Most small teams already use AI. Someone drafts emails in ChatGPT, someone summarises meeting notes in Claude, someone asks Gemini to fix a spreadsheet formula. The problem is rarely that people use AI. The problem is that everyone uses it differently, nobody knows what is allowed, and nobody checks the output. A short policy and a few weeks of practical training fix most of that.
This guide gives you both: a one-page AI policy you can copy, a 4-week training plan, a clear list of data that should never go into a chatbot, and simple ways to measure whether any of it is working.
Why train your team on AI at all
Untrained use of AI tends to fail in three predictable ways:
- Quality: people copy answers without checking them, and invented facts, wrong prices or outdated rules end up in client emails.
- Privacy: client details, contracts or passwords get pasted into personal accounts that the business does not control.
- Wasted time: people try AI once, get a vague answer from a vague prompt, and decide it is useless.
Good AI training for employees is not about teaching theory. It is about showing each person how to do their own weekly tasks faster, and where the limits are.
Is AI training a legal requirement?
In the European Union, it can be. Article 4 of the EU AI Act, on AI literacy, has applied since 2 February 2025 to companies that provide or use AI systems, including businesses outside the EU when their AI use reaches people in the EU. A 2026 amendment, known as the Digital Omnibus on AI, softened the wording: businesses must take measures to support the AI literacy of staff and others using AI on their behalf, without having to guarantee a specific level for each person. The European Commission's guidance says no certificate is required and that training should match the risk of how you use AI. In practice, a short documented training session and a written policy are a sensible baseline for a small business, wherever you are based. This is general information, not legal advice.
The one-page AI policy template
Your AI policy template should fit on one page. If it is longer, nobody will read it. Copy this checklist, adapt the wording, and share it with everyone who works for you, including freelancers.
1. Approved tools
- We use these AI tools for work: [for example ChatGPT Business, Claude Team, Gemini in Google Workspace].
- We use company accounts, not personal free accounts, for anything involving business information.
- New tools (browser extensions, meeting recorders, AI plugins) need approval from [name] before use.
2. Data rules
- Never paste the data listed in our "red list" (see below) into any AI tool.
- Remove names and identifying details from client material before using AI, unless the tool is approved for that data.
- When in doubt, ask [name] first.
3. Checking the output
- A person reads and checks every AI output before it goes to a client, a website or a public channel.
- Facts, numbers, prices, dates, legal and medical statements are always verified against a trusted source.
- The person who sends it is responsible for it, not the AI.
4. Transparency
- We tell clients when they are talking to an AI chatbot rather than a person.
- We do not use AI to imitate a real person's voice, face or writing without their permission.
5. Things AI does not decide alone
- Hiring, firing, pay, credit, pricing for a specific client, and complaints are decided by a person.
- AI can help prepare information, but a named person makes the decision.
6. Ownership and review
- Policy owner: [name]. Questions and incidents go to them.
- If sensitive data is shared by mistake, report it the same day. No blame for quick reporting.
- We review this policy every 6 months.
What data should never be pasted into AI
Business plans of the major AI tools usually offer stronger privacy terms than free personal accounts, and many do not use your business data for training by default. Check the data settings of each tool you approve. Even so, keep a simple red list that applies everywhere:
- Passwords, API keys, access codes and two-factor backup codes.
- Payment data: card numbers, bank account details, IBANs.
- Identity documents: passport, ID, visa or residence numbers and scans.
- Health information about clients or staff.
- HR files: salaries, performance reviews, disciplinary notes.
- Client personal data (names with phone numbers, addresses, emails) in personal or unapproved accounts.
- Confidential contracts and documents under NDA, unless the tool and account are approved for them.
- Unreleased financial results and anything price-sensitive.
A useful rule of thumb: if you would not post it in a shared office chat with a new freelancer, do not paste it into an AI tool.
