How to develop a clear AI policy

  • KVK Editors
  • The basis
  • 11 February 2025
  • Edited 3 April 2026
  • 2 min
  • Managing and growing

More and more SMEs are using AI tools, such as chatbots and smart software. This presents opportunities but also brings risks. That is why it is important to establish clear guidelines on how you and your employees use artificial intelligence (AI). In this article, you can read what an AI policy is, why it is important for SMEs, and what elements it should include.

There is a wide choice of AI tools. These have advantages, but also come with challenges. For example, your employees may not know which tools they are allowed to use for their work. So develop a clear AI policy and put it in writing.

What is an AI policy?

An AI policy sets out guidelines to ensure that you use AI in your business in a safe and responsible manner. You can compile these guidelines into a document or include them into the staff handbook.

Is an AI policy mandatory?

An AI policy is not mandatory, but it helps business owners and employees to work safely with AI tools. It provides clear rules and prevents risks. If something does go wrong due to incorrect or unsafe use of AI, an AI policy also offers a legal safeguard.

With a good AI policy, you also immediately comply with the relevant regulations. In Europe, the EU AI Regulation (AI Act) applies. This law sets out how businesses must use AI safely and responsibly. And in the Netherlands, the GDPR determines how you handle personal data. So ensure that the data employees use in AI tools complies with this legislation.

Key elements of an AI policy for SMEs

These are the key elements of an AI policy:

Purpose of the policy

A good AI policy starts by answering the question:

  • What are the goals of the policy? For example, guaranteeing the safe use of AI for your staff and business. And ensuring that you comply with the legal requirements for using AI.

Definition and updates

In the next section of the AI policy, you will answer questions such as:

  • Who does the policy apply to? Does it apply to all employees or only employees in a certain position? And does the policy also apply to external parties and self-employed people, for example?
  • How do you keep the policy up to date with new technologies and regulations?

Safe use and monitoring

Here you answer questions such as:

  • For what purposes may employees use AI? Describe as precisely as possible the purposes for which the use of AI tools is allowed within your business.
  • What steps should employees take to keep company data safe? Here you can say that employees are not allowed to enter customer information or sensitive company information into AI tools. If you, as a user, enter confidential information, the tool stores it, and that information may also be viewed or retrieved by others.
  • Which AI tools are employees allowed to use, and which not? You can make a list of approved tools and update it regularly. A number of AI systems have already been banned since 2 February 2025.
  • On which devices can AI tools be used? For example, only allow employees to use AI tools on secure devices/networks.
  • What is not allowed? For example, entering personal data, company secrets, or sensitive customer information into AI tools that are not GDPR-proof.

Quality control and responsibility

  • How do you ensure that AI results are checked? Do not blindly accept the information given, but always check that it is correct. Earlier versions of AI tools in particular suffer from so-called ‘hallucinations’ (giving incorrect information) and may also be influenced by biases and outdated or incorrect information.
  • Who is responsible for any errors that arise from the use of AI?
  • What happens in case of a policy violation? For example, a warning or sanctions.
  • Who is the contact person for questions, approvals, and reports about AI use?

Training and awareness

In this last section, you answer questions such as:

  • What training or instructions do you offer to teach employees how to use AI tools safely and effectively? Since 2 February 2025, organisations that develop or use AI systems must ensure that their employees are AI literate.
  • Where can employees find the policy? Indicate here where the policy document can be found for all employees and how you will inform them when it is updated. Inform new personnel about the AI policy as soon as they are hired.

By basing your AI policy on the steps above, you offer clarity to your personnel. This allows them to make best use of the growing range of AI tools in their work.

Also of interest