AI Usage Policy in a Company: How to Prepare It

An AI usage policy in a company is a concise internal document that clearly defines which artificial intelligence (AI) tools employees may use, what data they are suitable for, and which boundaries must not be crossed. It is the first practical step for a small Lithuanian company to demonstrate that it uses AI deliberately and responsibly - not chaotically. A well-written policy fits on one to three pages, is understandable to every employee, and simultaneously helps meet the requirements of the EU AI Act (Article 4) for responsible AI use.

A practical AI policy must answer four questions: which tools employees may use, what data must not be entered into them, who reviews the results, and how often the rules are reviewed.

What Is an AI Usage Policy and Why Is It Needed?

An AI usage policy is a set of internal company rules that define how employees may and may not use AI tools in their daily work. Unlike technical documentation, it is written in plain language and is intended for everyone - from the manager to the new employee on their first day.

The policy is necessary for three specific reasons:

• Data protection. Without clear rules, employees may paste client personal data, contract texts, or confidential information into public AI tools. This can violate GDPR and confidentiality obligations.
• Responsible use. The policy establishes that AI-generated results must always be reviewed by a human and clearly states where AI use is prohibited (e.g., for legal opinions or final decisions without verification).
• Compliance. The EU AI Act expects companies to use AI in a structured manner. The policy, together with the AI tools register and compliance record, provides evidence that your company acts responsibly.

Even if your team consists of only a few people, one common rule for everyone is better than ten different unofficial practices. Without a policy, the risk of shadow AI arises - when employees use tools that management is not even aware of.

In practice, the policy also serves a fourth, often overlooked function: it gives employees confidence. When a person knows exactly what they are allowed to do with AI, they work more boldly and efficiently, rather than avoiding tools out of fear of making a mistake. Thus, a good policy does not hinder AI use but encourages it within safe boundaries.

Is an AI Usage Policy Mandatory Under the EU AI Act?

The EU AI Act (Regulation (EU) 2024/1689) does not directly require a written "AI usage policy" as a separate document. However, Article 4, which entered into force on 2 February 2025, requires that companies (both AI providers and deployers) take measures to support the development of AI literacy among employees and relevant persons, considering their knowledge, experience, training, context, and the people who may be affected. This obligation does not require guaranteeing a specific or sufficient individual level of literacy.

A policy is one practical way to organise these measures and record the rules the company has chosen. It shows that the company not only talked about responsible AI but also established concrete written rules. Key dates of the AI Act to remember:

Most Lithuanian micro-enterprises fall under the "deployer" category - they do not create AI but use ready-made tools (ChatGPT, Copilot, Canva, etc.). For them, the Article 4 obligation is the most relevant, and the policy helps implement it. For more details, see the article EU AI Act Article 4: What It Actually Requires.

What Should an AI Policy Template Cover?

A good AI policy template does not need to be long, but it must clearly answer practical questions that employees encounter daily. The recommended structure is as follows:

1. Purpose and scope. One sentence explaining the purpose of the policy and to whom it applies (all employees, interns, contractors).
2. Permitted tools. A specific list of AI tools that may be used and for what purposes. This list should align with your AI tools register.
3. Prohibited actions. Clearly list what is not allowed - e.g., pasting personal data into public models, using AI results without verification, creating misleading content.
4. Data rules. What information may or may not be entered into AI. This is directly related to AI and personal data protection. GDPR does not ban AI use outright - it requires assessing the lawful basis, data minimisation, using approved tools, and implementing safeguards.
5. Human oversight. The requirement that AI-generated text, code, or decisions must always be reviewed by a responsible person.
6. Accountability and contact. Who in the company is responsible for compliance with the policy and whom to contact with questions.
7. Review procedure. How often the policy is updated (recommended at least once a year or when a new tool is introduced).

Separate the policy from the practical Employee AI Guide: the policy sets rules and limits, while the guide explains how to use tools properly and safely. Both documents complement each other.

