AI Policy for Financial SMEs: Template to Download

An AI policy for a financial SME does not need to be long. Two pages are enough if they clearly state which tools are allowed, which data may go where, and who approves new applications. This article shows what belongs in such a policy and how to introduce it in a single team meeting. Below you will find the template as a PDF and as an editable Word file.

Do you know which AI tools your team is using today?

In a July 2026 study by the Lucerne University of Applied Sciences and Arts and Finup, 49 percent of surveyed independent wealth managers said they use AI. Two thirds of these applications remain experiments, and only 11 percent are in productive use (AI Use Cases and Crypto Assets in External Asset Management, July 2026).

In practice, experiment means this: employees try out public tools, often with a personal account, and nobody in the firm knows exactly which data flows where. That is not a reproach to the teams. The need behind it is legitimate: faster drafts, better summaries, less time spent on wording. The problem is not the usage itself, but that it happens without rules.

That is why I like to ask a simple question in first meetings: do you know which AI tools your team is using today? The honest answer is almost always: roughly. That is exactly what the policy is for. It turns quiet usage into discussed usage.

Why is a short policy enough?

A ban does not work. It simply moves usage to private devices and personal accounts, where you see it the least. What works is a short, binding rule that everyone in the team can apply.

A two-page policy answers four questions: What is allowed? Which data may go where? Who decides when in doubt? What happens when something goes wrong? That is all it takes to turn experiments into governed use.

Large institutions solve the same problem with forty-page governance frameworks, because they have thousands of employees and a supervisor watching. A firm of five or fifteen people needs the same clarity, but not the same machinery. The two pages are the SME version of it.

It also helps to be clear about what the policy is not: not a legal document and not a bureaucracy project. It is a working rule, discussed in one team meeting, that holds up in daily work.

What belongs in an AI policy?

The template below consists of eight sections. Each section contains a ready-made governing sentence with placeholders, plus a guidance note that tells you what to adapt to your firm.

Section	What it covers
1. Purpose and scope	Who and which tools the policy applies to, including private use involving business content
2. Approved tools	Only approved tools from the inventory; no personal accounts for business content
3. Data classes	The traffic light: green (public), yellow (anonymised), red (confidential and personal)
4. Approvals	New tools and new use cases with yellow or red data need a documented approval
5. Responsibility	One person owns the policy, the inventory, and the approvals; a human always reviews AI output before use
6. Inventory	A simple list of all tools with provider, purpose, data class, location, and contract
7. Training	Everyone reads the policy when joining and after changes; the data classes are practised with real examples
8. Handling incidents	Mistaken entries are reported immediately, explicitly without disciplinary consequences

The traffic light from section 3 works well as an office poster: one sheet, three rows, no case-by-case debates.

Two sections deserve a closer look. The data classes are the heart of the policy: without them, every discussion becomes a case-by-case debate; with them, the answer is usually obvious. Keep in mind that anonymising is harder than it sounds: “My client, 58, an entrepreneur from Zug, is selling his company” is identifiable even without a name. Yellow means that even the combination of attributes identifies nobody.

The inventory is the underestimated section. A plain table with six columns is enough. Towards supervisors and in client meetings, this list is the fastest proof that you are in control. FINMA names exactly these foundations in its supervisory notice 08/2024 on artificial intelligence: an overview of the applications in use, clear responsibilities, and functioning controls (FINMA, December 2024). The notice is aimed at supervised institutions, but its logic is a good orientation for any financial SME.

How do you introduce the policy in a team meeting?

Plan for 60 to 90 minutes. The agenda that has proven itself in practice:

1. Take stock without blame (15 minutes). Ask openly who uses which tools for what today. Announce upfront that this round has no consequences. Experience shows that more ends up on the table than the leadership expected.
2. Introduce the traffic light (10 minutes). Explain the three data classes using two or three real examples from your daily work: a client email, a market report, a meeting note.
3. Fill in the template together (30 minutes). Go through it section by section and replace the placeholders. The discussion about the yellow class is usually the most valuable quarter hour of the meeting.
4. Responsibility and inventory (15 minutes). Appoint one person and start the inventory right away with the tools in use today.
5. Agree on a reporting channel (10 minutes). Say explicitly that reporting is encouraged and has no consequences. Only what gets reported can be contained.
6. Set a review date. Go through the policy and the inventory once a year, because providers change their plans and data usage. One calendar entry is enough.

Do not present the policy to the team as a ban, but as a permission: from today you may use these tools, and here is how. That changes the mood in the room completely.

From my practice: That large institutions do not leave their AI governance to chance is something I see continuously at additiv. The pattern is the same everywhere: an inventory of applications, clear roles, and a record of decisions. What transfers to a small firm is not the committees, but the questions. A small firm answers the same questions on two pages and is ahead of most. The most frequent surprise in these conversations: once it is openly on the table who uses what, shadow usage disappears by itself, because there is an allowed, better alternative.

Download the template

The template contains all eight sections as ready-made governing sentences with placeholders in square brackets, each with a guidance note. It is deliberately cautiously worded: not a legal document, but a working paper that you adapt to your firm. Enter your email address and we will send you the download link. You can then also download the template directly here.

Note: We are not a law firm. The template and all statements in this article on legal and regulatory topics are subject to change and do not replace legal advice. Have your completed policy reviewed by a qualified professional, in particular for questions on data protection (revised Swiss Data Protection Act, Fedlex), professional secrecy, and supervisory law. For specific questions, please consult a lawyer.

Conclusion: your next step

Schedule a 60 to 90 minute team meeting within the next two weeks and put the printed template on the table. Start with the no-blame stocktaking, introduce the traffic light, and fill in the sections together. That puts you ahead of two thirds of the industry, which, according to the study, is still in experimentation mode.

The data protection duties behind the policy are summarized in the revFADP checklist for financial firms. How to move from governed usage to productive use cases is covered in our guide AI for financial service providers: use cases, costs, and approach. What is allowed with client data in ChatGPT and what is not is covered in ChatGPT in daily wealth management. And if you would like to see what a protected environment for client data looks like in practice: we show an example at AI for wealth managers.

FAQ

Is this template legally binding?

No. It is a working paper that you adapt to your firm, and it does not replace legal advice. Have the completed version reviewed by a qualified professional, especially for questions on data protection, professional secrecy, and supervisory law.

Is a policy worth it for a three-person office?

Yes, especially there. In a small team, advisory work, administration, and compliance often sit in the same hands. A short written rule prevents every AI question from becoming a case-by-case debate, and it is the fastest proof towards banks, supervisors, and clients that you are in control of client data.

How often should we update the policy?

At least once a year, together with the inventory. Also with every new approval and whenever a provider changes its plans or data usage. The Swiss data protection commissioner (FDPIC) regularly publishes guidance that serves as orientation (edoeb.admin.ch).

What is the difference between a policy and a privacy notice?

The policy is an internal working rule for your team. The privacy notice informs the outside world how your firm handles personal data. The two are connected but do not replace each other: the policy governs behaviour, the notice documents it towards the people affected.

What should we do if someone breaks the policy?

Start with a conversation, not a sanction. In most cases there is no bad intent behind it, but a legitimate need without an approved path. Check whether the policy overlooks a real need and adjust it. That is why the no-consequences reporting channel matters so much: it surfaces the cases where the rule does not yet fit daily work.