Your team already uses AI. With what data?

An AI use policy is a short document that sets out three things: which artificial intelligence tools the team may use, which information is never entered into them and who decides when in doubt. In a small business it fits on one page. And it is worth writing sooner than you might think, because someone on the team may well be using AI on their own already.

The official figures point that way. According to Spain's National Statistics Institute (INE), in the first quarter of 2026, 33.6% of companies with 10 or more employees used artificial intelligence. In Catalonia, the figure was 40.5%. Among companies with fewer than 10 employees and an internet connection, it was 21.4%. The INE itself warns that these figures are not strictly comparable with those of previous years, owing to changes in the classification of activities and in the scope of the survey, so I will not talk about growth. What they do show is that AI has already reached a significant share of companies, including those with fewer than ten people. The useful question is not whether it is being used, but with what data and under what conditions.

In September I wrote about what you can do with free AI tools, and the article included a warning about third-party data. This one is the follow-up that warning called for: how to move from "be careful" to a rule the whole team understands.

Why "be careful" is not enough

"Be careful" leaves the decision to each individual, at the worst possible moment: in a hurry, faced with an email that needs answering now. There are three reasons to turn that advice into a written rule.

1. Not all accounts are equal, even paid ones. It is an easy mistake to make. With ChatGPT, for example, OpenAI's own help centre explains that it may use content from its individual plans (Free, Plus and Pro) to train its models, unless the user switches this off in the settings. It also explains that, by default, it does not use content from ChatGPT Business, Enterprise and Edu, or from its API. In other words, the fact that someone on your team pays for a subscription does not mean they are using a tool suitable for client data. What matters is the type of account and its terms, not the price.

2. Data protection law applied long before generative AI. Entering a client's personal data into an external tool is a form of data processing. The GDPR requires you to use only the data needed for each purpose (the data minimisation principle) and to process it with appropriate confidentiality and security. If a provider processes data on your company's behalf, there must be a contract or other legal act governing how it does so (the data processing agreement under Article 28 of the GDPR). And Spain's data protection act, the LOPDGDD, extends the duty of confidentiality to everyone involved in the processing, not just the company.

3. Spain's data protection authority has made it clear. On 27 January 2026 the AEPD published a ten-point guide entitled «Cuidado con lo que le confIAs» (roughly, "Careful what you confide to AI"). Its recommendations include: do not share personal data or sensitive information, describe fictitious cases instead of real ones, read the terms of service before using a tool and choose the most secure versions. And, at work, follow your organisation's information and security policies and do not include confidential information about the organisation, its staff or its clients. Note the detail: the AEPD refers to each organisation's own policies. Where there are none, each person decides for themselves. The AEPD published its own policy in November 2025, covering the use of generative AI in its administrative processes.

What the rules say, without the drama

You do not need to be a lawyer to grasp the essentials. Here is the map, in plain language:

There is one change to Article 4 of the AI Act worth knowing about. Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, rewrote that article this summer. It used to require deployers to "ensure" a sufficient level of AI literacy. It now requires them to take measures to support it, and makes clear that it does not require any specific level of literacy to be guaranteed for any individual. It has been softened, not removed: the obligation still applies to every company that uses AI in its professional activity, whatever the level of risk. A one-page policy and a documented training session can form part of those measures.

Law firms have an extra layer. The General Statute of the Spanish Legal Profession extends professional secrecy to all facts, communications, data, information, documents and proposals that a lawyer learns, issues or receives in the course of their professional work. The LOPDGDD adds that its duty of confidentiality complements the duties of professional secrecy. And the good practice guide on AI published by the Madrid Bar Association (October 2025) stresses that delegating a task to technology does not mean delegating responsibility: whatever relies on external tools must meet the same standards of diligence, transparency and confidentiality. None of this bans AI. It requires the tool to have been assessed before it receives any client information.

The one-page policy: six sections

You do not need a forty-page manual. You need everyone on the team to know what to do within ten seconds. This structure fits on a single sheet:

1. Approved tools. A short list, with the name and type of account. For example: "Assistant X, business account managed by the office". If it is not on the list, it is not used for work. Anyone who needs another tool asks for it.

2. Which data can go in and which cannot. Three levels work better than an endless list:

• Always allowed: your own texts, ideas, drafts without personal data, public information, templates.
• Only in tools approved for it: client or supplier data that the task requires, internal documents, company figures.
• Never: health data, identity documents, bank details, passwords, information covered by professional secrecy in tools that have not been assessed, and anything you would not show a stranger.

Where the task allows it, names and identifying details are replaced with fictitious ones. That is what the AEPD recommends.

3. Human review. Whatever AI produces is a draft. Before it is sent to a client, presented or signed, a person reviews it. Whoever sends it is answerable for its content, just as if they had written it from scratch.

4. Who decides. A named person who resolves doubts, approves new tools and keeps the list up to date. In a five-person company, that is probably you.

