurate, and how to roll it out so people genuinely read and follow it.

Why short and specific beats long and generic

A generic template tries to cover every AI system in existence, so it stays vague. Vague policies give no real guidance. When someone is about to paste a client contract into a chatbot to summarise it, "use AI responsibly and in line with company values" does not stop them. "Do not paste client documents into ChatGPT" does.

Specificity also makes the policy honest. If you name the five tools your team really uses and describe how each one should be handled, you are documenting reality rather than an aspiration. That matters under the EU AI Act, where almost every small business is a deployer, an organisation using AI systems under its own authority in a professional context, rather than a builder of them. A deployer's job is to use these tools carefully and be able to show they did. A policy anchored to your real toolset is part of that evidence. A generic one that describes tools you have never touched is not.

The approved tools list, with a risk tier

The heart of the policy is a short table of the AI tools your team is allowed to use, each with a note on how sensitive its use is. You do not need a formal risk assessment for everyday tools. You need a simple, honest tiering so people know where the care is required.

The EU AI Act sets out four risk tiers, and they are a useful frame here:

• Minimal risk: most everyday tools, such as a writing assistant that drafts marketing copy or cleans up an email. No specific legal obligations, though good practice still applies.
• Limited or transparency risk (Article 50): chatbots that talk to your customers, and any AI-generated or manipulated content such as synthetic images or video. These carry disclosure duties, covered below.
• High-risk (Annex III): AI used in areas like employment and worker management, for example screening job applicants, allocating tasks, or evaluating staff. These carry heavy duties including human oversight and record-keeping. Most small teams should simply avoid handing these decisions to AI.
• Prohibited (Article 5): banned practices such as social scoring or emotion recognition in the workplace. These are red lines, not risk levels.

For each approved tool, write one line: the tool name, what it is used for, and its tier. Anything not on the list is not approved until someone checks it. That single rule stops the quiet spread of unvetted tools, which is how client data ends up somewhere nobody intended.

The red lines

Every policy needs a short list of things that are never allowed, stated plainly. Keep this section blunt. These are the rules that protect your clients, your reputation, and your legal position all at once.

• No client or personal data in public AI tools. Do not paste names, contracts, health information, financial records, or anything identifying a person into a consumer chatbot whose inputs may be used for training or stored outside your control.
• No unsupervised high-risk decisions. AI does not decide who gets hired, fired, or evaluated. A human makes the call and can explain it.
• No prohibited uses. No emotion recognition on staff, no social scoring, none of the Article 5 banned practices.
• No passing AI output off as verified fact. Anything a model produces is a draft until a person has checked it.

Disclosure, confidentiality, and human oversight

These three sit close together because they all cover how AI meets the outside world.

Disclosure. Article 50 of the EU AI Act sets transparency duties. If a chatbot talks to your customers, it must tell them they are dealing with AI. If you publish AI-generated or manipulated content, such as a synthetic image or a deepfake-style video, that must be disclosed too. Turn this into a simple house rule: label AI chat interfaces clearly, and mark AI-generated media as such. It is easier to build this habit now than to retrofit it later.

Confidentiality and data handling. Spell out what counts as sensitive: client data, personal data, unreleased work, credentials. State where such material may go, which is usually only into tools you have vetted and that offer a business agreement covering data use, and where it may never go, which is public consumer tools. Keep it concrete so the answer is obvious in the moment someone is tempted.

Human oversight. The rule is simple: a person is responsible for every AI output that leaves the building or feeds a decision. AI drafts, a human owns. Whoever sends the email or ships the design is accountable for it, exactly as if they had written every word themselves. This one line does more for quality and safety than any amount of technical detail.

Who to ask, and how often you review it

People will hit situations the policy did not anticipate. That is fine, as long as they know where to go. Name a person or a role, whoever owns AI questions at your company, and make clear that asking is always the right move when something is unclear. A policy that punishes questions drives risky use underground. A policy that welcomes them surfaces problems while they are still small.

Then set a review cadence and put the date on the document. Every six months is reasonable for a small team, plus a quick look whenever you adopt a new tool or the rules change. The EU AI Act applies in phases. The transparency duties under Article 50 apply from 2 August 2026, while the heavier high-risk obligations under Annex III, for deployers and providers alike, were moved to 2 December 2027 by the 2026 Digital Omnibus, so a policy that is reviewed on a schedule will keep pace rather than going stale. A dated document also shows a client or regulator that this is a living practice, not a one-off gesture.

Rolling it out so people actually read it

Writing the policy is half the work. Getting it into people's heads is the other half. A few things make the difference:

• Keep it to one page. If it does not fit on a page, it will not be read. Cut, do not append.
• Use real examples. Show the actual tools and the actual situations your team faces. "Do not paste a client's contract into a free chatbot to summarise it" lands harder than an abstract rule about data.
• Walk through it once, together. Spend ten minutes in a team meeting reading it aloud and taking questions. That single session does more than any email.
• Ask for a sign-off. Have each person confirm they have read and understood it, with a date. This is not bureaucracy for its own sake. It is how "we told everyone" becomes something you can actually show.
• Fold it into onboarding. New hires read it and sign off in their first week, so the policy stays alive as the team changes.

An AI usage policy is one of the four artefacts that turn "we tried to be careful" into "we can show it," alongside a risk-classified tool inventory, role-based training with dated certificates, and a dated compliance record you can hand to a client, insurer, partner, or regulator. Klaar helps small European teams put those pieces together without drowning in legal text, but the policy itself is something you can start today. Open a blank page, list your real tools, draw your red lines, and keep it to a single page people will genuinely read. That is worth more than any twelve-page template gathering dust.