AI policy consulting has become its own little industry, and Irish businesses are being quoted serious money for a document most of them could scope in an afternoon. That does not mean the document is pointless, far from it. It means the gap between what you actually need and what you are being sold is wide, and worth understanding before you spend anything.
An AI policy is a short, plain-English document that answers a handful of questions: which AI tools are approved, what data can and cannot go into them, who owns the policy, when you disclose that AI was used, and how all of that lines up with GDPR and the EU AI Act. That is it. It is not a forty-page compliance manual, and the version that runs to forty pages usually does so because someone is billing by it.
Do you need one? If anyone on your team is already using AI, and they are, with or without permission, then yes, now. The policy is not bureaucracy for its own sake; it is the thing that stops client data ending up in a consumer chatbot, gives staff clear guardrails so they use AI confidently instead of secretly, and means that when a client or auditor asks how you govern AI, you have an answer. Most Irish SMEs sit in the EU AI Act's minimal- and limited-risk tiers, so the obligations are light, but light is not nothing.
The practical shape we use with clients fits on a page or two: a register of approved tools and what each is for; one named owner, often the COO or a partner, part-time; a short acceptable-use list, including the hard never-paste-this rules for client, financial, and NDA-covered data; a fifteen-minute vendor check before any new tool goes live; and a line on disclosure. It costs internal time and a bit of guidance, not a five-figure invoice.
We write and maintain AI policies as part of how we help businesses adopt AI, usually alongside training, so the policy is not a PDF that dies in a shared drive but something the team actually understands. If you want a second opinion on whether you need one, or on a quote you have been given, that is a thirty-minute conversation, and a cheaper one than the assessment you are probably being sold.
