Quick answer: A working AI policy rollout takes 30 days in four phases: Week 1 — customize the policy and inventory current AI use; Week 2 — leadership sign-off and manager pre-briefing; Week 3 — company-wide announcement and training; Week 4 — attestations, the question channel, and the first compliance check. The two factors that decide success: leadership visibly using the approved tools, and framing the policy as enabling AI use rather than banning it. The training-and-attestation step also produces your evidence for the EU AI Act's Article 4 AI literacy duty, in force since 2 February 2025.
Plenty of companies have an AI policy. Far fewer have employees who've read it, follow it, and know who to ask when a case isn't covered. The gap is the rollout. Here's a day-by-day plan built for SMB reality — no compliance team, limited meeting tolerance, people already using AI whether you like it or not.
Before Day 1: The Two Decisions That Shape Everything
Decision 1: Enable or restrict? If your policy's emotional center is "don't," people will route around it with personal accounts, and you'll lose visibility — the worst outcome. The policies that stick say: here are good tools we pay for, here's how to use them safely, here's the line.
Decision 2: Who owns the rollout? One name. They customize documents, run the training, answer questions, chase attestations. Without a named owner, week 3 never happens.
Week 1: Prepare (Days 1–7)
Days 1–2 — Customize the policy documents
Start from templates, not a blank page. You need at minimum an AI usage policy and a generative AI acceptable use policy; add data handling rules if you handle client or personal data (you do). Replace bracketed fields, delete sections that don't apply, and cut anything that makes the documents exceed roughly six pages each.
Days 3–4 — Inventory current AI use
Send a three-question, no-blame survey: What AI tools do you use for work? What do you use them for? What account type (company/personal/free)? Promise amnesty and mean it. The results tell you which tools to approve, which to replace with safer equivalents, and which red lines need the most emphasis in training.
Days 5–7 — Choose and provision approved tools
For each high-usage tool, decide: approve (business tier, training opt-out verified, DPA signed) or substitute. Provision accounts before announcing the policy. Announcing rules without providing tools reads as a ban with extra steps.
Week 2: Align Leadership (Days 8–14)
Days 8–10 — Executive sign-off
Get leadership to approve the documents and — more important — to agree on the message: "We want you using AI well. This is how." A policy undermined by an exec pasting board materials into a personal chatbot is dead in a month.
Days 11–14 — Manager pre-briefing
Thirty minutes with managers before the all-hands: walk the green/yellow/red structure, give them answers to the predictable questions, and assign them one job — reinforce, don't improvise exceptions.
Working from the Policy Pack? The AI Usage Policy Pack ($29) includes all three policies pre-drafted plus a rollout guide that mirrors this plan — the bracketed-field customization in Days 1–2 takes an hour, not a week.
Week 3: Launch (Days 15–21)
Day 15 — Announce
Short company-wide message from the CEO or founder, not from "compliance": why now (one sentence), what's changing (approved tools + rules), what happens next (training this week, attestation after). Link the documents.
Days 16–18 — Train everyone
One 30–45 minute session (recorded for absentees and future hires):
- Why — one real horror story, two minutes
- The traffic light — green/yellow/red with examples from your workflows
- Data rules — what never goes into which tools
- You own the output — verification expectations
- Live demo — someone respected doing a green-tier task well with an approved tool
- Q&A — capture every question; the unanswerable ones become policy clarifications
This session is your Article 4 AI literacy core training. Keep the deck, the attendance list, and the recording.
Days 19–21 — Open the question channel
A dedicated Slack/Teams channel or alias where "is this okay?" gets answered within one business day. The channel matters more than the policy text.
Week 4: Embed (Days 22–30)
Days 22–24 — Collect attestations
One-line signed acknowledgment from every employee and contractor. Chase to 100% — the last 10% are disproportionately the people you need on record.
Days 25–27 — First compliance check
Lightweight, announced, no-blame: spot-check that approved accounts are being used, training opt-outs are still active, and nothing on the red list shows up in tool logs. You're testing the system, not hunting offenders.
Days 28–30 — Close the loop
- Fold Q&A clarifications into a one-page FAQ appended to the policy
- Add policy training to onboarding so new hires get it in week one
- Book the six-month review and diary regulatory dates (Article 50 transparency disclosures land 2 August 2026; the full deadline checklist has the rest)
- Report completion to leadership: tools approved, % trained, % attested, questions handled
The Four Rollout Killers
- Policy without tools. Rules plus no approved alternatives = shadow AI with better camouflage.
- Launch without training. A PDF in a shared drive has a read rate you don't want measured.
- Training without attestation. No records means no Article 4 evidence and no enforcement footing.
- Launch without maintenance. No question channel, no review date — the policy is stale by Q3. If you're building the surrounding structure, the governance framework guide picks up where this plan ends.
FAQ
How long does an AI policy rollout take?
Thirty days works for most SMBs: a week of preparation, a week of leadership alignment, a launch week with training, and an embedding week for attestations and follow-up.
Should employees sign the AI policy?
Yes. A one-line attestation after training gives you enforcement footing and doubles as documented evidence for the EU AI Act's Article 4 AI literacy obligation, in force since February 2025.
What if employees are already using unapproved AI tools?
Expected — start with an amnesty survey to surface actual usage, then approve business-tier versions of the popular tools where feasible.
How do we keep the policy from going stale?
Three mechanisms: a question channel that generates living FAQ clarifications, a six-month review date, and diarized regulatory triggers — the next being the EU AI Act's transparency obligations on 2 August 2026.
Run this plan with the documents already written. The AI Usage Policy Pack ($29) includes the three core policies and a step-by-step rollout guide. Rolling out governance and EU AI Act compliance at the same time? The Complete AI Compliance Stack ($199) covers the full 30-day path.
This article is for general information only and is not legal advice. Consult qualified counsel for your specific situation.