AI policy for SMEs: the template with 10 rules for your employees
Jens Margraf ·
AI policy for SMEs: 10 rules with a data traffic light, 4-step rollout and a free generator for your AI directive as a Word file – based on Swiss law.
Friday afternoon, just before the weekend. An accountant wants to quickly draft a payment reminder and copies the entire customer list with open invoices into her private ChatGPT account. Bad intent? None. A breach of data protection law? Very likely. And the problem: nobody ever told her she must not do that. That is exactly what an AI policy in an SME is for – not as bureaucracy, but as a guardrail.
Most Swiss SMEs already use AI. Very few have clear rules for it. This article shows what belongs in a good AI policy, sums up the key points in ten rules – and with our free generator you can turn them into your own directive as a Word document in five minutes.
Why does an SME need an AI policy at all?
Because AI is already in your business – whether you planned it or not. According to the SME labour market study 2025 by AXA and Sotomo (in German), 34% of Swiss SMEs deliberately integrate AI into their work processes, and another 37% are testing it. Yet only around a third of AI-using companies have a clear data protection rule for AI applications. Among businesses with 5 to 9 employees, it is just 23%.
The consequence is what we call shadow AI: employees use private accounts, free tools and browser extensions – with company data, without a contract, without control.
Three reasons why this concerns executive management directly:
- The FADP applies to AI too. The Federal Data Protection and Information Commissioner (FDPIC) has made clear that the revised Data Protection Act is technology-neutral and covers every AI-supported processing of personal data. No separate AI law is needed for that.
- Fines hit people, not companies. Unlike the GDPR, fines under Swiss law target the responsible natural person – up to CHF 250,000 for intentional violations.
- More rules are coming. To implement the Council of Europe's AI Convention, the federal government is preparing a consultation draft that, according to the federal SME portal (in German), is expected in spring 2027. If you create order today, you will not have to scramble tomorrow.
And a look across the border shows: even in Germany, the leader in the OECD comparison, only 45% of SMEs using generative AI have introduced guidelines for their employees (Statista/OECD, in German). So if you act now, you are not late – you are ahead.
What belongs in an AI policy?
A good AI policy answers four questions: Which tools? Which data? Who reviews? Whom do I ask? Everything else is decoration.
| Building block | Regulates | Why it matters |
|---|---|---|
| Approved tools | Which AI applications are allowed | Only business versions come with a data processing agreement (DPA) |
| Data traffic light | Which data may go into which tool | Protects personal data and business secrets |
| Human oversight | Who reviews and takes responsibility for AI output | AI hallucinates – responsibility stays with humans |
| Transparency | When AI use is disclosed externally | FADP information duties and labelling |
| New tools & incidents | Process for requests and reports | Prevents sprawl and covered-up mistakes |
| Training & review | Rollout and annual update | Rules only work when they are understood |
Our stance is clear: an AI policy that only bans things produces shadow AI. Employees will use the tools anyway – just in secret. A good policy enables first and limits second.
The short version: an AI policy in 10 rules
The ten rules are the short version for your employees. The generator further down creates the complete directive with your details, tool register, checklist and acknowledgement form.
1. Purpose and scope
This policy governs the use of AI tools at [company name]. It applies to all employees, apprentices and external staff – in the office, working from home and on private devices, whenever company data is processed. We want to use AI actively. These rules make sure we do it safely.
2. Approved tools only
For company data we use exclusively the AI tools on the list in the appendix: [e.g. aibox, DeepL Pro]. Which tool is approved for which traffic-light level is also stated in the appendix. Private accounts (including paid ones like ChatGPT Plus or Claude Pro) are not allowed for company data – they run under consumer terms without a data processing agreement.
3. The data traffic light
| Level | Examples | Rule |
|---|---|---|
| Green: public | Website copy, published product information, general professional questions, texts with no reference to people or customers | Allowed in all approved AI tools |
| Yellow: internal | Internal documents, drafts, quotes without pricing, meeting notes, personal data that is not particularly sensitive (e.g. a contact person's name and role) | Only in tools explicitly approved for "Yellow" in the appendix: data processed in Switzerland or with equivalent protection, no training on your inputs, data processing agreement in place. Personal data only as far as necessary, anonymised where possible. |
| Red: confidential | Particularly sensitive personal data (e.g. health), personnel files and salary data, business secrets (prices, margins, strategy, finances), customer data under a non-disclosure agreement, passwords and access credentials | As a rule, no input. Exceptions only with prior approval from executive management for a specific tool and a specific purpose. |
When in doubt, the stricter level applies – and ask [responsible person] briefly before entering data.
4. Humans review – always
AI results are drafts, not facts. Language models can "hallucinate", inventing convincing-sounding but false statements. Anyone who reuses an AI result reviews it and takes responsibility for it – just as with a text prepared by an intern.
