“Es una empresa con un buen equipo, te resuelven cualquier duda que puedas tener y plantean buenas soluciones a los problemas que te pueda surgir. Muy recomendable.”
Cliente verificado
POLICY AND COMPLIANCE
AI usage policy: what your company must require and almost nobody writes down
Many companies already have an AI document; few have a policy that works. A useful policy does not ban tools: it defines who may use what, with which data, with what review and what happens when someone builds an application.
The eight points that cannot be missing
An AI policy is judged by what can be verified, not by what it promises. If it does not say which tools are approved, which data may be used and who reviews, it governs nothing.
The eight points we always cover: authorised tools and models; permitted and forbidden data; human review of decisions; ownership of code and prompts; environments and deployment; roles and permissions; logging and audit; and minimum training per profile.
The AI Act adds a layer: an AI system inventory, risk classification and the ability to explain what each system does and with which data. A policy without an inventory is a statement of intent, not a control.
THE CHALLENGE
A rule nobody reads is not a policy
Many companies already have an AI document; almost none get it applied day to day without slowing work down.
Decorative document
A twenty-page PDF approved by leadership that nobody remembers and that does not say what to do with tomorrow's specific case.
No data criteria
The policy does not distinguish an internal draft from customer personal data, so in practice everything is allowed or nothing is.
No owners
It is unclear who approves a new tool, who reviews a doubtful use or who answers an audit.
APPROACH
A short policy, with an owner, that can be applied
We write so the team knows what to do within two minutes, not so the document looks good in the file.
Real starting point
We start from what is already used in the company, not from a generic template: a policy that ignores reality is not followed.
Rules by data type
What is allowed is defined by data type: public, internal, personal or confidential, with examples for each case and tool.
Roles and approvals
Every exception has a path and an owner: who authorises it, under which condition and where it is recorded.
Periodic review
The policy is updated when the provider, the tool or the regulation changes, with date and author for each version.
DELIVERABLES
The whole package, not just the PDF
A policy works when it comes with the mechanisms that enforce it without relying on goodwill.
Approved policy
A short document with rules by data type, examples and escalation criteria, approved and with a review date.
Usage register
An inventory of AI tools and applications in use, with owner, data processed and approval status.
Approval workflow
A clear procedure to introduce a new tool: who evaluates it, what is checked and how fast an answer is given.
Team training
A practical session with real company cases, so the policy is understood as help rather than an obstacle.
TRUST
Technical and regulatory judgement
We have supported technology and compliance decisions in companies since 2008, with offices in Barcelona and Madrid and remote collaboration across Spain, Europe, LATAM and the US. Secure development practices and ENS awareness.
- Inventory of AI and employee-built applications, with prioritised risks.
- One-page policy, in Spanish and English, aligned with the AI Act and GDPR.
- Technical guardrails that enforce the policy without relying on goodwill.
- Short training per profile: what each role may do and where to request the governed lane.
FAQ
Questions about AI usage policy
Have a project in mind?
Tell us what you need around AI usage policy. We will help you turn it into a clear, viable delivery plan.
