Skip to content
AImori
EN
Free for Chrome
Menu

AI policy template for small businesses

Employees use ChatGPT, Copilot and other AI services, often without clear rules. A short AI usage policy sets out which tools are allowed and which data never goes into them. Here you will find a free template to adapt: as a Word file and as a fillable PDF, without sign-up and without an email address.

Preview: first page of the AI usage policy template with fields for company name, responsible person and approved AI tools

Word template (DOCX, 4 KB) Fillable PDF (38 KB)

Free, no sign-up and no email address. As of 14 October 2026.

Why an AI policy?

  • Swiss FADP: it applies to AI too. The Federal Data Protection and Information Commissioner (FDPIC) has stated this. Entering personal data into an AI service discloses it to a provider. The company must follow the processing principles (Art. 6), ensure adequate data security (Art. 8) and choose processors carefully (Art. 9). Additional rules apply to disclosure abroad (Art. 16).
  • GDPR: staff need instructions. Anyone processing personal data of people in the EU must take technical and organisational measures (Art. 32) and bind processors by contract (Art. 28). Under Art. 32(4), staff process personal data only on instructions. A written policy is such an instruction.
  • EU AI Act, Art. 4: support AI literacy. Art. 4 has applied to providers and deployers of AI systems since 2 February 2025. A company that uses AI services professionally is a deployer. Since the new wording by amending Regulation (EU) 2026/1744 ("Digital Omnibus", in force since 27 July 2026), deployers must take measures that support the AI literacy of their staff; no specific level is required. Swiss companies are affected if they are established in the EU, offer AI systems in the EU or if the AI output is used in the EU (Art. 2).
  • Secrets: additional duties. Medical practices, law firms, audit firms and banks are bound by professional or banking secrecy (Art. 321 Swiss Criminal Code, Art. 47 Banking Act). Many other companies have contractual confidentiality duties. Trade secrets are protected by Art. 162 Swiss Criminal Code.

Above all, a policy removes uncertainty in the team: people who know what is allowed use AI more safely and do not need to fall back on private accounts. More in the guide Shadow AI in small businesses.

ChatGPT policy for employees: what the template covers

The template fits on two pages plus a page for signing and applies equally to ChatGPT, Copilot, Gemini, Claude and other AI services. The sections:

  1. Purpose: what AI may be used for and what is protected.
  2. Scope: who the rules apply to, including on private devices.
  3. Approved AI tools: a field for services, account type and purpose. Private accounts are not allowed for company data.
  4. Data that never belongs in AI tools: personal data, social security numbers, IBANs, passwords, health data, contracts and trade secrets, plus a field for your own cases.
  5. Handling results: checking, responsibility, no decisions about people by AI alone.
  6. Training: a field for format, duration and date (AI literacy under Art. 4 AI Act).
  7. Technical aids: warnings before sending complement the rules.
  8. Reporting incidents: to an internal contact, without penalty for reporting quickly.
  9. Violations and review, plus an acknowledgement to sign.

Fillable placeholders: company name, effective date, responsible person, approved tools, additional prohibited data, training, reporting contact and next review. In Word they are highlighted in yellow; in the PDF you fill in the fields in your PDF reader or by hand on a printout.

How to introduce the policy

  1. Adapt: download the template, fill in the fields, adapt the examples to your company.
  2. Have it reviewed: by a qualified person, especially for professional secrecy or staff in the EU.
  3. Explain: present it to the team, answer questions, have the acknowledgement signed.
  4. Train and review: short training when people join and every year, update the policy once a year.

Enforce it technically with AImori

A policy only works if people remember it in their daily work. AImori is a free browser extension for Chrome and Edge: it checks input on AI websites locally in the browser and warns before sending when it contains IBANs, social security numbers, passwords or customer data. Section 4 of the policy becomes a reminder at the right moment. Section 3 can be reflected too: on AI sites that are not approved, AImori shows a notice or block page with a button to the allowed tool.

Via Intune or Group Policy, the extension reaches every workstation without servers and without user accounts. No content goes to IT or to third parties. More: What is detected

Frequently asked questions about AI policies

Does a small business need an AI policy?

Swiss law has no explicit duty to have exactly this document. But anyone processing personal data must ensure data security and instruct staff. A written policy is the simplest way to do that and shows, if something goes wrong, that the company had rules.

Does the EU AI Act apply in Switzerland?

Not directly. It affects Swiss companies if they are established in the EU, offer AI systems in the EU or if the output is used there. Whether this applies should be clarified case by case with a qualified person.

May I change and share the template?

Yes. You may freely adapt the template and use it in your company, including for clients you support.

Is a policy enough on its own?

It is the foundation. Mistakes still happen in daily work, for example when copying an entire email thread. Training and technical aids such as AImori catch such mistakes.

Not legal advice. This page and the template give a general overview as of 14 October 2026, with no warranty of completeness or accuracy. Have the policy reviewed by a qualified person before introducing it.

Read more: May employees enter customer data into ChatGPT? · IBAN, social security numbers & co.: what never belongs in AI tools

Sources

Information as of 14 October 2026.

Free for Chrome