AI usage policy template for food and drink SMEs

An AI usage policy is an internal document of two to four pages that tells your teams which AI tools to use, which data never to enter into them, and what must be reviewed by a person. In a food and drink SME, it mainly protects your prices, your recipes and your labelling statements.

This article provides an eight-clause template designed for a company in the sector, with what to write in each clause and sample wording. The full, ready-to-fill version can be downloaded as a Word file. It also explains when the policy must go through employee representatives and what it does not cover.

Key takeaway

an AI usage policy fits into eight clauses: scope, approved tools, forbidden data, encouraged uses, human review, AI lead, training, review. In the food industry, two clauses matter more than elsewhere: the list of data never to enter (commercial terms, recipes, audit results) and mandatory review of any labelling statement. No law requires the policy, but in France it becomes binding on employees once appended to the company rules, after the works council has given its opinion.

AI usage policy template: what it covers and what it is not

An AI usage policy is aimed at people, not systems. It sets everyone's rules of conduct with AI tools, whether provided by the company or installed by an employee on their phone.

Document	What it covers	Who decides	Status for employees
AI usage policy	How teams use AI tools	Management, with the AI lead	Guidance, or binding if appended to the company rules
IT policy	Equipment, access, email	Management	Same logic as the AI policy
Company rules	Discipline, health, safety, sanctions	Management, after the works council's opinion	Binding
Data and AI governance policy	Which data AI sees, who decides	Management	Internal, does not target individual behaviour

If you already have an IT policy, simply add an AI chapter to it.

Shadow AI: why a food and drink SME needs a policy now

Shadow AI is AI used without the company knowing or having framed it. In a food and drink SME, it takes very concrete forms. A sales rep pastes the table of terms negotiated with a retailer into an online assistant to prepare a meeting. A sales administration assistant has an email about a dispute rephrased, including the customer's name and contact details.

None of these actions is malicious. All of them send data outside the company that it never decided to share. The practical sheets published in France by France Num, the CPME and the CNIL make the point: content entered into consumer tools may be used to train models, and confidential, personal or strategic data should be kept out of them (sheet 4, precautions, in French).

A blanket ban does not work: usage moves onto personal phones and becomes invisible. The policy instead names the safe tools and draws a clear line around what must not leave the company.

Company AI policy for food and drink SMEs: the 8 clauses

Each clause below states what it should contain and offers starting wording, to adapt to your company.

1. Purpose and scope

This clause sets out who the policy applies to and which tools it covers. It should cover all staff, including temporary workers and interns, and all AI tools: those provided by the company, but also free services used personally for work purposes.

Sample wording: "This policy applies to anyone working for the company and to any artificial intelligence tool used for work, whether or not it is provided by the company."

2. Approved and prohibited tools

List the approved tools by name, with the account to use: the business version of the chosen assistant, agents connected to the ERP, an approved translation tool. Any tool not on the list requires the AI lead's agreement. Put this list in an appendix.

Sample wording: "Only the tools listed in appendix 1 may be used with company data. Any request to add a tool is sent to the AI lead."

3. Data never to enter into a consumer tool

This is the most important clause, and the one that must be most concrete. A generic list is not enough: name the data of your sector.

Prices, discounts and terms negotiated with each retailer or distributor.
Recipes, formulations, product specifications and yields.
Purchase prices and supplier contracts.
Audit results (IFS, BRC, official inspections) and non-conformities.
Personal data of customers, employees and applicants.

Sample wording: "No data on the list in appendix 2 may be entered, pasted or uploaded into a non-approved AI tool, even if partially anonymised."

4. Encouraged uses

A policy that only prohibits gets bypassed. Say what AI can do: rephrase an email without customer data, translate an already public product sheet for export, outline a presentation, summarise a regulatory text.

5. Mandatory human review

The general principle: the person using AI remains responsible for what it produces. In the food industry, this clause must name the content that never goes out without review by the competent person: any labelling statement, the ingredients and allergens list, nutrition claims, replies to a quality complaint. The EU food information regulation makes the food business operator responsible for the information provided to consumers, allergens included (Regulation 1169/2011).

Sample wording: "No statement intended for labelling or consumer information may be produced by an AI tool without written approval from the quality department."

6. Role of the AI lead and reporting

Name the AI lead and say what the role is for: keeping the list of tools, answering questions, receiving reports. Above all, set out what to do in case of error, for example sensitive data pasted by mistake. An employee who fears being sanctioned reports nothing.

Sample wording: "Any data from appendix 2 entered by mistake is reported to the AI lead without delay. A spontaneous report does not lead to sanctions."

7. Staff training

Since 2 February 2025, the EU AI Act has required companies that use AI to take measures so that their teams know how to use it (article 4). A one-hour session on arrival, then an annual refresher, is enough in most SMEs. Keep a record.

