In short
An AI policy for SMEs is a minimum set of rules that defines which data can enter the tools, who validates the outputs and how value and risk are measured. Seven controls are enough, not a legal manual.
Key points
- If your team already uses AI without shared rules, a policy already exists: it is implicit and inconsistent.
- Outputs that leave the company, or that affect money, people or critical processes, need human review.
- Every use of AI needs an owner, a minimal record and 3 metrics: time recovered, quality, rework.
- Article 4 of the AI Act asks for measures to support the AI literacy of the people who use AI, since 2 February 2025. It does not guarantee a specific level for every person.
“AI policy” is the name of the document. The need behind it is different: knowing who checks what before an output leaves the company, and which data can go in.
If someone in your company is already using ChatGPT, Claude or Copilot without shared rules, you already have a policy. It is just implicit, inconsistent and invisible.
Most Italian SMEs underestimate this. The problem does not start when you choose the tool. It starts when the team begins to use it in different ways, on different data, to different standards.
A useful AI policy is not there to slow people down. It is there to stop AI from entering your processes as an ungoverned shortcut.
Operational AI policy means this: a minimum set of rules that defines where AI can be used, who validates the outputs and how the company measures value and risk.
Literacy is not an optional topic either. Article 4 of the AI Act, rewritten by the Digital Omnibus, asks for measures to support the skills of people who use AI on the company’s behalf. Together with the basic bans, it has applied since 2 February 2025.
Why an SME needs an AI policy before it even chooses a tool
In our work we see the same pattern every time. The company tests AI on quick tasks and gets a few interesting results. Then it widens the use without defining boundaries, roles or validation criteria.
The result is not innovation. It is variability.
In our meetings with SMEs, these signs come up often:
- the team uses different tools for the same problem
- nobody knows which outputs can be reused
- data is copied and pasted without governance
- the General Manager senses the chaos but has no metric to measure it
So before you discuss which tool to adopt, you need to decide how your company system will handle inputs, outputs, oversight and responsibility.
In one sentence
Before the tool, you need to decide:
- what can go in
- who validates
- what stays on record
- where AI must not be used
If you want the full picture, start with How to govern AI in an Italian SME: a system, not a tool.
The 7 controls an operational AI policy must contain
An AI policy for SMEs should not read like a legal manual. It should work as an operational governance checklist.
1. Which data can enter AI tools
The first control is the most basic and the most ignored.
You need to define:
- which data can be uploaded
- which data must be anonymised
- which data must not leave internal systems
Without this distinction, the risk is not theoretical. It is operational. It is also almost impossible to defend, after the fact, a decision made with data uploaded without criteria.
Minimum checklist
- public or neutral data
- anonymised internal data
- sensitive data excluded or handled in a controlled environment
2. Which outputs require mandatory human review
Not everything that comes out of an AI system can be used in the same way.
You need a simple rule:
- internal draft outputs: freer use
- outputs for clients, board or partners: mandatory review
- outputs that affect economic or process decisions: double validation
Here, human oversight is a way of working, not an obligation for every SME. We cover it in the AIEH article on the EU AI Act for SMEs.
Practical rule
If the output:
- leaves the company
- affects money
- affects people
- changes a critical process
then it needs a clear human review.
3. Who is responsible for what
If everyone can use AI but nobody owns the process, you do not have adoption. You have dispersion. In practice, the company depends on individual initiatives instead of shared standards.
A minimum policy should clarify:
- who can experiment
- who approves the standards
- who validates critical outputs
- who monitors the impact on time, errors and ROI
Typical mistake
Many SMEs say: “everyone can try it”. It sounds open. In reality it often means:
- no owner
- no standard
- no accountability
4. How AI use is tracked
You do not need a huge system.
At the very least, track:
- where AI is used
- for which tasks
- with which validation criteria
- which improvements or errors it produced
If you cannot explain where AI helps you and where it exposes you, you are not governing. You are hoping. So the policy should leave a simple record, not a perfect one.
