How to Write an AI Use Policy for a Small Business

A small business AI use policy can fit on one page: list the approved tools, state what data may and may not be entered, require human review of outputs, say when to disclose AI use, name an owner and set a review date. The goal is not to restrict useful work but to make safe use easy and to prevent the common problems: confidential data in unapproved tools, unchecked errors reaching customers and unclear responsibility when something goes wrong. This guide gives you a structure, sample wording and a rollout method. It is general information, not legal advice; ask an attorney to review the policy if you handle regulated data.

Why you need a policy even if you are small

Without guidance, each employee decides alone which tools to use and what to paste into them. That leads to personal accounts holding company information, inconsistent quality and no one knowing what data has gone where. A policy sets shared expectations, helps you answer customer security questionnaires and gives you something to point to if there is an incident.

The seven sections of a one-page policy

1. Purpose and scope

State who the policy applies to (employees, contractors) and what it covers (any generative AI or AI-assisted tool used for work).

Sample wording: "This policy explains how we use AI tools at work so we can save time while protecting customer, employee and company information."

2. Approved tools

List the tools and plan types that are approved, and say that others require approval from the owner. Require business accounts rather than personal accounts.

3. Data rules

Define categories and say what is allowed in approved tools.

Adapt the categories to your business. Note that some data types are covered by specific laws and contracts, such as health information or payment card data, so be conservative.

4. Human review

Require a person to review AI-generated content before it is sent to customers, published or used in decisions. State that the employee who sends the content is responsible for its accuracy. Add that AI must not be the sole basis for decisions about hiring, firing, discipline, credit or pricing for individuals.

5. Transparency and disclosure

Say when AI use must be disclosed, for example if a customer contract requires it, if a call is recorded or transcribed (with consent as required by law), or if you publish AI-assisted content where disclosure is expected. Rules and expectations vary, so check your contracts and applicable law.

6. Intellectual property and quality

Remind staff to avoid pasting copyrighted material they do not have rights to use, to check generated content for accuracy and to follow brand and quality standards. Legal questions about ownership of AI output are evolving; ask counsel about important cases.

7. Ownership, incidents and review

Name the owner, say how to report a mistake or data exposure immediately, and set a review date, typically every six months, since the tools change quickly.

A short sample

"We use approved AI tools to draft, summarize and organize our work. Use only the tools on the approved list with your company account. Do not enter restricted data. Confidential data may be used only in tools marked as approved for it. You are responsible for checking AI output before you share it. Do not use AI as the only basis for decisions about people. If you think you shared something you should not have, tell the owner right away. The owner reviews this policy every six months."

Customize it, and keep it plain.

Rolling it out

1. Draft with input from the people who will use the tools.
2. Have legal or an adviser review, especially if you handle regulated data or have customer contracts with AI or security clauses.
3. Share it in a short meeting with examples of allowed and disallowed use.
4. Collect acknowledgments from staff.
5. Include it in onboarding for new hires.
6. Review at the set date and after any incident.

Connecting policy to vendor selection

Your policy should match what your tools can do. If your rules require single sign-on, audit logs or no-training commitments, choose plans that deliver them. The vendor questions in security questions for AI vendors help you verify this. The policy also fits naturally into the first 30 days of a rollout, ideally written in week one.

Legal cautions

Several areas deserve professional advice rather than a template:

• Employment: some jurisdictions regulate automated tools in hiring and employee monitoring.
• Privacy: state privacy laws and sector rules may impose duties on personal data.
• Recording and transcription: consent requirements vary across states.
• Customer contracts: some customers restrict the use of AI on their data.
• Regulated sectors: healthcare, finance and legal services have extra obligations.

The Federal Trade Commission has stated that existing consumer protection law applies to AI-related claims and practices, so avoid exaggerated claims about what your AI-assisted services do.

Frequently asked questions

How long should the policy be?

One page is enough to start. A short policy that people read beats a long one they ignore.

Do we need to ban personal AI accounts?

Most businesses should require company accounts for work, because only those allow admin control and business data terms.

How often should we update it?

At least every six months, and when you adopt a new tool or face a new legal requirement.

Who is responsible if AI produces a mistake?

Make clear that the person who uses or sends the output is responsible for checking it, and that the business owner is responsible for the overall policy.

Sources and further reading

• National Institute of Standards and Technology — AI Risk Management Framework, a useful reference for governance.
• Federal Trade Commission — guidance on AI claims, privacy and data security.
• U.S. Equal Employment Opportunity Commission — guidance on automated tools in employment decisions.