Does my company need an AI policy?

Shadow AI is almost certainly already at your company

By now the research is clear: most employees use AI at work whether or not their company has approved it. The PagerDuty 2026 Shadow AI Survey found that two-thirds of employees had turned to tools their employer, as far as they knew, had never authorized: ChatGPT to draft an email or a client document, Gemini or Nano Banana to generate an image, and on it goes. Usually it happens through personal accounts, often on the free tier, with no thought given to security settings, to what the company has promised its clients, or to keeping company data in-house. This is what is meant by the term shadow AI — shadow, as management rarely sees it. It's almost certainly happening at your company too, which is why nearly every SME now needs to think about how AI can be used.

Unmanaged AI use causes (at least) three major problems at once. It puts your compliance with the AI Act at risk, it creates real business exposure — up to and including a data leak, and it lets habits set in that don't reflect how the company actually wants to work. An AI policy is the one document that deals with all three.

The compliance side: what the AI Act expects

Nowhere does the EU AI Act say that every company must have an AI policy. But two of its requirements are, in practice, easiest to meet with one.

Article 4: AI literacy. You have to make sure that staff using AI systems understand them well enough. Part of that training is about getting value out of AI by using it skilfully and inventively, making the company faster, more efficient or better performing. The compliance part is different: people also need to understand what responsible use looks like, and what the consequences of their choices are. A clear policy plus a training you can evidence is the most practical way to show you have met the obligation. It isn't too much of a burden, and there is more in it than a tick in a box, your team comes away knowing something useful and knowing where the company's boundaries sit.

Transparency and oversight. The Act generally expects a human to stay in charge of AI, and in certain cases expects you to be transparent about its use with the people affected. A policy that defines who needs to review AI output and when, how AI use gets flagged, and what AI can be used for in the first place turns those principles into something your team can actually follow.

The business side: protecting your data

Let's put the law aside for a moment. Even without the AI Act, you would probably still want a say in what your team uploads to an outside AI tool, if only to protect the business. Once confidential client information, personal data or your own commercial secrets, financials, copyright-protected material, business plans, land in a consumer AI service, you lose any real control over where they travel next.

A good policy answers the practical questions before they turn into incidents. Which tools are approved? What should never be uploaded? Who owns the output? Where do you go when you are unsure or have questions? Who makes the call on the risky ones?

What a proportionate policy looks like

At a small or mid-sized company, a policy that works is short and focuses on the basics. The essentials:

• Approved tools: which AI services can be used, and for what.
• Data rules: what data may and may not go in, especially personal and confidential data.
• Human oversight: where a person must review AI output before it is relied on or sent to clients.
• Responsibility: who is responsible for AI-related decisions, and who to ask when unsure.
• A decision mechanism: who makes the call on the riskier questions.

There is a simple test for whether a policy works: short enough that colleagues actually read it, and clear enough that it settles the question when they are in doubt.

Good governance is the smallest set of rules that genuinely protects your business, not the largest set you can write.

So, do you need one?

If anyone at your company uses AI to get their work done, the short answer is yes. A proportionate AI policy is worth having, both for what the AI Act expects and for your own protection. The good news is that it doesn't have to be big, expensive or daunting. At most SMEs this is a small piece of work that takes real risk off the table and keeps you on the right side of the law.

This article is general information about the EU AI Act, not legal advice for your particular situation. For something more detailed or tailored to you, do get in touch.