Guide
What to include in a small business AI policy
An AI acceptable-use policy does not need to be long. It needs to answer four questions a staff member will actually have: which tools am I allowed to use, what may I put into them, what must a person check, and who do I tell when something goes wrong. In practice that fits on two printed pages and takes about thirty minutes to write, once you know which sentences matter. Below is the structure we use, with the reasoning behind each part.
1. Say who and what the policy covers
Open with one sentence naming the business, the people it applies to, and the tools it covers. Cover employees, contractors, and interns, and say that it applies to AI features inside software you already use, not just standalone chatbots. This is the section that stops the argument later about whether the policy was ever meant to cover the thing that went wrong.
2. Write an approved-tools table
List the tools people may use for work, and for what. A three-column table is enough: tool, approved use, and whether customer data is allowed in it. If a tool is not on the list, the rule should be ask first, not decide for yourself. Most real problems come from a free tier someone signed up for on a Tuesday afternoon, not from the tools you chose deliberately.
3. Name the prohibited uses
Be specific. No entering customer names, health details, or account numbers into tools that are not approved for that data. No publishing AI-written text as fact without checking it. No using AI to make final decisions about hiring, credit, or discipline, and no using it to imitate a person's voice or likeness without their permission. Named prohibitions get followed; vague encouragement does not.
4. Set the human review rule
Pick a small set of outputs that always get a person's eyes before they leave the building: anything customer-facing, anything legal or financial, and anything that goes out under the company's name. Say who reviews it. One sentence is enough, and it is the sentence that matters most when a client asks how the work was produced.
5. Say how people report a mistake
A policy with no reporting route teaches people to hide problems. Give one named person or role to tell, and say plainly that reporting a mistake quickly is the expected behavior. Fast disclosure is the difference between an incident and a cover-up.
6. Close with consequences and a review date
State that repeated or deliberate violations are handled through normal performance processes, and put a date on the policy saying when it gets reviewed. AI tools change fast, so a policy written once and never reopened is out of date within a year.
The clauses small policies usually forget
The approved-tools table with a data column
Most one-page policies list tools but never say which of them may hold customer information. A three-column table that separates tools approved for customer data from tools approved only for public or internal work is what makes the policy usable on a busy Monday.
“Tools in the left column may be used for ordinary work. Tools in the middle column may not be given customer names, contact details, or account numbers. Anything not listed requires approval from the policy owner before first use.”
The named person who approves a new tool
A rule that says ask before using a new tool is only followed when there is a person to ask. Name the role, not a committee, and say how quickly they answer so nobody is blocked waiting.
“New AI tools must be approved by the policy owner before use. Requests are answered within two business days.”
The no-raw-customer-data sentence
This single sentence prevents the most common real incident: an employee pasting a customer email thread into a free chatbot to get a reply drafted faster. Say it explicitly and give the approved alternative.
“Do not enter customer names, email addresses, phone numbers, or account details into any AI tool that is not approved for customer data. Use the approved tool, or remove identifying details before pasting.”
The human review line for anything customer-facing
AI output leaves the building under the business name. Stating which outputs always get a person's review, and who reviews them, is the clause clients and insurers ask about first.
“Any AI-generated text sent to a customer, client, or regulator must be reviewed by a person before it is sent. AI-generated work is never sent as a final deliverable unread.”
The reporting route for a mistake
Policies without a reporting path teach people to hide errors. Name one route and promise that using it promptly is the expected behavior rather than a confession.
“If you think an AI tool has received information it should not have, or has produced something wrong that was sent out, tell the policy owner the same day. Reporting a mistake quickly is always the right call.”
A review date on the first page
AI tools change monthly. A policy with a review date gets reopened; one without it quietly becomes a document about software nobody uses any more.
“This policy is reviewed at least once a year, and whenever the business adopts a new AI tool.”
How to roll it out in a week
Print the policy and hand it out at a staff meeting rather than emailing a PDF nobody opens. Walk through the approved-tools table and the prohibited list out loud — those two pages are the ones people remember. Collect a signature, put the signed copy somewhere you can find it in a hurry, and diarise the review date. That is the whole rollout. A written policy you can produce on request is worth more than a thorough one that exists only as a draft.
If you would rather not write it from scratch, the template in this shop already has these seven sections, the two-sided allowed-and-not-allowed lists, and the signature page. It is $2, it comes as an editable Word file and a fillable PDF, and you fill in seven blanks.
Get the template — $2This guide is general information for business owners, not legal advice. Businesses in regulated fields such as healthcare, legal work, or finance should have their policy reviewed against their own obligations.