In Luxembourg, 48% of the companies surveyed by FEDIL, the Luxembourg AI Factory and Luxinnovation have an AI governance policy and 46% do not, according to the report published on 2 June 2026; the share of companies without a policy dedicated to generative AI remains high and unchanged since 2025, while blocking the tools has become marginal. Article 4 of the AI Act, applicable since 2 February 2025 and rewritten by the regulation of 8 July 2026, requires companies using AI systems to take measures to develop their teams' AI literacy; the Commission's Q&A states that no certificate is required and that an internal record is enough to document those measures. A written usage policy is the first of those measures. We publish here the one-page template we use with the companies we train, section by section, and the record that goes with it. This template describes a practice; it does not replace a lawyer's advice.
The facts
- The FEDIL, AI Factory and Luxinnovation report (136 respondents, survey from 27 January to 13 March 2026) describes generative AI as a productivity tool that has become standard, which employees bring to work as they use it at home. 48% of companies have an AI governance policy, 46% do not and about 6% do not know; the report distinguishes this general governance from rules specific to generative AI, whose absence remains the norm. The risks it associates with unmanaged use: data protection, confidentiality, intellectual property, compliance, security and human oversight.
- Article 4 of the AI Act, as worded since 27 July 2026, requires providers and deployers of AI systems to take measures to support the development of AI literacy among their staff and the persons operating or using those systems on their behalf, taking into account their knowledge, experience, education and training and the context of use, without guaranteeing any specific level. The Commission's Q&A (updated on 20 October 2026) adds that no certificate is required, that no level has to be measured, that no governance structure or AI officer is imposed, that relying only on the tools' instructions for use is generally insufficient, and that an organisation may keep an internal record of its training and initiatives. Supervision falls to national authorities since 2 August 2026.
- Two recent signals show where a usage policy wears out first. The NTAC project (Ministry of Labour, SMC and IMS Luxembourg, press release of 21 October 2026) found among the 11 organisations supported a good level in data handling and collaboration, and progress to be made in information searching, responsible use of digital tools and document sharing. Meta's commercial terms in force since 30 October 2026 make the advertiser solely responsible for the edits the platform's AI makes to its ads: human review of outputs is no longer just good practice, it is the platforms' contractual position.
A one-page usage policy: the nine sections
A usage policy fits on one page when it answers concrete questions: who is concerned, with which tools, which data never leaves, who reviews, how AI-produced content is flagged, whom to ask. The table below sets out the nine sections of our template, with what each one fixes and an example wording to adapt. The examples cite common tools and cases; each company replaces them with its own.
| Section | What it fixes | Example wording |
|---|---|---|
| 1. Scope | Who the policy applies to and for which uses | This policy applies to anyone using a generative AI tool on behalf of the company: employees, interns, contractors. |
| 2. Approved tools | The list of tools and accounts, and the ban on personal accounts for company data | The approved tools are those provided by the company, on a professional subscription. No company data is entered into a personal account. |
| 3. Prohibited data | What never leaves the company, whatever the tool | Never entered into an AI tool: personal data of customers or employees, health data, contracts, trade secrets, passwords, documents classified as confidential. |
| 4. Human review | Who reviews, and what is checked at source before external use | Any content intended for a customer, a partner or the public is reviewed by a responsible person. Figures, quotes, legal references and names are checked at source. |
| 5. Transparency | Internal flagging and labelling of published content | Content generated or modified by AI is flagged internally. Published content is labelled in line with the AI Act's transparency obligations. |
| 6. Intellectual property | What is not reproduced, and who owns the assistants created | No protected content is reproduced without authorisation. Prompts, projects and skills created for the company are kept in its accounts. |
| 7. Retention | Where conversations live and what happens to them when someone leaves | Useful conversations and assistants are kept in the company's accounts; access is transferred or closed when an employee leaves. |
| 8. Contact person and reporting | Whom to ask for a new tool, an error, a doubt | An AI contact person is appointed. Any request for a new tool, any error found and any doubt about data are addressed to them. |
| 9. Training and review | Who is trained, when, and how often the policy is reviewed | Every user attends a training session before use. The policy is reviewed every six months and at each change of tool; training sessions are entered in the record. |
The record: what we advise documenting
The Commission's Q&A describes no format: it states that an organisation may keep internal traces of its training and initiatives. In our practice, a spreadsheet is enough, kept by the AI contact person or by human resources, with one line per action: the date, the content (training, policy circulation, review, new tool), the participants and their roles, the trainer or the person in charge, the materials handed out, and proof that the policy was circulated, for instance an acknowledgement of reading. A column for the tools approved at that date avoids reopening the debate at every version change.
