How to write an AI use policy for a small business

We earn a commission if you buy through some links on this page, at no extra cost to you. It never affects the order. How we make money.

An AI use policy tells your team which AI tools they may use, what information they may put into them, and how AI output must be checked before it reaches a customer. Most small businesses already use AI informally, often on personal accounts, so a short written AI use policy is less about stopping people and more about making everyday use safe and consistent. This guide explains what to include, gives a one-page template, and shows how to roll it out without slowing anyone down.

Why a small business needs an AI use policy

When there is no policy, each person makes their own rules. One colleague pastes a client contract into a free chatbot to summarise it; another refuses to use AI at all; a third publishes an AI-written blog post with an invented statistic. None of them is being careless on purpose. They simply have no guidance.

A written policy fixes three problems at once. It protects data, because staff know what must never leave the company. It protects quality and reputation, because everyone knows AI output must be checked. And it protects money, because the company pays for a few approved tools instead of a scatter of personal subscriptions that nobody tracks.

It also helps with customers. Larger clients increasingly ask suppliers how they use AI, especially in security questionnaires. Being able to send a one-page policy answers that question quickly and shows that you take their data seriously.

What an AI use policy should cover

A good small-business policy fits on one or two pages. It should answer these questions clearly:

• Scope: who the policy applies to (staff, contractors, interns) and which tools count as AI.
• Approved tools: the specific tools and plans the company provides or permits.
• Data rules: what kinds of information may and may not go into AI tools.
• Checking output: who must review AI-assisted work, and what must always be verified.
• Customer-facing use: rules for content, emails, images and chatbots that customers see.
• Intellectual property: who owns AI-assisted work and how to handle images and code.
• Disclosure: when to tell customers that AI was involved.
• Responsibility: who owns the policy, how to ask questions and how to report a mistake.

Keep the language plain. A policy nobody reads protects nobody.

Approved tools and accounts

The most useful single rule is: use company accounts on approved tools for company work. Business and team plans of the major assistants usually exclude your data from model training by default and give an administrator control over users, sharing and data retention. Personal free accounts often do not.

List the approved tools by name and plan, for example "ChatGPT Business for writing and research" or "Fathom for meeting notes". Compare the main assistants in the AI assistants ranking and the ChatGPT vs Claude comparison before choosing. Current entry prices: ChatGPT Free plan, then USD 20 per month, Claude Free plan, then USD 20 per month, Gemini Free plan, then USD 4.99 per month.

Add a simple process for requesting a new tool: who to ask, and what they check (data terms, security, cost). Without a request route, people will quietly sign up anyway.

Data rules: the traffic-light approach

The data section is the heart of the policy. A traffic-light system is easy to remember:

• Green, fine on any approved tool: public information, your own marketing drafts, general questions, anonymised examples.
• Amber, approved business accounts only: internal documents, non-sensitive client work, meeting notes, code that is not secret.
• Red, never in an AI tool unless a specific exception is approved: passwords, API keys and secrets; payment card and bank details; government ID numbers; health information; employee payroll and HR records; anything a client contract says must not be shared.

Give examples from your own business. "Do not paste customer card details" is obvious; "do not upload the payroll export to summarise it" is the kind of example people actually need. If you handle personal data of people in Europe, the UK, Kenya, Nigeria, South Africa or elsewhere with data protection laws, your obligations apply to AI tools just as they do to any other software.

Checking AI output before it is used

AI tools produce confident text that is sometimes wrong. They can invent facts, quotes, statistics, legal rules and even sources. Your policy should state that a named person is responsible for anything AI helped create, exactly as if they had written it themselves.

Spell out what must always be checked against a primary source:

• Prices, fees, tax rates and legal requirements.
• Statistics, dates and names.
• Any claim about a product's features, including your own.
• Quotes and references, which should be confirmed to exist.
• Calculations, which should be re-run in a spreadsheet or calculator.

For high-stakes work, such as contracts, payroll or tax filings, AI may help draft or explain, but a qualified person must review the final version. The policy can say this in one sentence.

Customer-facing content and chatbots

Content that customers see deserves its own rules. Marketing copy, emails, product descriptions and social posts may be drafted with AI, but must be edited for accuracy and brand voice. Our guide to AI writing tools for marketing covers a workflow that keeps quality up.

If you put an AI chatbot on your website or in your help desk, the policy should cover what it may answer, how customers reach a human, and who reviews its answers. Chatbots that promise refunds or discounts the business does not offer create real problems. Most help desk software now includes AI features with controls for which knowledge base articles the bot may use.

For images and video, require that realistic AI images of people are not presented as real customers or staff, and that AI is never used to fake testimonials or reviews. See whether you can use AI images commercially for the licensing side.

Intellectual property and ownership

State that work created by staff with AI help for the business belongs to the business, in the same way as other work they produce. Contracts with freelancers should say the same; our guide to an international contractor agreement covers the clauses.

