How to Write an AI Use Policy for Your Small Business
Your team is probably already using AI at work, whether or not you have approved it. A short, clear AI use policy turns that hidden risk into a managed advantage. This playbook walks you through writing one in an afternoon, section by section.
Key takeaways
- An AI policy should be short, practical and specific. Two to four pages is plenty for most small businesses.
- The core is a clear list of approved tools and a simple rule for what data may and may not go into them.
- Require human review for anything customer-facing, legal, financial or published.
- Train people on it, then review the policy at least twice a year because AI tools change fast.
Banning AI rarely works. People find it too useful, so they use it quietly on personal accounts, with no rules and no visibility. The 2024 Work Trend Index from Microsoft and LinkedIn found that among people using AI at work, most were bringing their own AI tools rather than tools provided by their employer. That pattern, often called "shadow AI," is where real data leaks and embarrassing mistakes come from.
A policy gives your team permission and guardrails at the same time. It tells people which tools are fine, what they must never paste in and when a human must check the output. It also shows customers, partners and regulators that you take the risks seriously.
Before you write: three quick inputs
Spend thirty minutes gathering information first. It will make the policy realistic instead of theoretical.
- Current use: ask your team, without blame, which AI tools they use and for what. An anonymous form often gets more honest answers.
- Your data: list the sensitive data you hold, such as customer details, employee records, financials, health information, client confidential material and trade secrets.
- Your obligations: note any client contracts, industry rules or laws that limit how you share data with third parties. Our earlier article on privacy policies and data protection covers the general foundations.
Common mistake
Copying a large company's twenty-page AI policy. Nobody in a ten-person business will read it, and it will reference committees and processes you do not have. Write rules your team can remember without looking them up.
The playbook: write the policy section by section
- Purpose and scope. One short paragraph: why the policy exists and who it covers. Include employees, contractors and freelancers who work with your data.
- Approved tools. List the specific AI tools and plans people may use for work, and say that any other tool needs approval first. Name a person who handles requests.
- Data rules. Define what may never go into AI tools, what may go only into approved business accounts and what is fine anywhere. A simple traffic light system works well.
- Human review. State which outputs must be checked by a person before use, and what checking means: facts, figures, names, tone and legal claims.
- Prohibited uses. List the uses that are off-limits, such as making final hiring or firing decisions with AI, generating fake reviews, impersonating real people or creating misleading images.
- Disclosure. Explain when to tell customers or clients that AI was used, for example chatbots, AI-generated images or reports where clients expect human work.
- Intellectual property. Remind people not to upload others' copyrighted or confidential material without permission, and to treat AI output as a draft that may need checking for originality.
- Accounts and security. Require business accounts for approved tools, strong passwords and two-factor authentication, and removal of access when someone leaves.
- Reporting problems. Tell people what to do if they paste something they should not have, or spot a harmful output: report it quickly, with no blame for honest mistakes.
- Review date and owner. Name who maintains the policy and when it will next be reviewed.
The data rules: a traffic light system
The data section matters most, so make it visual and simple. Adapt the examples to your business.
| Category | Examples | Rule |
|---|---|---|
| Red: never | Passwords, payment card numbers, government ID numbers, health records, client data covered by confidentiality agreements | Never enter into any AI tool unless specifically approved in writing |
| Amber: approved business tools only | Customer names and emails, internal financials, draft contracts, employee information | Only in approved business accounts with data protections, and only the minimum needed |
| Green: generally fine | Public website content, published product information, generic questions, anonymized examples | Any approved tool |
Pro tip
Teach one habit above all others: replace names and identifying details with placeholders before pasting anything in. "Customer A ordered 40 units" works just as well as the real name for almost every drafting task.
Sample policy wording you can adapt
Here is short sample wording for a few key sections. It is a starting point, not legal advice. Adjust it to your business and have it reviewed if you work in a regulated industry.
- Approved tools: "You may use the AI tools listed in Appendix A, using your company account only. To request a new tool, contact the operations manager. Do not use personal AI accounts for company work."
- Data: "Never enter red-category data into any AI tool. Enter amber-category data only into approved tools and only when necessary. Remove names and identifiers wherever possible."
- Review: "You are responsible for any AI-assisted work you submit. Check all facts, figures, names and claims before anything is sent to a customer, published or used in a decision."
- Decisions about people: "Do not use AI to make final decisions about hiring, promotion, pay, discipline or termination. AI may help with drafting, but a person makes and documents the decision."