This record serves three purposes. It shows the measures taken within the meaning of Article 4 if an authority or a client asks. It tells who was trained on what when a team changes. It makes the policy review simple, because it says which tools, rules and training existed at each date. What Article 4 does not require, the record does not have to contain: no certificate, no number of hours, no individual score.
What the policy does not settle on its own
A page of rules without training produces rules that get bypassed. The gaps noted by NTAC, information searching, responsible use of tools, document sharing, are everyday gestures: knowing that a document is confidential is not enough if one has not learnt to work with the tool without handing it over. That is why section 9 ties the policy to training before use, by role and on the company's real cases, and why our in-company courses include a module on safe use (confidentiality, GDPR, AI Act).
Nor does the policy settle what platforms decide. When an advertising platform edits an ad with its AI and leaves the responsibility to the advertiser, as Meta has since 30 October, the human review rule (section 4) must also cover content produced by the platforms' tools, in addition to what is produced in ChatGPT or Claude. Finally, a policy is no legal opinion: for personal data, contracts and regulated professions, the text is reviewed with a lawyer, and the question of data that must stay in Europe is handled at tool level, for instance with a chatbot hosted in Europe.
In Luxembourg: what companies already have, and what is missing
Luxembourg companies have lifted the block: the FEDIL report notes that banning generative AI became marginal between 2025 and 2026, and that 53% of respondents plan to develop or host generative AI solutions locally, with data security and sovereignty as the main motivations. What is missing is the written rule: one company in two has no governance policy, and a policy specific to generative AI remains the exception. The national supervisory framework is not finalised either: bill 8476 provides for the CNPD to be the default supervisory authority, and the Council of State raised several formal objections in July, as we wrote in our article on AI training in Luxembourg, which also lists the public training schemes.
For a Luxembourg SME, the order we recommend is therefore this: the page of rules first, because it is written in one meeting and is the simplest measure to document; training next, by role; the record from the first session. Continuing vocational training aid and the Skills-Plang are to be checked with INFPC and ADEM; we do not claim eligibility for any training without that check.
Putting the policy in place in five steps
The steps below are our own practice; they take a few weeks for an SME.
- Inventory actual uses. One week of collection, department by department: which tools, on which accounts, for which tasks, with which data. The inventory almost always reveals personal accounts and documents already shared.
- Write the page. Leadership, a representative of each business function concerned, and a lawyer if the company handles sensitive data. One meeting to fill in the nine sections, one review, one sign-off.
- Circulate with acknowledgement of reading. The policy is handed to every person concerned, and the date is entered in the record. That is the record's first line.
- Train by role on real cases. Leadership, managers, business functions and technical profiles do not have the same uses; exercises start from the participants' files, and every session is entered in the record.
- Review every six months. New tools, new versions, new obligations: the review is entered in the record with the list of tools approved at that date.
A company that has taken these five steps has the measure Article 4 asks for, its proof, and rules its teams know because they have practised them.
AIxH's view
We wrote this template because the question comes up at every training session: what can go into the tool, and who reviews? The answer is built with the company, from its own cases. Our AI training courses in Luxembourg take place in person, on the participants' files, with a module devoted to safe use; our ChatGPT and Claude integration service configures assistants with the rules of use and the excluded data written down in black and white. The one-page template is the starting point; training and the record are what keep it alive.