5. No automated decisions about people
Decisions about job applications, dismissals, creditworthiness or performance reviews are made by a human here. AI may support, but never decide alone. Such applications require prior approval from [responsible person] and, where applicable, a data protection impact assessment.
6. Transparency towards the outside
When customers interact with an AI system (e.g. a chatbot), we point this out. AI-generated images, videos or voices of real people are clearly labelled. Details are set out in our guide to the AI labelling obligation.
7. Confidentiality and third-party rights
Documents we receive under a non-disclosure agreement are only uploaded to AI tools with the counterparty's consent. Before publishing AI-generated texts and images, we check whether third-party rights (e.g. trademarks, copyright) could be affected.
8. Request new tools instead of just trying them
Anyone who wants to use a new AI tool contacts [responsible person]. We check: is there a business version with a contract? Is training on our data excluded? Where is the data processed? The goal is a decision within [5] working days.
9. Report mistakes – without blame
Anyone who has accidentally entered red data into an AI tool or yellow data into a non-approved tool reports it immediately to [responsible person]. We look for solutions, not culprits. Only a reported mistake can be fixed. The company then checks whether a report to the Federal Data Protection and Information Commissioner (FDPIC) is required (Art. 24 FADP).
10. Training and review
All employees receive a short introduction to this policy. [Responsible person] reviews the policy and the tool list at least once a year. Questions? [Email / Teams channel].
Your AI directive in 5 minutes – free, as a Word file
Instead of retyping placeholders: our generator creates the complete directive with your details – company name, governing body, contact person, your AI tools and effective date are already filled in. It also includes the data traffic light, tool register, employee checklist and acknowledgement form. Optional add-ons for professional or banking secrecy and for the GDPR if you have customers in the EU. A template, not legal advice.
How to roll out the AI policy in 4 steps
A policy in a drawer protects nobody. Here is how it becomes part of everyday work:
- Take inventory. Ask openly and without reproach: which AI tools are you using today? You will be surprised. This list is your starting point.
- Approve a secure alternative. Before you restrict anything, offer a tool that is at least as good as what people use in secret. A central platform like aibox bundles several AI models under one roof, with selectable Swiss hosting and no training on your inputs – so it meets the requirements for the Yellow level, and you do not have to review five separate contracts.
- A 30-minute introduction. Not a PDF circular, but a short joint session with examples from your daily work. Everyone understands the data traffic light once they have seen it applied to three real cases.
- Update your privacy policy. If you use AI with customers' personal data, that belongs in your privacy policy – including any disclosure abroad.
After that: review the policy annually, keep the tool list up to date. AI tools change faster than any set of regulations.
Three mistakes we see in practice
The prohibition policy. "The use of ChatGPT is prohibited." Sounds safe, but it is not. Usage moves to private phones – and you lose all control.
The 20-page document. Legally flawless, read by no one. What employees cannot grasp in two minutes, they will not apply in daily work.
Rules without skills. A policy says what is allowed. It does not say how to use AI well. If you give your team rules but no AI fluency, you get results that are safe but poor. Our experience: 20% technology, 80% people.
Conclusion: two pages that protect you more than any firewall
An AI policy for SMEs does not need to be long or complicated. It needs four answers – which tools, which data, who reviews, whom do I ask – and the will to enable AI rather than prevent it. The ten rules above are the core – create the complete directive in the generator in five minutes. Adapt it, roll it out, and review it once a year.
The best time for this is not when the new AI law arrives. It is before the next customer list lands in a private account.
For municipal administrations there is a separate version with cantonal data protection law and official secrecy: AI directive for municipalities (in German).
My question to you: does your company already have an AI policy – and if so, is it actually lived in everyday work?
Introduce AI safely – with a plan, not a gut feeling
You do not want to set up the policy on your own? In our AI consulting we work with you on tool selection, the policy and the rollout. And with aibox, your employees get a secure platform for everyday AI.
FAQ
Is an AI policy legally required in Switzerland?
No, there is no explicit obligation. However, the Data Protection Act requires that personal data is processed securely and for a defined purpose – including with AI. A written AI policy is the simplest proof that you have implemented this duty of care organisationally.
How long should an AI policy for an SME be?
The core rules should fit on two pages – a policy nobody reads protects nobody. The tool list, checklist and acknowledgement form belong in appendices that you update continuously.
Can I simply ban the use of ChatGPT in the company?
Legally yes, but in practice it is rarely wise. A pure ban drives usage into private accounts, where you have no control over the data at all. Better: approve secure tools and define clear rules about which data may be entered.
Does the AI policy also apply to employees working from home or on private phones?
Yes, as soon as company data is involved. The policy should explicitly state that company data may only be processed in approved tools – regardless of which device or location.
Who should be responsible for the AI policy in an SME?
A named person with a direct line to executive management – in small companies often the management itself or the IT lead. What matters is not the title, but that employees know whom to contact with questions or incidents.
Jens Margraf, CEO and founder of AI now AG