- Mistakes: "If you enter data you should not have, or notice a harmful output, tell your manager the same day. Honest mistakes reported quickly will not be punished."
Hypothetical example
Imagine a twelve-person accounting practice that discovers several staff using free AI chat tools to draft client emails, sometimes including client names and figures. The partners write a three-page policy: one approved business AI plan, a traffic light data table, mandatory review of all client-facing text and a ban on uploading client financial statements. They run a forty-five-minute training session with real examples and ask everyone to sign that they have read it. Six months later, they review usage, add one new approved tool and tighten the wording on client confidentiality.
Legal context to reflect in your policy
AI rules differ by country and are changing, so treat this as general information and get advice for your situation.
- European Union: the EU AI Act entered into force in 2024 with obligations phased in over several years. Among the earliest was an AI literacy requirement for organizations that deploy AI systems to take measures so staff using AI have sufficient understanding of it. A policy plus training is a practical way to show this. The GDPR also continues to govern personal data you put into AI tools.
- United Kingdom: UK GDPR and guidance from the Information Commissioner's Office on AI and data protection apply.
- United States: there is no single federal AI law, but existing laws on discrimination, consumer protection and privacy apply to AI use. Some states have passed AI-specific laws, for example on automated decisions in employment or on high-risk AI systems, with varying effective dates. Check the current rules in each state where you have staff or customers.
- Frameworks: the NIST AI Risk Management Framework from the U.S. National Institute of Standards and Technology and the ISO/IEC 42001 AI management system standard offer structured approaches if you want to go further.
A good AI policy
- Fits on a few pages and uses plain language
- Names specific approved tools
- Makes the data rules visual and memorable
A weak AI policy
- Bans AI entirely, pushing use underground
- Uses vague terms like "use responsibly" with no examples
- Is written once and never updated
How to choose which tools go on the approved list
The approved tools list is where your policy meets reality, so choose carefully. For each candidate tool, check a handful of points before adding it:
- Data terms: whether your inputs are used for training, how long they are kept and where they are stored, on the exact plan you will use.
- Admin controls: whether you can add and remove users centrally, enforce two-factor authentication and see basic usage.
- Contracts: whether the vendor offers a data processing agreement if you handle personal data covered by the GDPR or similar laws.
- Fit: whether the tool actually does the jobs your team needs, ideally tested on real tasks first.
- Exit: whether you can export or delete your data if you stop using it.
Record the plan name and the date you checked the terms next to each approved tool. Vendors update terms often, and that note tells you when a recheck is due.
Rolling it out so people follow it
A policy only works if people know it and understand why it matters. Introduce it in a short team meeting rather than an email. Walk through three or four real scenarios from your business, such as drafting a quote, summarizing a client call or creating a social post, and show what is allowed and what is not. Ask people to confirm they have read it, and make it easy to find later.
Pair the policy with good habits from your other systems. Our cybersecurity checklist covers account security, and our guide to free tools for small business can help you decide which tools to evaluate for the approved list.
Your AI policy action plan
- Survey your team about current AI use, anonymously if needed
- List your sensitive data and any contractual or legal limits
- Choose and list your approved AI tools and plans
- Build a red, amber and green data table with real examples
- Write the ten sections, keeping the whole policy under four pages
- Run a short training session with scenarios from your business
- Collect read confirmations and store the policy where everyone can find it
- Set a review date at least every six months
Frequently asked questions
Does a very small business really need an AI policy?
If anyone other than you uses AI for work, yes. Even a one-page policy prevents the most common problems: confidential data in personal accounts and unchecked AI output sent to customers.
Should the AI policy be part of the employee handbook?
It can be, but many businesses keep it as a separate short document referenced in the handbook, because it needs updating more often than other policies.
How do I enforce the policy?
Start with training and clear expectations. Use business accounts so you can manage access. Treat honest mistakes as learning moments, and handle deliberate or repeated violations like any other policy breach.
Do contractors and freelancers need to follow it?
If they handle your data or produce work for you, yes. Reference the policy in contracts or include AI and confidentiality clauses that set the same expectations.
Related reading
The bottom line
An AI use policy does not need to be long or legalistic. List the approved tools, make the data rules simple and visual, require human review for anything that matters, and train your team on real examples. Then revisit it regularly, because the tools and the rules around them will keep changing.
