The One-Page AI Policy for a 5 to 50 Person DACH Company

Your staff already use AI. The only question is whether they do it consistently and safely, or improvise in consumer tools you cannot see. For a 5 to 50 person company in Austria, Germany, or Switzerland, you do not need a 27-page governance manual. You need one page that gets read, covering: approved tools and how to request new ones, what data must never go into which tools, a basic training expectation (your EU AI Act literacy hook), a human-review rule for output, disclosure of chatbots and AI content, and one named owner. A copy-ready template is below. The goal is to enable safely, not to ban, because a ban just moves AI use into private accounts you have no view into.

This is a practical guide, not legal advice. The regulatory specifics are current as of mid-2026 and some are moving; verify against the official sources before you rely on them, and run anything load-bearing past your own counsel.

Why a small company actually needs one

Not fear, just reality. Surveys put AI use among knowledge workers around three quarters, and most of those bring their own tools, more so at small and mid-sized companies. That is shadow AI, and it is the default unless you offer a known, approved path instead. The risks are concrete: staff have pasted confidential code and customer data into consumer chatbots, and unverified AI output has reached customers and courts with real consequences. A one-pager does not add bureaucracy. It replaces invisible, ad-hoc use with a path people can actually follow.

There is also a legal nudge. The EU AI Act's AI-literacy duty (Article 4) has applied since 2 February 2025 to both providers and deployers, which is effectively any company whose staff use AI. The bar is deliberately flexible, basic documented training scaled to role, not a certification programme, and there is no Article 4-specific fine, with enforcement routed through national authorities from August 2026. A proposal to soften Article 4 (the Digital Omnibus) was circulating in 2026 but is not yet adopted, so treat the current duty as live.

What belongs in the policy

Eight short sections, each earning its place.

The DACH data-protection part

When an employee puts personal or customer data into a tool, your company decides the purpose and means, so it is the controller and carries the GDPR duties. Using an external AI provider to process personal data generally needs a data processing agreement (an AVV under Article 28), which consumer free tiers usually do not offer and may also train on your inputs, while business tiers typically do offer one and do not train on your data by default. Switzerland's revised data protection act applies in parallel and is treated as technology-neutral, so it covers AI processing too. One moving detail worth flagging: vendor terms change fast, so cite each provider's own current DPA rather than assuming. We cover how these regimes stack in how GDPR and the AI Act stack for a DACH SaaS.

The copy-ready one-page template

Paste it, fill the brackets, delete what does not apply. It is built for a 5 to 50 person company, not an enterprise.

"A one-page policy that people actually read and follow beats a 27-page document that sits in a folder. The job is not to look compliant. It is to give your team a safe yes instead of an invisible workaround."

What to leave out, on purpose

Theater is the enemy here. Skip the vague aspirational language ("use AI responsibly" with no specifics), which only creates a false sense of compliance. Skip a full ISO 42001 certification or a complete NIST AI risk-management build-out; both are enterprise-tier and disproportionate for a small team, though they are fine as a reference vocabulary if you scale later. Skip long risk taxonomies and exhaustive use-case catalogues that nobody maintains. And never ship a policy with no named owner or no review date, because both guarantee it drifts into fiction. Keep it to the page that gets read.