Good news
You do not need a bureaucratic machine. A minimal record can be enough:
- process
- owner
- type of output
- level of validation
- observed impact
5. In which cases AI should not be used
This is one of the strongest signs of maturity.
A clear-headed SME does not only say “here we use AI”. It also says “here we don’t”, or “here we use it only as support”.
Typical examples:
- sensitive communications with clients or collaborators
- economic evaluations without numerical checks
- HR or organisational decisions taken without context
- documents that require full confidentiality
This point makes the difference
A mature company does not only say “here we use AI”. It also says:
- not here
- here only as support
- here never without human control
6. How you measure adoption and ROI
The policy must not become a forgotten PDF. It must change the way you work.
That is why it should be tied to 3 minimum metrics:
- hours saved on repetitive tasks
- number of standardised processes
- fewer errors or less rework in the outputs
This is the step that turns governance into a revenue path, not into theory. Without metrics, every discussion about AI goes back to being opinion.
The 3 most useful metrics at the start
If you want to start light, measure:
- time recovered
- quality of outputs
- reduction in rework
7. How you connect the policy to real processes
The policy only works if it lands in your processes.
That means connecting it to:
- reporting
- sales preparation
- data analysis
- document production
- approval flows
Fabio Armellini is a useful case to keep in mind. The jump in value does not come from the “AI tool”. It comes from the system that cuts days of consolidation work and gives control back. In our experience, this is the line between initial enthusiasm and real adoption.
Recommended sequence
The policy works best if you apply it first to:
- a reporting process
- a sales process
- a document process
Where the EU AI Act applies, and where you shouldn’t overcomplicate things
For an Italian SME, the EU AI Act is not an excuse to add bureaucracy everywhere. It is a lens for checking whether you use AI responsibly.
In practice, for companies that use AI in daily processes, three obligations already apply: measures for staff AI literacy (Article 4), bans (Article 5) and transparency (Article 50, from 2 August 2026).
Human oversight and documentation are requirements for high-risk systems, postponed to 2027-2028 by the Digital Omnibus. They remain a good way of working, and you can read about them in the post on the delay.
What you should not do is turn the policy into a legal document that nobody reads.
What you should do is build the governance principle into the way the team works. For the regulatory and operational picture, also see EU AI Act and Italian SMEs: what GMs and Fractional Managers need to know.
How to turn the policy into real team adoption
A policy fails when it stays abstract.
To avoid that, start with a small scope:
- choose 1-2 high-friction processes
- define minimum rules for AI use
- assign an owner
- measure impact and problems for 30 days
- extend only after you have seen concrete signals
If you want to know where to start, the For Companies page explains how AIEH sets up adoption for SMEs.
In short
The right policy does not slow the team down. It reduces:
- ambiguity
- variability
- rework
- reputational risk
The sign that tells you you’re still in chaos
The right question is not “does the team use AI?”.
The right question is this:
if tomorrow someone asked you where AI is used, under which rules and with what impact, could you answer in 10 minutes?
If the answer is no, you do not have a system yet. You have scattered initiatives.
How to start without building useless bureaucracy
The smartest way to start is not to write a 12-page policy on your own.
Start with an operational diagnosis:
- where the team already uses AI
- where it loses time
- where standards are missing
- where the risk is higher than the value generated
From there you can build a policy that is useful, short and above all adoptable.
If you want a clear picture of your starting point, the fastest step is the SME diagnostic. In a few minutes you see whether you are governing AI or just adding more variability to the system.
Primary sources and references
Frequently asked questions
What is an operational AI policy for an SME?
It is a minimum set of rules that defines where AI can be used, who validates the outputs and how the company measures value and risk. It works like a governance checklist, not a legal manual.
Is an AI policy mandatory for an SME?
There is no general obligation to have a document called a policy. Some obligations already apply, such as the measures on staff AI literacy and the bans. A policy is the simplest way to organise them.
How do you measure whether the AI policy works?
With three minimum metrics: hours saved on repetitive tasks, number of standardised processes, and fewer errors or less rework in the outputs.