How to Write an AI Use Policy for a Small Business

A small business needs an AI use policy that fits on one page and that staff will actually read. The version that works has five parts: which tools are approved, which data may go into them, who checks the output, what must be disclosed to customers, and what to do when something goes wrong. Everything else is detail.

Your employees are almost certainly using AI already. The question is whether they do it with rules or with guesses. The guide to shadow AI explains how unofficial use spreads, and a policy is the cheapest response.

This is a practical template, not legal advice. If you handle regulated data such as health or financial records, have a qualified adviser review the final wording.

Start with data, not tools

Most policies begin with a list of banned apps and go stale in a month. Start with what is being typed in. Three tiers cover almost every case.

Green: anything public or yours alone. Marketing copy drafts, generic questions, your own published material, brainstorming. Any approved tool, no restrictions.

Amber: internal but not sensitive. Meeting notes without personal details, internal process documents, anonymized examples, draft proposals with names removed. Approved tools only, and only on accounts that do not train on your inputs.

Red: never goes into a general AI tool. Customer personal data, health or payment information, passwords and API keys, contracts under confidentiality, unreleased financials, anything a client has told you not to share.

A tier list works because people can sort a real situation into it in a few seconds. If someone has to read a paragraph to decide, they will guess.

The same logic applies to client work. The questions in is it safe to put client data into AI tools and keeping client data separate are where the red tier comes from.

The five sections, with sample wording

1. Approved tools

Name them. "Staff may use the business accounts on [Tool A] and [Tool B]. Personal accounts may not be used for work data." The reasoning behind that last sentence is in should employees use their own AI accounts at work. Business accounts let you control settings, and they stay with the company when someone leaves.

Add a route for requests: "To propose a new tool, ask [name]. We will answer within a week." If saying yes takes a month, staff will skip the question.

2. Data rules

Paste the three tiers in. Then add one line that handles the gray area: "If you are unsure which tier something is, treat it as red and ask."

3. Checking the output

AI is confident when it is wrong. A good rule is proportional: "Anything that goes to a customer, a regulator, or into a contract is read in full by a person before it is sent. That person is responsible for it, not the tool." For facts, figures and citations, add: "Check every number and every source. Models invent both." The guide to spotting hallucinated answers gives staff a method.

4. Disclosure

Decide what you tell customers. For many businesses the honest default is simple: "We use AI tools to help draft and organize our work. A person reviews anything we send." Whatever you choose, make it true and consistent. If you want wording, see how to tell customers you use AI.

5. When something goes wrong

Someone will paste the wrong thing eventually. Make reporting safe: "If you put red-tier data into an AI tool by mistake, tell [name] immediately. You will not be disciplined for reporting it quickly." People hide mistakes when they fear punishment, and a hidden mistake is the expensive kind. The steps to follow afterward are in what to do if an employee pastes confidential data into AI, and a fuller plan is in the AI incident response template.

Make it stick

• One page, plain language. If it runs long, cut. A policy nobody finishes protects nobody.

• Put an owner's name on it. One named person answers questions and keeps it current.

• Walk the team through it once, using two real examples from your own work. Fifteen minutes is enough.

• Review it every quarter. Tools and settings change. Put the date at the top.

• Show it to new hires on day one, alongside the other basics.

What a framework adds

If you want to go further, the NIST AI Risk Management Framework is a voluntary, free reference for thinking about AI risk more formally. It is written for organizations of all sizes, but for a dozen people it is background reading rather than a checklist you must complete. The page itself is a good place to see how larger organizations structure the same questions.

A short worked example

A twelve-person design studio adopts the following. Approved: the company accounts on two tools. Green: stock captions, brainstorming names, rewriting its own blog drafts. Amber: project briefs with client names removed. Red: client files, invoices, anything under a signed NDA. Rule: every client-facing deliverable is read in full by the project lead. Owner: the studio manager. The whole thing is 280 words, and the staff meeting about it takes ten minutes. That is the target. For more on getting started with limited resources, the small business AI overview puts this in context.

Frequently asked questions

Does a small business need an AI policy?

If anyone on the team uses AI tools for work, yes. A short policy prevents the most expensive mistakes, such as customer data going into a personal chatbot account, and it takes under an hour to write.

What should an AI policy include?

Approved tools, rules for what data may be entered, a requirement to review output before use, a stance on disclosure to customers, and a way to report mistakes.

How long should an AI use policy be?

One page. If it is longer, people stop reading and the rules stop applying.

Who should own the AI policy?

One named person, usually an operations or office manager, who answers questions and reviews it quarterly.