An AI Policy for Your Company: What Belongs on One Page

A customer complains by email about a late delivery. The employee in the sales office copies the message, with name, address and order number, into ChatGPT, has it draft a polite reply and sends it after a quick look. He set up the account privately at some point. The reply promises a new delivery date that nobody in the warehouse has confirmed.

Nobody in the company could have said whether that was allowed.

The case is invented, but the situation behind it is real. The team has used AI for a while, each person with their own account, their own settings and their own idea of what may go into a prompt. An AI policy closes that gap, and for a company of ten or thirty people one page is enough.

What an AI policy has to do in a small company

Search for "AI policy" in German and you mostly find template policies from data protection associations, chambers of commerce, law firms and compliance vendors. For the legal questions they are a useful starting point. In daily work, however, what counts first is that the team knows the rules, because no clause that nobody has read prevents the case above. The page described here therefore answers only four questions: what may go into a prompt, which accounts and settings apply, who checks before anything leaves the company, and what the EU AI Act requires of a small company.

Our own house rules serve as the example throughout. We work with AI agents every day, in development, sales and administration. The rules for that sit in a file that every one of our agent sessions loads before it starts, and they answer the same four questions. One limitation belongs at the start: this article is not legal advice. Where it covers laws and vendor terms, we name the source and the state as of 5 October 2026. Where your industry or your customer contracts set stricter rules, those take precedence.

What may go into a prompt

Personal data draws the most important line. The GDPR defines it as any information relating to an identified or identifiable natural person (Article 4(1)). That includes the name in the sender field as well as the order number that links to the customer. Copying such an email into an AI tool passes that data to the vendor. That requires a legal basis for exactly this purpose and an account with a contract that binds the vendor; the next section covers the account. Whatever the account, the principle of data minimisation in Article 5 applies, meaning only as much as the purpose requires. To draft a reply to the complaint, the model needs the facts and the tone you want, but neither the name nor the address. It is not quite that simple, though: in its guidance on AI and data protection of May 2024, the German Data Protection Conference points out that removing names and addresses is regularly not enough, because a person can often be identified from the context.

On the page, three levels are enough.

• Free to use: public information, your own texts without names, general subject questions and anonymised examples.
• Company account only, for approved tasks only, and only as far as needed: customer correspondence, quotes, order data and internal documents.
• Never: login credentials, personnel files, job applications, health data and documents you received under a non-disclosure agreement.

We hold to the third level without exception for credentials. At the start of a session our agents read the same knowledge store with customers, agreements and rules, and our house rules expressly forbid putting secrets there. Passwords and keys are stored separately from it, and an agent gets only the access its task needs.

Which accounts and settings apply

A private AI account is a contract between the employee and the vendor, not your company. The German Data Protection Conference therefore recommends in the same guidance that employers provide their own devices and accounts for work use. The documentation of the three large vendors shows how big the difference is.

• OpenAI states that by default it does not use content from ChatGPT Business and ChatGPT Enterprise for training, and it signs a data processing agreement for these plans. On the plans for individuals, OpenAI may use content for training unless someone turns off the "Improve the model for everyone" setting. Even then, a thumbs-up or thumbs-down rating releases the whole conversation for training.
• Anthropic by default does not use inputs from its commercial offerings such as Claude Team and Enterprise for training. On Claude Free, Pro and Max, a change in August 2025 lets the user decide whether chats go into training; if the user agrees, Anthropic keeps them for five years.
• Microsoft protects Copilot Chat with "enterprise data protection" when the employee signs in with a work account through Microsoft Entra ID. Prompts are then not used to train the foundation models, and Microsoft's data protection addendum and product terms apply. The consumer product with a personal Microsoft account is also called Copilot.

Article 28 GDPR requires a contract that binds the vendor for this kind of processing on your behalf. The vendors offer that contract for their business plans, not for private accounts. That gives the page its first rule: company data belongs only in accounts that the company has bought and manages. The company account is only the precondition, though. Which customer data may go in for which task is something you decide once per tool, in sensitive cases together with your data protection officer or adviser.

Buying the seats does not settle the question. Check once, centrally, whether chat history is stored, which connections to mailbox and file storage are allowed, and who switches on new tools; for Claude Cowork we described these switches in our article on Claude Cowork and ChatGPT Work. One question remains open that no plan answers. OpenAI and Anthropic are based in the United States. Transfers to certified US companies rest on the adequacy decision on the EU-US Data Privacy Framework of 10 July 2023; the basis your vendor relies on is stated in its data processing agreement. The decision is in force and was upheld by the EU General Court in September 2025, but it has been under appeal at the Court of Justice since 31 October 2025. How that ends cannot be predicted. According to OpenAI's documentation, ChatGPT Business can now also store content in Europe, although the option is being rolled out gradually and is not yet available to every customer. The chosen region covers storage only, not processing, and a copy of every prompt and response is kept in the United States for a limited time for abuse monitoring.

"In our own setup, I have switched off the memory of the Claude account. It would be convenient, but it would be one more store at the vendor that I can neither export nor trace in our version history, and that our other tools cannot read. Whatever an agent needs to know about our clients and agreements therefore sits in dated files that we own. I will revisit that decision when the vendors close this gap," says Sebastian Behler, founder of CERTAINCE.