5. Minimum training. A short session when someone joins or when a new tool is approved: what it does, what it does not do, what data it accepts and how to spot errors. Record the date and who attended. That gives you evidence for part of the Article 4 measures.

6. Regular review. Tools and their terms change. Put a date in the calendar every six months to review the list and the terms of each service.

Template to copy

AI use policy of [company] · Version [date] · Owner: [name]

Approved tools: [tool, account type, what it is used for].

Always allowed: your own texts, ideas, drafts without personal data, public information.

Only in tools approved for it: [client data needed for the task, internal documents].

Never: health data, identity documents, bank details, passwords, [information covered by professional secrecy], [other].

If in doubt: do not enter it and ask [owner].

All output is reviewed before it is sent, presented or signed.

Training: a session on joining and whenever a new tool is approved. Recorded in [location].

Next review: [date].

How to put it in place in a week

Monday. Ask without looking for culprits. Which tools each person uses, what for and with which account. If the question sounds like an audit, you will hear half the story. If it sounds like "we want to get this right together", you will hear what is really happening.

Tuesday. Choose the tools. Based on what you have learnt, pick one or two. Check in their terms whether they use your data to train models and whether they offer a data processing agreement for businesses.

Wednesday. Write the page. Use the template above. If you have to explain it, it is still too long.

Thursday. Thirty minutes with the team. Go through the page together with two or three real examples from your work. Note who attended.

Friday. Put it where everyone can see it and add the date of the next review to the calendar.

What a one-page policy does not solve

I would rather tell you myself than have you find out later.

• It does not replace reviewing contracts. If a tool is going to work with client data on a regular basis, someone has to read its terms, check where the data is processed and sign the appropriate data processing agreement. A single page will not do that for you.
• It does not prevent AI errors. It reduces the risk of data ending up where it should not. Whether the answers are correct depends on human review.
• It is not the same as automating with client data. If you want a tool to process case files or reply to clients without anyone stepping in, that is a project designed with its own safeguards from the outset, and it comes with its own obligations, such as telling people they are talking to an AI (I explained this in this article on the AI Act).
• If nobody in your company really uses AI, you do not need it yet. But ask before you take that for granted.

Want to know which AI tools your team uses and with what data? Start with the diagnosis. AI Diagnosis €99

Frequently asked questions

Is an AI use policy mandatory?

No rule requires a document by that name. But the GDPR requires measures to protect personal data, and Article 4 of the AI Act requires measures to support staff AI literacy. A short policy, together with documented training, is a simple and demonstrable way to make progress on both.

Is a personal subscription to an AI assistant enough to use it with client data?

Not necessarily. What counts is the type of account and its terms. With some assistants, the provider may use content from individual plans, including paid ones, to train its models unless the user switches this off, whereas it does not do so by default on business plans. Always check the terms of the specific plan.

What data should never be entered into an unapproved AI tool?

Personal data about clients or employees, health data, identity documents, bank details, passwords and information covered by professional secrecy. The AEPD also recommends describing fictitious cases instead of real ones whenever possible.

How often should the policy be reviewed?

Every six months is a reasonable benchmark, and whenever a new tool is approved or the terms of one you already use change.

To finish

AI is already in your company, whether you invited it in or not. A well-written page turns that into an advantage: the team knows what it can do without asking, what it must never do and who to turn to when unsure. It needs no budget, just a week and the willingness to talk about it without looking for culprits.

If you would like help reviewing which tools your team uses and getting the policy written and applied, I can support you through AI Compliance. And if you would rather start by seeing where AI makes sense in your case, the AI Diagnosis is a first step with no commitment.

Transparency note: this article was prepared with the assistance of AI tools and has been reviewed by a person with editorial responsibility at Isenzo IA. It is for general information and does not constitute legal advice. The rules and terms cited reflect their status as of October 2026; always check the official source before making decisions.

Sources

• INE (Spain's National Statistics Institute). Survey on the use of ICT and e-commerce in companies. Year 2025, first quarter 2026. Final data (22 October 2026).
• Regulation (EU) 2026/1744 (Digital Omnibus on AI), amending Regulation (EU) 2024/1689. BOE, DOUE-L-2026-81147.
• Regulation (EU) 2016/679 (GDPR), Articles 5 and 28. EUR-Lex.
• Organic Law 3/2018 (LOPDGDD), Article 5. BOE.
• Royal Decree 135/2021, General Statute of the Spanish Legal Profession, Articles 21 and 22. BOE.
• Organic Law 5/2024 on the Right of Defence, Article 16. BOE.
• AEPD. Press release on the guide «Cuidado con lo que le confIAs» (27 January 2026) and the guide itself.
• AEPD. General policy for the use of generative AI in the AEPD's administrative processes (version of 27 November 2025).
• OpenAI Help Centre. How your data is used to improve model performance.
• Madrid Bar Association (ICAM). Launch of its Good Practice Guide on the Use of Artificial Intelligence in the Legal Profession (7 October 2025).