Key takeaways
- Keep it to one or two pages. A policy nobody reads protects nobody.
- Name the approved tools and require business accounts, not personal ones.
- Spell out what data never goes into AI tools, with examples.
- Require a human to review anything a customer will see.
- Name one person to ask, and review the policy at least twice a year.
On this page
Why a small business needs one at all
Your team is probably already using AI. Someone is pasting customer emails into a free chatbot to write replies. Someone else is using it to summarize a contract. None of that is a crime, but you have no idea which tools, which accounts, or what data went in.
A short policy fixes that. It doesn't stop people from using AI. It tells them how to use it in a way that doesn't put your customers, your data or your reputation at risk. It also gives you something to point to if a customer, insurer or partner asks how your business handles AI.
What it shouldn't be is a legal tome. A twenty-page policy written to cover every scenario gets signed and forgotten. One or two pages, in plain English, with real examples, gets followed. Think of it as the rules you'd explain to a new hire on day one.
The seven things your policy should cover
1. Approved tools and accounts. List the AI tools people may use for work, and require company accounts, not personal ones. Business and team plans usually give you admin controls and better data terms than free personal accounts (check the current terms for any tool you approve). If someone wants a new tool, they ask first. The point is that you know where your business data is going.
2. What data can and can't go in. This is the most important section, so be concrete. "Don't share sensitive data" is too vague to follow. Give examples of what never goes in (customer Social Security numbers, card numbers, passwords, medical details, anything covered by a confidentiality agreement) and what's fine (your own marketing copy, public product info, internal drafts without customer details). For anything in between, the answer is "ask first." My answer on whether it's safe to give AI access to business data goes deeper.
3. Human review for customer-facing work. Anything a customer, vendor or the public will see gets read by a person before it goes out: emails, quotes, social posts, review replies, website copy. AI drafts are fine. AI sending on its own, without a check, is not, unless you've specifically set up and tested that workflow.
4. Disclosure when appropriate. You don't need to stamp "written with AI" on every email. But be honest when it matters: if a customer is chatting with a bot, they should know it's a bot. If an AI voice agent answers your phone, it shouldn't pretend to be a person. Some industries and some states have specific rules here, so check yours.
5. Accuracy and verification. AI makes confident mistakes. The policy should say that the person using the tool is responsible for the output, and that facts, numbers, dates, prices and legal or medical statements get checked against a real source before use. More on why in what happens when AI makes a mistake.
6. Who to ask. Name one person. In a small business that's usually the owner, the office manager, or whoever manages your AI work (sometimes an outside fractional AI manager). If people don't know who to ask, they'll guess.
7. Review cadence. AI tools and their terms change fast. Put a date on the policy and review it at least twice a year, plus any time you add a major tool.
Get the checklist
A sample policy you can adapt
Here's a starting template. Copy it, change the bracketed parts, cut what doesn't apply, and add anything specific to your industry.
[BUSINESS NAME] AI USE POLICY
Effective: [DATE] Next review: [DATE + 6 MONTHS]
Questions go to: [NAME, EMAIL]
1. Why we have this
We use AI tools to save time on repetitive work. This policy keeps
our customers' information safe and our work accurate.
2. Approved tools
You may use these tools for work, signed in with your company account:
- [TOOL 1] for [writing drafts, summaries]
- [TOOL 2] for [meeting notes]
Do not use personal AI accounts for company work. Ask [NAME] before
trying any new AI tool with company information.
3. Never put these into an AI tool
- Social Security numbers, card or bank numbers, passwords
- Medical or health information about anyone
- Anything covered by a confidentiality agreement
- [INDUSTRY-SPECIFIC: e.g., client case files, student records]
If you're not sure, ask first.
4. Human review
A person reads and approves anything a customer, vendor or the
public will see before it is sent or posted. No exceptions unless
[NAME] has approved a tested automated workflow in writing.
5. Accuracy
You are responsible for anything you use from an AI tool. Check
names, dates, prices, numbers and any legal, tax or medical
statement against the original source before using it.
6. Being honest about AI
If a customer is talking to a chatbot or AI phone agent, it must
say so if asked and must never claim to be a person.
[ADD ANY DISCLOSURE RULES FOR YOUR INDUSTRY OR STATE.]
7. Mistakes
If AI-produced work causes a problem, tell [NAME] right away. We
fix it, then fix the process so it doesn't happen again. Reporting
a mistake will never get you in trouble. Hiding one might.
8. Review
[NAME] reviews this policy every six months and whenever we add
a major AI tool.
Acknowledged by: ____________________ Date: __________
That's about one page. If yours is growing past two, you're probably writing procedures, not policy. Move the step-by-step material into separate SOPs.
How to roll it out without making it a big deal
A policy works best when it feels like common sense, not a crackdown. Here's a simple rollout:
- Ask before you write. Find out what tools people already use and what they use them for. You'll catch risks you didn't know about, and you'll avoid banning something useful.
- Walk through it in a short team meeting. Fifteen minutes. Go through the "never put these in" list with real examples from your business.
- Set up the approved accounts first. If you tell people to stop using personal accounts, give them the company account the same day.
- Have everyone sign it. Not for legal theater, but so everyone has actually read it.
- Add it to onboarding. Every new hire gets it in week one.
- Revisit it when something changes. New tool, new kind of data, a mistake that slipped through. Update the policy and tell the team what changed.
If you'd rather have help writing the policy and training your team on it, that's part of my AI consulting and training work.
What this looks like in a real small business
Example: picture a nine-person accounting and bookkeeping office. The owner finds out during tax season that two staff members have been pasting client emails into free chatbot accounts to draft replies. Nobody meant any harm, and the replies were good. But client financial details went into personal accounts the firm doesn't control.
The owner doesn't ban AI. She sets up a business account on one approved tool, writes a one-page policy from a template like the one above, and adds a line specific to her firm: no client tax documents, account numbers or Social Security numbers go into any AI tool, ever. Client names in drafts get replaced with initials.
In a fifteen-minute meeting, she walks the team through it. One staffer asks whether summarizing an IRS notice is okay. The answer: yes, after removing the client's identifying details. That question becomes an example in the policy.
Because the firm handles sensitive financial data, she also has the firm's attorney read the policy before it's final. Total time: an afternoon to write, one short meeting to roll out, and a calendar reminder to review it in six months.
The honest part
I'm not a lawyer, and this page isn't legal advice. The template above is a reasonable starting point for a typical small business. If you're in a regulated industry (healthcare, legal, financial services, insurance, education, anything with government contracts), have your attorney or compliance advisor review your policy before you adopt it. Those industries can have specific rules about data handling, disclosure and record keeping that a generic template won't cover.
A policy also doesn't enforce itself. If nobody checks which tools are in use, people drift back to whatever is convenient. The review date matters.
And no policy makes AI risk-free. It reduces the most common risks: sensitive data in the wrong place, unreviewed mistakes reaching customers, and nobody knowing who's responsible.
Quick questions
Does a small business really need a written AI policy?
If anyone on your team uses AI for work, yes. It doesn't need to be long. A one-page policy that says which tools are approved, what data stays out, and who reviews customer-facing work prevents the most common problems and costs you an afternoon.
Can I just ban AI instead?
You can, but it usually doesn't work. People find AI useful and keep using it quietly on personal accounts, which is the worst outcome. A clear policy with approved tools gives you control and visibility. Banning it mostly gives you neither.
How often should we update our AI policy?
At least twice a year, plus any time you add a major tool, start handling a new kind of sensitive data, or have a mistake slip through. AI tools and their terms change quickly, so put a review date on the policy and a reminder on someone's calendar.
Related answers