Who checks before anything leaves the company

The third question concerns the result, and this is where a rule of etiquette belongs on the page. AI text takes seconds to produce, yet someone still has to read it. Forwarding it unchecked saves the sender the reading and hands it to the recipient, who has less context because they do not know which passages the sender checked or which assumptions were in the prompt. The dangerous errors are the plausible ones, such as a figure that could be right or a date in the correct format. Whether a model flags uncertain passages depends on the task and the instructions, and you cannot rely on it. So ask the tool explicitly to name its sources and the passages you should check with every result; that shortens the review but does not replace it. For internal use the rule is therefore: you own what you forward. Every sentence has been read, the text is cut down to the answer, and unchecked details are marked as unchecked.

Externally, an unchecked text costs more than time. Once it is sent, the delivery date in the opening complaint is a commitment by the company. Anything that touches prices, dates or binding commitments therefore needs human approval on the page, even when the draft looks good. The same rule would apply to a new employee in their first weeks.

We work the same way ourselves. When our agents write emails, they save drafts in the mailbox, and a person sends them. The sales assistant built for MAFU-SHERPA keeps the same boundary: the system researches companies and drafts a suitable message, and the salesperson reviews the draft and sends it with one click from Outlook. The delegation map sorts out, step by step, which other parts of a workflow need approval.

What the EU AI Act requires of a small company

The AI Act distinguishes between providers, who develop AI systems, and deployers, who use them "under its authority" (Article 3(4)). A company whose team uses ChatGPT for work is a deployer; only purely personal, non-professional use is excluded. Since the end of July 2026, the regulation has applied as amended by the so-called Digital Omnibus, which softened some obligations and postponed others.

The obligation that applies to every company using AI tools is in Article 4 and has applied since 2 February 2025. Deployers "shall take measures to support the development of AI literacy of their staff". Since the amendment, the article expressly no longer requires any specific level of literacy. Whether this also covers a team that uses ChatGPT to write advertising copy or translate text, the European Commission answers with yes in its questions and answers on AI literacy; staff should be informed about the specific risks, for example hallucination. No certificate is needed, and an internal record of the training is sufficient. The Bundesnetzagentur, under section 2 of the German KI-MIG generally the competent market surveillance authority in Germany, recommends documenting the measures; in its reading, the regulation does not require an AI officer or standardised training. National authorities have supervised the obligation since 2 August 2026.

Article 50 has contained a labelling duty for AI text since 2 August 2026, but only for text published to inform the public on matters of public interest. Even then, the duty does not apply when the text has been reviewed by a person or subject to editorial control and someone holds editorial responsibility. It does not cover internal texts, quotes or ordinary business correspondence. We checked this for our own website on 14 August 2026. No provision of Article 50 obliges us, and the note on AI use in our imprint is voluntary. The check still left us with a rule that reaches beyond the law. The exemption for reviewed text depends on a step that can be lost: if our texts were one day published without human review, the exemption would be gone. That is why the review step is built into our workflow itself. Every new article for this website passes an independent review, and every change goes live only after the founder approves it.

Two further boundaries belong on the page. AI systems intended to screen or filter job applications or to evaluate candidates count as high-risk (Annex III, point 4). The deployer obligations for them, including human oversight by people with the necessary competence, apply from 2 December 2027 after the postponement. Whether a general chat tool falls under this when someone uses it for that task is a question of interpretation that we leave open here. Since 2 February 2025 it has already been prohibited to use AI to infer the emotions of employees in the workplace, except for medical or safety reasons (Article 5(1)(f)).

The one page to adopt

The four sections add up to one page that you can adopt and adapt. Enter a name where the page asks for one, because nobody maintains a rule that has no owner.

1. Company data goes only into AI accounts that the company has bought and manages.
2. Credentials, personnel files, job applications, health data and confidential documents from others go into no prompt.
3. Customer data only for tasks that (enter name) has approved per tool, and only as far as the task needs it.
4. Whatever you forward, you have read and shortened. Mark unchecked details as unchecked.
5. Prices, dates and binding commitments reach customers only after human approval.
6. A person decides about applicants and employees, never an AI result on its own.
7. (Enter name) approves new tools and connections to mailbox or file storage before they work with company data.
8. Questions and errors go to (enter name). The page is reviewed twice a year.

Go through the page once with the team, ideally on a real case like the complaint at the start, and record who took part. That also gives you a first record of a measure under Article 4, as the Bundesnetzagentur recommends. The page is a start, not proof that everything is done; what your company needs beyond it depends on what your team uses AI for. Our own file is longer than this page, because agents with access to systems need more rules than a team at a chat window. The core is the same.

If you would rather not set up the page on your own, the AI enablement workshop is the right step: your team learns, on its own tasks, to hand whole pieces of work to Claude, ChatGPT or Copilot and to check the result, and a fixed module on data protection and the EU AI Act ends with a list of what may go into a prompt in your company. You normally buy the licences directly from the vendor; our recommendation for a tool does not depend on who sells them.

Bring a real task, such as a complaint like the one at the start: Discuss an AI enablement workshop.