A 4-week AI workshop plan for teams
An AI workshop for teams works best as short weekly sessions tied to real work, not a single long day. This plan needs about 60 to 90 minutes per week plus practice time.
| Week | Focus | Session content | Homework |
|---|---|---|---|
| 1 | Basics and rules | What AI tools are good and bad at, why they invent facts, walk through the policy and the red list, set up company accounts. | Each person lists 5 repetitive tasks from their week. |
| 2 | Prompting for daily work | Writing clear prompts: role, context, task, format, examples. Practise on emails, summaries and replies using everyone's own tasks. | Use AI on 3 real tasks and note the time saved or lost. |
| 3 | Checking and reusing | How to fact-check output, spot errors, and build a shared prompt library for recurring tasks (quotes, follow-ups, social posts). | Add 2 tested prompts to the shared library. |
| 4 | Workflows and next steps | Using AI with files and spreadsheets, where simple automations fit, review of results, agree on 2 or 3 team use cases to keep. | Each person picks one task to do with AI every week. |
Tips that make training stick
- Use real tasks: generic demos are forgotten. A salesperson should practise on real follow-up emails, an admin on real invoices (with data removed).
- Name an internal champion: one person who collects good prompts and answers simple questions.
- Keep a record: date, attendees and topics covered. It takes two minutes and helps if a client or regulator ever asks.
- Pick one main tool: training on three assistants at once confuses people. If you have not chosen yet, see our comparison of ChatGPT vs Claude vs Gemini.
How to measure results
You do not need a dashboard. Measure a few things before week 1 and again after week 4:
- Time per task: ask each person to time 3 of their recurring tasks before and after. Even rough numbers are useful.
- Adoption: how many people use the approved tool at least weekly. Most business plans show basic usage data in the admin panel.
- Quality: count errors caught in review, and any client complaints linked to AI content.
- Incidents: number of times red-list data was shared by mistake. The goal is zero, but a reported incident is better than a hidden one.
- Prompt library: number of tested prompts the team actually reuses.
Review these numbers after 30 days and again after 90. Keep what works, drop what does not, and update the policy if new tools have appeared.
When to move beyond training
Once your team is comfortable, the next step is usually to connect AI to the tools you already use: a website or WhatsApp chatbot that answers common questions, or automations that move data between your forms, CRM and inbox without copy and paste.
If you are in the UAE
The UAE's federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) applies to how businesses handle personal data, and companies in the DIFC or ADGM free zones follow their own data protection rules. Your red list and approved-tools section should reflect whichever applies to you. If your team serves clients in the EU, the EU AI Act literacy obligation can apply too.
Get help training your team
dhowly runs practical AI training for teams on ChatGPT, Claude and Gemini, in English or French, built around your real tasks, and can help you adapt the policy above. Book a free 15-minute call through our contact form. We work with businesses worldwide, remotely.
Frequently asked questions
Do small businesses need a written AI policy?
There is no universal legal requirement for a written policy, but a one-page policy is the simplest way to set clear rules on approved tools, sensitive data and checking output. It also gives you a record that you took reasonable steps if a client or regulator ever asks.
Is AI training mandatory under the EU AI Act?
Article 4 of the EU AI Act, applicable since 2 February 2025, requires providers and deployers of AI systems to take measures to support AI literacy among staff. A 2026 amendment softened the wording so businesses do not have to guarantee a specific level per person. No certificate is required. This is general information, not legal advice.
How long should AI training for employees take?
For most small teams, four weekly sessions of 60 to 90 minutes, plus short practice tasks, is enough to cover the basics, prompting, checking output and a few shared workflows. Refresh sessions every 6 months help as tools change.
Can employees use free ChatGPT or Claude accounts for work?
It is safer to provide company accounts on a business plan, which usually offer admin controls and stronger data terms. If you allow free personal accounts, restrict them to non-sensitive tasks and make sure the red list is followed strictly.
Which AI tool should we train our team on first?
Start with one tool that fits the software you already use, for example Gemini if you run Google Workspace, or ChatGPT or Claude for general writing and analysis. One tool, used well, beats three tools used occasionally.