Sample wording: "Every user of an approved tool is trained in its use and in this policy. The company keeps a list of the training delivered."

8. Review and sanctions

Tools change fast: plan a review at least once a year, and whenever a new tool is approved. For sanctions, refer to the company rules if the policy is appended to them; otherwise, the policy remains a good-practice document.

Sample wording: "The policy is reviewed every year by management and the AI lead. Breaches may lead to the sanctions set out in the company rules."

Free Word template

Download the full AI usage policy template

The ready-to-fill version of this template: all 8 clauses written out, the fields to complete highlighted, and appendices designed for a food and drink SME.

All 8 clauses written in full, with a guide to adapt them in 2 to 3 hours

The list of forbidden data specific to the food industry: retailer prices, recipes, IFS and BRC audits

An incident report form and an acknowledgement form for staff to sign

Summary: what each clause of the policy protects

Clause	What it protects	Food industry example
1. Scope	Avoids grey areas	The temporary worker in sales administration is covered
2. Approved tools	Data only goes into controlled tools	Business version of the assistant, agent connected to the ERP
3. Forbidden data	Your commercial edge and your recipes	Terms negotiated with a retailer
4. Encouraged uses	Adoption, instead of workarounds	Translating a product sheet for export
5. Human review	Consumer safety	Allergen list of a new product
6. AI lead and reporting	Fast reaction to errors	A price list pasted by mistake
7. Training	Compliance with the EU regulation	Session for each new employee
8. Review	A policy that keeps up with the tools	Update when a new agent arrives

AI acceptable use policy and company rules: do you need to consult the works council?

You have two options. A simple policy is a good-practice document issued by management: quick to put in place, but with no disciplinary weight. A policy appended to the company rules becomes binding on employees: breaches can be sanctioned.

Employment law varies by country; here is how it works in France. In the second case, the procedure for the company rules applies. The document must be submitted to the works council (CSE) for its opinion, then go through the publication formalities and be sent to the labour inspectorate, as set out in article L1321-4 of the French Labour Code. Without these steps, the policy is not binding. Company rules are only mandatory from 50 employees; below that, a simple policy remains the most common route.

Our advice for an SME just starting out: begin with a simple policy, let it run for six months, then append the settled version to the company rules.

What an AI usage policy doesn't do

It does not protect your data on its own. A written rule does not stop a copy and paste. It needs approved tools that are actually available and limited access to data.

It does not replace data governance. Deciding which data to open to an AI agent, and to whom, is a management decision, not a matter of individual behaviour. The policy is one step of it, not the whole.

It is not legal advice. This template is a starting point. Have the version appended to the company rules reviewed by a lawyer or your accountant.

Write your AI usage policy in 3 steps

List current uses before writing. Ask each department which AI tools it uses and for what, without looking for someone to blame. The policy must address real uses, not imagined ones.

Keep it short, with examples from your sector. Two to four pages, eight clauses, two appendices: the list of approved tools and the list of forbidden data.

Present it in a meeting, then train. A policy sent by email is not read. Thirty minutes per department, with the examples from clause 3, is enough.

Frequently asked questions about AI usage policies

Is an AI usage policy mandatory for an SME?

No, no text requires it as such. But the EU AI Act already requires companies that use AI to train their teams, and GDPR requires personal data to be protected. The policy is the simplest way to show these obligations are handled, and to protect data that the law does not cover, such as your prices or your recipes.

Do you need to consult the works council to introduce an AI policy?

In France, yes if the policy is appended to the company rules, because it then follows the same procedure: works council opinion, publication, sending to the labour inspectorate. A simple good-practice policy with no disciplinary weight does not require it. Check the equivalent rules in your own country.

Can you ban ChatGPT at work?

Yes, an employer can restrict the use of a tool for work, provided the restriction is justified by the protection of the company and proportionate to the aim pursued. In practice, a total ban pushes usage onto personal phones. It is better to approve a business version, which offers more guarantees on data, and to prohibit consumer versions for sensitive data.

Who writes the AI policy in an SME without a lawyer?

The managing director, with the AI lead and a representative of each department that uses AI. Starting from a template, such as the one in this article or the free template from the canton of Geneva, saves most of the time. A review by a lawyer or accountant is only really needed for the version appended to the company rules.

What should you do if an employee has already pasted sensitive data into an online assistant?

Start by identifying what was entered and in which tool, then delete the conversation if the tool allows it. If personal data is involved and the breach poses a risk to individuals, GDPR requires you to notify your data protection authority within 72 hours. In any case, use the incident to complete clause 3 of the policy.

AI usage policy template: 8 clauses for food and drink SMEs