An honest limit first
One A4 page is enough for a usage rule. It is not enough for full compliance: the EU AI literacy obligation, the data protection documentation and the risk assessment do not fit on one page, and do not belong there either.
And one more thing: the existence of a policy does not on its own prevent anyone from breaking it. A 1,250-person study run in April 2026 found that 86% of respondents have an AI policy at their company, and that 66% of them still used a tool they believed was banned.
So what is it for? Because the one-page policy is not useful for preventing things, it is useful for creating a legal position — in the protection of trade secrets, in employment law and on the question of liability. And because the biggest problem is not deliberate rule-breaking: according to a 48,340-person international survey, 38% of employees used AI without knowing whether they were allowed to, and 19% did not even know whether a policy existed at their company.
The strongest argument, and the one least often made
Under Article 2(1) of Directive (EU) 2016/943, information is a trade secret if it is secret, if it has commercial value because it is secret, and if the person lawfully in control of it has taken reasonable steps under the circumstances to keep it secret. Every member state has transposed that definition into national law, so the wording you would actually litigate under is your own country's — but the third condition is in all of them.
That third condition is the whole point. Trade secret protection is not automatic in EU law. If a company has no written rule saying that pricing, margins or contract text must not be put into a public tool, then in a later dispute it becomes arguable whether those things ever qualified as trade secrets. Two transpositions side by side — open the one that applies to you:
Hungary — Act LIV of 2018 and "the conduct generally expected in the situation"
Hungary transposed the directive in Act LIV of 2018, in force since 17 August 2018. Section 1(1) defines a trade secret as a fact, a piece of information, other data or a compilation of these, connected to economic activity, secret and therefore holding commercial value, in respect of which the holder displays the conduct generally expected in the given situation in order to keep it secret.
The Act names know-how separately as well. Under Section 1(2), protected know-how is technical, economic or organisational knowledge, a solution, experience or a compilation of these that qualifies as a trade secret and is recorded in an identifiable form. "Recorded" is not decoration here: if nothing sets out what belongs in it, an argument built on know-how will be empty in court.
What that means for AI use: if nobody at the company has written down that pricing, margins or contract text must not go into a public tool, the hard thing to prove afterwards is not that someone pasted the data, it is the expected conduct. The one-page policy is what produces that evidence.
Spain — Ley 1/2019, and a Supreme Court ruling that sets the bar
Spain transposed the directive in Ley 1/2019 of 20 February on trade secrets. Article 1(1) requires the same three cumulative conditions and words the third one like this: the information must "haber sido objeto de medidas razonables por parte de su titular para mantenerlo en secreto" — it must have been the subject of reasonable steps by its holder.
What counts as reasonable has a concrete answer. In judgment 447/2024 of 3 April 2024, the Civil Chamber of the Spanish Supreme Court dismissed a company's trade secret claim against former employees: a password, a personal access code and access levels were, in the court's view, standard security measures that did not show the company had treated that information as secret because of its competitive value.
That bar sits higher than most companies expect: the question is not whether there was IT protection, it is whether the intent is visible. A written AI policy that names the excluded data categories documents exactly that intent — and Spanish practice reads the ruling as requiring measures that are at once effective, documented, kept current and communicated to staff.
Which means the one-page policy is not bureaucracy. It is a precondition of the legal protection of your trade secrets.
What goes in it, and what forces each line
Every line has its basis written next to it — because a policy is credible when it names an obligation rather than citing "good practice".
| # | Item | What forces it |
|---|---|---|
| 1 | A list of approved tools, and how to request a new one | without it the other points cannot be enforced |
| 2 | Company account mandatory, private account banned | the security of processing: the company has no control over a private account |
| 3 | Prohibited data categories, itemised | the legal basis for processing, the data processing agreement and the rules on third-country transfers |
| 4 | Trade secrets: what they are, and that they must not go into a public tool | Directive (EU) 2016/943 and its national transposition — see above |
| 5 | Human review of every outbound output, with a named owner | contractual and civil liability; the machine's output is the company's statement |
| 6 | Labelling: chatbots, deepfakes, AI text on matters of public interest | Article 50 of the AI Act, from 2 August 2026 |
| 7 | A copyright rule: what may be uploaded, and what the status of the output is | national copyright law; the EU directive |
| 8 | Named owners: who decides on a new tool, who to call when something goes wrong | the Australian government template makes this mandatory under the name "accountable official" |
| 9 | Incident reporting with a deadline | the data protection notification duty: 72 hours |
| 10 | Training: who got it, when, from what | Article 4 of the AI Act, under national supervision from 2 August 2026 |
| 11 | A review date | the best university templates all treat themselves as living documents |
| 12 | An employment-law hook | make the policy part of the employment contract or the staff handbook: the employee must not act in a way that damages the employer's legitimate business interests |
Without the twelfth point, breaking the policy has no employment-law consequence. It is one line, but without it the paper is advice, not a rule.
