AI in a team or company: rules, costs and literacy

Three employees, three ways

At Mr Manuel's drugstore in town, three people work. Ana uses AI on her phone to write the ads for social media. Paulo pastes supplier emails into his free personal account, to summarise them. Rita does not use it, because she thinks "it is forbidden", although nobody ever said so.

Nobody is doing harm on purpose. But the shop does not know what data has left, how much is being spent, or who answers if an ad goes out with the wrong price. One simple thing is missing: a written rule.

The use rule on one page

A good rule fits on one page and answers four questions.

1. What you can do. With examples from the shop: "write drafts of ads and emails", "summarise documents with no personal data", "translate notices for foreign customers".

2. What you cannot do. "Send a customer a text from the AI without reading it." "Use AI to decide about people", such as who gets which shift or who gets a discount. "Use personal accounts for work."

3. Which data never goes in. The list you saw in Level 1 (customer data, ID numbers, health, passwords, contracts), written in your company's own words: "the customer sheet for the discount card never goes in".

4. Who answers. Whoever sends something answers for what they sent, even if the AI wrote it. Also write down who to ask when in doubt and who to warn when something goes wrong.

At the end, a date and the sentence "we review this rule every six months". The tools change fast.

Personal accounts or a company account

When everyone uses their own personal account, three things are outside the company's control:

• The data. The conversations belong to the person, not to the company. If Paulo leaves, he takes the history with him, supplier emails included. And the privacy settings (for example, whether the conversations are used for training) are the ones he chose, or the ones it came with.
• The invoicing. A subscription paid with a personal card usually carries the person's billing details, not the shop's, and nobody knows for sure how much is being spent in total. Confirm that the billing details identify the company and centralise the record of expenses.
• Who sees what. In a company account there is an administrator who gives and removes access, chooses the privacy settings for everyone and shares projects with the team. Depending on the service, they may also see usage logs. Tell people this, clearly.

In company accounts, these options are usually in an admin area, separate from the personal settings. Before you sign up, look in the terms for three answers: is the data used for training? Where is it stored? What happens when the account is deleted? This is how it looks on 6 October 2026; your screen may differ. Look for the button with the same name.

Costs: doing the sums without numbers

Prices change almost every month, so they are not here: see the Current state page. What does not change is the way of thinking. There are two ways to pay:

• Per person per month. A fixed amount for each seat. It is predictable. It pays off for someone who uses it every day; for someone who uses it once a month, it is money sitting idle.
• Per use. You pay according to the amount of text the AI reads and writes. It is the usual way when you connect AI to an automation, as in the previous lesson. It can come out cheap, or shoot up if a flow gets stuck going round in circles. So always set a spending cap.

To estimate, make a simple table: who uses it, for what, how many times a week. Try it for a month, with a cap, and compare the invoice with the estimate.

AI literacy: what the law asks

The AI Act (Regulation (EU) 2024/1689) has an article on AI literacy, Article 4. It was rewritten by Regulation (EU) 2026/1744, in force since 27 July 2026. In the current wording, companies and organisations that use AI at work must take measures to promote AI literacy among the people who use it on their behalf. It no longer speaks of guaranteeing a set level for each person.

In shop language: if you put your employees to work with AI, help them understand what they are using. The one-page rule is one such measure. This course, taken by the team, can be another part. Keep a simple note of who did what training and when.

Sources: Regulation (EU) 2024/1689 and Regulation (EU) 2026/1744, on EUR-Lex. This is not legal advice.

Exercise: the drugstore's rule

Help me write the AI use rule of a drugstore with 3 employees, on a single page, in plain English.
We use AI for: [e.g. social media ads, summarising supplier emails, translating notices].
Data we have that must never go in: [e.g. customer sheet, purchase prices, photographs of prescriptions].
Who to ask when in doubt: [name or role].
Organise it in 4 parts: what you can do, what you cannot, data that never goes in, who answers. Use concrete examples, not general sentences. At the end, one line with the review date.