How to Write an AI Use Policy for Your Small Business

A small business AI use policy is a short document that tells your team which AI tools they may use, what information must stay out of them, and who checks the results. One page is enough. The goal is to let people use AI with clear limits instead of guessing or hiding it.

This guide gives you the five parts to cover and example wording you can adapt. It is general information and not legal advice. Laws about privacy, employment and industry rules differ by place, so have a lawyer review your final policy.

Why a short policy helps

Staff are probably already using AI tools. Without a rule, they pick their own tools and paste in whatever is handy. A policy sets the boundaries before a mistake happens.

You do not need to write it from scratch in a legal style. NIST describes its AI Risk Management Framework as a voluntary framework to help organizations build trustworthiness into how AI is designed, used and evaluated. You can borrow its spirit by keeping your policy honest and easy to follow.

The five parts of the policy

Part	What it answers	Example rule
Approved tools	Which AI tools may be used for work	Only the tools on our approved list, signed in with a company account
Data that never goes in	What must stay out	No passwords, payment card numbers, health records or private customer files
Accounts and admin	Who controls access	The owner holds the admin role and removes access when someone leaves
Review of output	Who checks AI work	A person reads and approves anything before it goes to a customer
Who to ask	Where questions go	Ask the named policy owner before trying a new tool

Approved tools and banned data

Part 1: Approved tools

List the tools your business allows and say what each is for. If you have not picked one yet, read how to choose an AI assistant for your team.

Here is what vendors say about their business products, which is a reason to approve business plans over free ones.

• ChatGPT: OpenAI’s business page says your data is never used for training its models.
• Claude: Anthropic says commercial inputs and outputs are not used for training by default.
• Gemini: Google says Workspace does not use customer data for training models without prior permission.
• Microsoft 365 Copilot: Microsoft says prompts, responses and data accessed through Microsoft Graph are not used to train foundation models.

These promises are tied to the business products. They do not cover free personal accounts, so your policy should say “company accounts only.” Add a line that new tools need approval, and keep a simple list of what is approved.

Part 2: Data that never goes in

This part does the most to prevent harm. Write a plain list of banned data, then explain it in one sentence each. A sensible starting list follows.

• Passwords, security codes and API keys.
• Payment card and bank account numbers.
• Government ID numbers such as Social Security numbers.
• Health or medical records about customers or staff.
• Private employee files, such as reviews and pay records.
• Contracts and documents marked confidential.
• Anything a client told you in confidence.

The FTC’s guide for business is built on five principles: take stock of what personal information you hold, scale down to what you need, lock it, dispose of what you do not need, and plan ahead. They are a useful check for your list. If you do not need to give an AI tool a person’s details, leave them out.

Teach people to remove names and numbers before pasting text. For example, replace a customer’s name with “Customer A.” The AI can still help with the wording.

Accounts and review

Part 3: Accounts and admin control

Say that AI tools must be used with company-owned accounts. This lets the owner see who has access and remove people when they leave. It also keeps business data out of personal accounts that the company cannot manage.

Include these rules.

1. The owner or a named admin creates and manages the accounts.
2. Staff do not share logins.
3. When someone leaves, the admin removes their access the same day.
4. Turn on multi-factor sign-in where the tool offers it.
5. The admin reviews which apps and integrations are connected to each tool.

If you use Microsoft 365 Copilot, remember that it only shows files a person already has permission to open, according to Microsoft’s privacy article. Fix your file sharing before you roll it out. Microsoft’s admin guide also suggests adding a link to your organization’s AI usage policy in the welcome email to users.

For Gemini, Google says admins can turn the Gemini app off, so the policy can state who decides that. For setup of a ChatGPT workspace, see how to set up ChatGPT for your business.

Part 4: Review of AI output

AI can sound confident and still be wrong. Microsoft’s own article says responses are not guaranteed to be fully factual and that people should use judgment before sharing them. Your policy should turn that advice into a rule.

• A person reads everything before it goes to a customer, vendor or the public.
• Check names, numbers, dates and legal or medical claims against a real source.
• Do not present AI work as a finished expert opinion.
• Keep a human in the loop on any automation. For example, the workflow in how to draft email replies with Zapier and AI creates drafts for a person to send.
• If your team records calls with AI, follow the consent steps in how to record and summarize meetings with AI.

Who to ask and what happens next

Name one person who answers questions, approves new tools and handles mistakes. In a small company this is often the owner or office manager.

Add a short mistake rule: if someone pastes banned data into a tool, they tell the policy owner right away. Make it clear that reporting early is better than hiding it. Then review the policy every six months or when you add a new tool, since vendor features change.

Roll it out

1. Write the one-page draft using the five parts above.
2. Have a lawyer review it, especially if you handle regulated data.
3. Share it in a short team meeting and answer questions.
4. Ask each person to confirm they read it.
5. Put the policy where people can find it, and review it twice a year.