Your team is using AI at work, whether or not anyone wrote down the rules. A short written policy is the cheapest fix there is: it tells people what is fine, what is never fine, and who to ask. Below is the policy we would start a small business with. Copy it, adapt it, and have everyone sign it.
How to adapt it
- Replace “the Company” with your business name.
- Name one person as the AI owner. In a small business that is usually the owner or office manager.
- Write down the AI tools you allow today, and where staff can find that list.
- Check the “Never put these in” list against the data your business actually holds. Add anything specific to you.
- Have every employee and contractor read and sign it, and give new hires a copy on their first day.
This template is general guidance, not legal advice. If you work in a regulated field, such as health care, finance or law, have it checked against the rules that apply to you.
The policy
AI Acceptable Use Policy
Applies to everyone who works for or with the Company.
1. Purpose and scope
- This policy covers every use of AI tools for Company work, on any device, by employees, contractors and owners.
- AI tools means chat assistants, writing and image tools, and AI features built into other software, such as email or document editors.
2. Approved tools
- Only the AI tools listed by the AI owner may be used for Company work. The current list is kept where staff can find it.
- To use a tool that is not on the list, ask the AI owner first. Free trials and browser extensions count.
3. Accounts
- Use your Company account for approved AI tools. Do not use personal AI accounts for Company work.
- Turn on two-factor sign-in wherever the tool offers it.
4. Never put these into an AI tool
- Passwords, access codes or keys of any kind.
- Payment card numbers or bank details.
- Customer or employee personal information: names with contact details, addresses, ID numbers, health information.
- Contracts, financial results or anything marked confidential, unless the AI owner has approved that tool for it.
5. What AI is good for here
- Drafting and editing text, summarizing material that is already public, brainstorming, and first drafts of code, as long as a person reviews the result.
6. Check before it leaves the building
- A person reads and checks anything AI helped write before it goes to a customer, is published, or is signed.
- Check every fact, number, quote, link and name. AI tools state wrong things with confidence.
- Do not let an AI tool make a decision about a person, such as hiring, firing, pay or credit, on its own.
7. Connecting AI to other systems
- Do not connect an AI tool to Company email, files, calendars, customer records or other apps without approval from the AI owner. A connection lets the tool read, and sometimes change, everything that account can reach.
8. Other people’s work
- Do not paste in material the Company does not have the right to share, such as a client’s confidential documents.
- Check that you are allowed to use AI-generated images or text commercially before publishing them.
9. Mistakes
- If you put something into an AI tool that this policy says not to, tell the AI owner the same day. Reporting quickly matters more than the mistake.
10. Leaving the Company
- Your access to Company AI tools ends on your last day. Do not keep Company material in a personal AI account.
11. Who owns this policy
- The AI owner keeps the list of approved tools, answers questions and reviews this policy at least every six months.
Acknowledgement
I have read this policy and will follow it. I know who the AI owner is and will ask them when I am unsure.
Name, signature and date.
A policy is the start, not the whole job
The policy tells people the rules. It does not tell you whether your AI tools are set up to match them: whether chats are kept and for how long, whether they are used for training, who can join your workspace, what the tools are connected to, and whether you could find out later what was shared. Business plans and personal accounts often behave differently on every one of those.
Two ways to check:
- Take the free AI risk check. Ten questions, your score straight away, and we reply with what we would fix first.
- Ask us for an AI rollout review. We review your settings, fit this policy to your tools and train your team on it, at a fixed quote.