The template
[COMPANY NAME] — AI USE POLICY
In force from: .......... Review date: ..........
Owner: ............................
(approval of new tools · questions · incident reports)
1. APPROVED TOOLS — with a company account, company sign-in:
..........................................................
New tools only with the owner's approval. A free version is still a tool.
2. WHAT MUST NEVER GO INTO AN AI TOOL — on any account:
customer names and identifiers · full contract text · pricing and margins ·
personal data (name, email, address, tax number, health data) ·
passwords, API keys, access credentials · source code from ........ systems ·
anything classified as a trade secret (see the attached list)
3. WHAT TO SET UP: training on your data switched off,
history retention ........, work account, not a private one.
4. HUMAN REVIEW: every outbound text, number, citation and piece of code
gets checked first. The company is liable for it, not the tool.
5. LABELLING: if an AI-generated image, video or audio is published,
we label it. Chatbot facing a customer: we say it is a machine.
6. IF SOMETHING GOES WRONG: anyone who pasted sensitive data tells the owner
within ........ hours. There is no penalty for reporting.
7. TRAINING: every new joiner ........, everyone once a year.
We record that it happened here: ..........................
8. THIS POLICY IS PART OF THE EMPLOYMENT RELATIONSHIP.
Why not forty points? Because according to the international survey, one person in five does not know whether their company has a policy at all. A twelve-page document does not improve that. One A4 page does — if you put it on the wall.
Two places where "not deciding is also a decision" caused real damage
An airline's website chatbot invented a discount rule that did not exist. The company argued in its defence that the chatbot was "a separate legal entity that is responsible for its own actions". A Canadian tribunal rejected that in February 2024: the company is responsible for all information on its own surface, whether it comes from a static page or from a chatbot. The damages awarded came to just 812 Canadian dollars — and that is exactly what makes it instructive. The lesson is not the size of the loss but the principle: the machine's output is the company's statement. That is the justification for point five.
A large consultancy left non-existent citations and a fabricated court quotation in a report written for a government client in October 2025, and partially refunded the fee. If one of the world's largest audit firms had no rule on human checking of citations, a twenty-person company certainly does not either.
Point seven of the template: what the law actually demands about training
The AI literacy obligation was relaxed in July 2026. Under the current text, providers and deployers have to take measures to support the development of AI literacy — and the European Commission's own guidance states that Article 4 does not create an obligation to measure staff AI knowledge, and does not prescribe mandatory curricula, certificates or exams.
At the same time the obligation does exist, and since 2 August 2026 it has been supervised by the national market surveillance authorities — in most member states that is not the data protection authority but a separate ministry or agency, so it is worth checking who it is in your country.
What that means in practice: keep an attendance sheet. Not an exam. The syllabus for the four sessions is set out in the team's AI literacy plan, with the topics for each.
Where to borrow from if you want more
Four public, citable sources — all of them real organisational policies, not content marketing:
- A British local-government professional body publishes a downloadable template, second edition, updated in June 2026. Its scope explicitly extends to suppliers and subcontractors as well, which is missing from most small-company policies. (Part of the template is behind membership.)
- The Australian government AI policy, currently in its second version, in force since December 2025. It makes the designation of a responsible executive, a public transparency statement and a register of use cases mandatory.
- University policies — these are good models because they were written under pressure, in public and not to sell anything. One American university's policy says of itself that it is "a work in progress as the technology, the law and community use evolve" — that sentence is itself a line worth borrowing.
- The EU AI Office's repository of practices on AI literacy, with more than 40 organisational initiatives. There is an important limit the repository states itself: copying the practices listed there does not on its own create a presumption of compliance.
What not to use as a source: most of the pages that come up for "free AI policy template" are content marketing, with no named author and no legal review, attached to a product.
What order to do it in
Survey first, policy second. Write it first and it will describe what you imagine — not what is actually being used, and the first item on the list (approved tools) stays unfillable. The survey takes a day and needs no new software: mapping your shadow AI walks through the five sources.
Then comes the policy, then setting up the access controls, and finally the training.
What to take away
One A4 page is not full compliance, and it will not stop anyone breaking the rules — but it creates a legal position on three points: the protection of trade secrets, the employment relationship, and the question of liability. None of those three depends on whether anyone complies.
Of the twelve points, the two most often left out are the employment-law hook and the review date. Without the first there is no consequence; without the second you are, six months later, banning tools nobody uses any more.
And point two of the template, the list of prohibited data categories, only gets good once the legal background behind it is in place — that is the subject of GDPR and AI, with seven decision questions.