Two practical rules help. First, only use AI image and video tools whose terms allow commercial use on the plan you pay for. Second, do not ask AI to imitate a named living artist, a competitor's branding or copyrighted characters. For code, require that suggestions flagged as matching public code are reviewed for licence terms, a point covered in AI coding assistants for teams.

Copyright protection for purely AI-generated material is limited in several countries, so if a piece of work must be clearly yours (a logo, a book, a signature design), keep meaningful human creative input and records of it.

Disclosure: when to tell people AI was used

There is no single rule for every business, so decide your own position and write it down. Common choices:

• No disclosure is needed for internal drafts, research and editing help.
• Chatbots should say they are automated, and offer a route to a person.
• Realistic synthetic images, video or voices in advertising should be labelled where platforms or local rules require it.
• Client deliverables follow the client's contract; some clients require disclosure or forbid AI use.

Laws are developing. The European Union's AI Act, for example, includes transparency duties for chatbots and certain synthetic content. If you sell in a regulated market, check current requirements rather than relying on a summary, and review your policy at least once a year.

Meetings, recordings and consent

AI notetakers that join calls and record them are among the most popular tools, and they need a short rule of their own. Recording laws differ: some places require consent from everyone on a call, and many clients simply expect to be asked.

A sensible policy says: tell participants when a notetaker is recording, turn it off when asked, do not record HR, legal or medical conversations, and set a retention period after which recordings are deleted. Our guide to AI notetakers explains how these tools work and what to check, and the AI meeting notes ranking compares the main products.

Security basics that support the policy

An AI policy works best on top of basic security. Require company accounts to use single sign-on or a password manager with strong, unique passwords, and turn on two-factor authentication for every AI tool that offers it. When someone leaves, remove their access to AI tools along with email and files, because chat histories can contain sensitive material.

Be wary of browser extensions and plug-ins that promise AI features. Many request permission to read every page you visit. Add a rule that extensions need approval, and keep the approved list short.

A one-page AI use policy template

Adapt this template to your business. Replace the bracketed parts.

1. Purpose. [Company] encourages the use of AI tools to work faster and better, within these rules.
2. Scope. This policy applies to all staff and contractors using AI tools for [Company] work.
3. Approved tools. Use only: [tool and plan], [tool and plan]. Use company accounts for company work. Ask [name] to approve any new tool.
4. Never enter: passwords or keys; card or bank details; ID numbers; health data; HR or payroll records; confidential client material unless the client has agreed.
5. Check everything. You are responsible for AI-assisted work as if you wrote it. Verify prices, facts, figures, legal points and quotes against primary sources.
6. Customers. Do not use AI to create fake reviews, testimonials or people. Chatbots must say they are automated and offer a human.
7. Recordings. Tell participants before an AI notetaker records. Do not record [sensitive meeting types].
8. Ownership. AI-assisted work done for [Company] belongs to [Company].
9. Questions and mistakes. Ask [name]. Report any data entered by mistake to [name] immediately; early reports are not punished.
10. Review. This policy is reviewed every [six/twelve] months. Last updated: [date].

Rolling the policy out

Share the policy in a short team meeting rather than only by email. Walk through the traffic-light examples, show where the approved tools are, and explain how to request a new one. Ask people what they already use; you will often discover useful tools and risky habits in the same conversation.

Then make the safe path easy. Set up the approved accounts before announcing the policy, so nobody has a reason to keep using personal ones. Share a few saved prompts for common tasks, as described in how to use ChatGPT for business. A policy that comes with better tools is adopted far faster than one that only adds rules.

Budgeting for approved AI tools

Approved tools cost money, and that is part of the point: paying for team plans buys administrative control and better data terms. Start with one general assistant for everyone who writes, researches or analyses, then add specialist tools only for roles that use them daily, such as a notetaker for sales or a coding assistant for developers.

Review usage every quarter. Remove seats nobody uses and watch for price changes; our software price tracker lists recent changes across the AI tools we follow. For an overview of which tools are worth paying for first, see AI tools for small business.

Keeping the policy up to date

AI tools change monthly. New features, such as web browsing, file uploads, memory and agents that act on your behalf, change what the tools can see and do. Name one person as the policy owner and ask them to check the approved tools' terms and settings every few months, and whenever a tool announces a major new feature.

Keep a simple change log at the bottom of the policy so staff can see what changed and when. When a mistake happens, such as an incorrect AI answer reaching a customer, treat it as a lesson: fix the specific problem, then ask whether a rule or a check would have caught it, and update the policy if so.

Common mistakes to avoid

• Banning AI outright. People keep using it on personal accounts, which is the riskiest outcome.
• Writing a ten-page policy. Nobody reads it. Put detail in an appendix and keep the core to one page.
• Vague data rules. "Do not share confidential information" is too abstract; give named examples.
• No owner. Without a named person, the policy is never updated.
• Forgetting contractors. Freelancers often do the most AI-assisted work. Include them and add a clause to their contracts.
• Ignoring client contracts. Some clients forbid AI use on their material. Check before using it.

Questions