PAI-DOC-13
2026-07 · Trust
The company AI policy: the full model, on one page.
An AI usage policy sets out in writing what is allowed in the company: accounts, data, verification, transparency, tools, doubt, signature.
The full model is published in the clear on this page: seven articles, one page, to copy out, adapt and have signed.
Signed and filed, it becomes your first demonstrable piece of evidence under the AI-literacy measures required since February 2025.
01
A twelve-page policy will be neither read, nor applied, nor remembered.
An AI usage policy sets out in writing what is allowed, on which accounts, with which data. One page is enough, and it is even the condition: a one-page policy, signed and presented in person by management, changes behaviour the very next week; twelve pages join the documents no one reads.
The need is immediate: in most SMEs, AI usage exists before the first written rule, often on personal accounts, with client data. The policy does not create this usage, it gives it a framework.
02
The full model fits below, to copy out and have signed.
1. Accounts.
Only the accounts provided by the company are used for work. No business document goes through a personal account, free or paid.
2. Data.
Never, on any account: health data, banking data, trade secrets, documents under a confidentiality agreement. Only on approved company accounts: day-to-day client and commercial documents, quotes and correspondence included, within the limits set by [officer].
[Complete according to your business.]
3. Verification.
An AI output is a draft, never a finished product. Every piece of generated content is reviewed and corrected before use, and anything that goes to a client is approved by the person who puts their name to it.
4. Transparency.
AI-generated content released to the public is labelled as such, in line with the company's policy.
5. Tools.
The list of approved tools is kept by [officer]. Any new tool, extension or AI feature is submitted to them before use, never after.
6. Doubt.
When in doubt about a piece of data or a use, ask [officer] before, not after. Asking is never held against anyone; not asking can be.
7. Signature.
This policy is presented by management, signed by everyone, and reviewed at every change of tool.
Signed at ................................ , on ....... / ....... / ...........
Name and signature: ...............................................
Fig. 01 · Indicative model: it adapts to your business and does not replace legal advice.
This seven-article model is published in the clear, word for word the one from the executive guide. Copy it out, replace [Company] and [officer], complete article 2 according to your business, and have it signed.
It is indicative: it adapts to your business and does not replace legal advice.
03
Three conditions decide whether the policy works or just decorates.
Presented, not emailed: a policy sent out by email joins the documents no one reads. Fifteen minutes in a meeting, led by management itself, and everyone understands that the subject is serious, and that it is not aimed against them.
A visible trade-off: the policy bans personal accounts; it only holds if the company provides proper professional accounts. You do not take away a tool that saves time without giving the equivalent.
Dated, signed, filed: attached to the tools register, it becomes your first demonstrable piece of evidence, the one a client, an insurer or an auditor will ask to see. It is also one of the AI-literacy measures the EU AI Act has required since February 2025.
04
The typical mistakes repeat themselves, and they can all be avoided.
The sprawling policy: twelve legal pages no one reads, that protect less than a single page understood. The punitive policy: banning without providing an alternative pushes usage towards personal accounts, exactly what you wanted to avoid.
The orphan policy: with no named officer, questions have no recipient and new tools come in without review. The frozen policy: never revisited, it goes out of date at the first change of tool, and its signature no longer proves anything.
The remedy is the same in all four cases: one page, one officer, one trade-off, one review at every change of tool.
05
The annotated version lives in chapter 3 of the guide, sent by email.
The executive guide devotes its chapter 3 to this policy: the same model, annotated line by line, with the three conditions detailed and the order-of-magnitude budget for professional accounts.
It is obtained free of charge by email, from the form in the main dossier: a first name, a professional email, and the guide goes out, with no further solicitation.
06
Continue
Go further
- The EU AI Act, for an SMEWhat the policy demonstrates: the real obligations, dated and sourced.
- The executive guideThe annotated version of this policy lives in its chapter 3, sent by email.
- The four-week AI auditThe policy, drafted and presented, is one of the deliverables, along with the register and the measurement.
07
Commitments
Four commitments, on every engagement
These commitments are set out in our presentation deck. They hold for every engagement, from the diagnostic to managed operations.
- Contact
- Dedicated, end to end
- Progress point
- Weekly
- Environments
- Permanent access
- Reply
- Within 24 working hours
08
Decide
Two minutes to know where you stand.
A straight answer: what applies to you, and whether a project makes sense. If the answer is no, you leave with the answer.
Regulation (EU) 2024/1689 · PAI-DOC-13