How to Prepare an AI Usage Policy Step by Step

For a small company, the practical process looks like this:

Step 1. List what is already in use. Before writing the rules, find out the reality. Ask the team which AI tools they already use at work - often, several programs that management was unaware of come to light. This list will form the basis of your AI tools register.

Step 2. Define data boundaries. Determine what information in your company is sensitive (client data, finances, contracts) and clearly state that it must not be entered into public AI tools without safeguards.

Step 3. Define permitted and prohibited actions. Instead of abstract phrases, write concretely: "AI may be used for drafting texts and generating ideas," "AI results must always be reviewed by an employee," "it is prohibited to paste client personal data into unapproved public tools."

Step 4. Assign a responsible person. In a small company, this is often the manager themselves. It is important that there is one person to contact with AI-related questions.

Step 5. Inform the team. A policy only works if employees read and understand it. It is convenient to combine this with AI literacy training, which also helps fulfill the Article 4 obligation. This training and these documents are recommended practical records but are not mandatory legal minimums or a guarantee of compliance. The free path is for one signed-in participant; team training is included in the paid documentation package.

Step 6. Document and review. Sign the policy with a date, store it along with other compliance documents, and set a date for the next review.

For a small company, this entire process realistically takes a few hours if starting from scratch. Most of the time is spent not on the policy itself but on defining sensitive information boundaries and aligning the tool list with what is actually used. Therefore, it is worth initially allocating half an hour for an open conversation with the team - it often reveals more than assumptions.

How Often Should the AI Policy Be Updated?

It is recommended to review the AI policy at least once a year and additionally every time a new AI tool is introduced in the company or when legal regulations change. The AI market moves quickly: tools that did not exist a year ago may now be part of daily work, and some features (e.g., data storage settings) can change without notice.

A practical way not to forget this is to link the policy review with the AI tools register. When you add a new tool to the register, immediately check if the policy is still valid. This way, the document remains alive and does not become a formal piece of paper that becomes outdated after a few months. Consistent updates are also the best evidence that the company manages AI deliberately.

Common Mistakes When Preparing an AI Policy

Small companies preparing an AI policy independently often stumble over the same issues:

• Too long, legalistic document. A twenty-page policy that no one reads does not protect against anything. One clear rule is better than ten incomprehensible ones.
• Vagueness without specifics. The phrase "use AI responsibly" means nothing. Specific examples of what is allowed and what is not are needed.
• Policy without a register. A policy that does not specify which tools are allowed to be used leaves a gap through which shadow AI spreads.
• One-time document. AI tools change rapidly. A policy not reviewed for a year becomes outdated.
• Copying from a large corporation. A bank or multinational company’s policy is not suitable for a five-person team - it is too complex and includes obligations that you do not even need.

AI Documents from Expert-Reviewed Templates Without High Costs

For a small company, writing an AI policy, register, and guide from scratch is a tedious task, especially when time and legal knowledge are lacking. This is exactly why nebedirbam.lt was created: the service automatically prepares all EU AI Act Article 4 documentation - AI usage policy, AI tools register, compliance record, and employee AI guide, plus AI literacy training with knowledge checks and certificates - at a fixed €149 + VAT (€299) price based on expert-reviewed templates, without consultation queues or hourly rates.

The documents are tailored to the AI tools you actually use based on a short questionnaire, not copied from a generic template. The documents are generated from templates reviewed by a compliance specialist and adapted using your answers. They do not guarantee legal compliance; the company remains responsible for its applicable obligations. If you first want only training, you can start with free AI literacy training.

An AI usage policy is the simplest and most cost-effective way to transition from chaotic AI use to deliberate use. It protects your data, helps fulfill the Article 4 obligation, and provides clarity to employees. Start with what is already in use, write down simple rules, and do not forget to review the policy when a new tool appears.

Sources: Official explanation of EU AI Act Article 4 and EU AI Act regulatory framework.

The Article 4 activity record can bring together the guidance and training steps you have actually taken. More practical guidance is available in the article collection.