How to use this template
Replace bracketed placeholders, assign a policy owner and adapt the restricted-data examples to your industry. This is an operational template, not legal advice.
Decision guide
AI Policy Template for Small Business
A copy-ready small-business AI use policy covering approved tools, data classes, prohibited uses, human review, accuracy, security, incidents and vendor approval.
Design principle
Use the lightest rule that controls the actual risk: public and low-risk work can move quickly; confidential, regulated and consequential work needs stronger approval and review.
Copy-ready template
Copy-ready AI Use Policy
Effective date: [DATE] · Policy owner: [NAME/ROLE] · Applies to: [COMPANY] employees, contractors and temporary staff using AI for company work.
1. Purpose and scope
We use AI to improve productivity, research, drafting, analysis and workflow automation while protecting confidential information, customers, employees and the company. This policy applies whenever company work, data, systems or decisions involve an AI service.
2. Approved tools and accounts
Use only AI tools and accounts approved by [POLICY OWNER / IT]. Company work must use company-managed accounts when available. Employees may not connect new AI apps to company email, files, CRM or other systems without approval.
3. Data classification
Public data may be used in approved tools. Internal data may be used only in approved company accounts. Confidential data requires explicit approval for the specific tool and workflow. Regulated/restricted data (for example PHI, payment-card data, credentials, government IDs or legally protected records) must not be entered into an AI system unless the company has specifically approved that vendor, contract, configuration and use case.
4. Prohibited uses
Do not paste passwords, API keys, authentication codes or full payment-card data into AI tools. Do not use AI to impersonate people deceptively, bypass security controls, make unauthorized commitments, or perform unlawful discrimination. Do not let AI make a consequential employment, credit, health, legal or financial decision without the required human process and review.
5. Human review
A person remains accountable for work produced with AI. Human review is required before publishing factual claims, sending high-value or sensitive customer/client messages, signing commitments, changing financial records, making employment decisions, or acting on regulated information.
6. Accuracy and sources
Treat AI output as a draft or hypothesis unless independently verified. Check material facts against reliable sources. Do not invent citations, customer facts, financial figures, legal requirements or product capabilities.
7. Customer and client communication
Disclose AI use when required by law, contract, professional rules or company policy. Do not send sensitive or consequential AI-generated communication without review. Preserve the company's tone, privacy commitments and approval process.
8. Copyright, confidential information and ownership
Do not upload third-party confidential material unless authorized. Respect licenses and copyright. Do not assume AI-generated material is automatically safe to publish or exclusively owned; review source material and applicable terms.
9. Security and access
Use MFA where available, follow least-privilege access and remove departed users promptly. Do not install unapproved browser extensions, agents or connectors that can read company systems. Report suspicious AI behavior or unexpected data exposure.
10. New tools and vendor review
Before adopting a new AI tool, document the job it will perform, data it can access, account owner, expected cost, retention/training terms, security controls, integrations and offboarding plan. Higher-risk tools require [SECURITY/LEGAL/COMPLIANCE] review.
11. Incidents
If confidential or restricted information is entered into an unapproved tool, or an AI system exposes unexpected data, stop the workflow and report it immediately to [INCIDENT CONTACT]. Preserve relevant details and follow the company's incident-response process.
12. Retention and deletion
Keep AI chats, files and generated artifacts only as long as the underlying business need and retention policy require. Delete test data and abandoned workspaces. When a tool is retired, export required records and remove company access.
13. Training and enforcement
People using AI for company work must understand this policy and any role-specific rules. Repeated or serious violations may result in loss of tool access or other corrective action under company policy.
14. Review cadence
The policy owner reviews this policy and the approved-tool list at least every [90 DAYS / 6 MONTHS], and sooner when the company adopts a material new AI workflow, regulation or vendor.
15. Employee acknowledgment
I understand that AI can be useful but can also produce inaccurate output or expose information if used improperly. I agree to follow this policy, use approved tools and remain responsible for work I submit or act on. Name: ______ Signature: ______ Date: ______
How we make money
Recommendations are not sold.
This page currently has no commissionable tracking link. When approved affiliate links are present elsewhere, affiliate economics still have zero weight in workflow scoring, tool eligibility, or comparison logic.
Sources checked
Evidence behind this page
No external source record is attached to this page yet. See the methodology for how planning assumptions are separated from vendor facts.
FAQ
How to decide what survives the cut
Is this AI policy legal advice?
No. It is an operational starting template. Companies in regulated or high-risk industries should have appropriate legal, security and compliance review.
Should a small business ban AI completely?
Usually a risk-tiered policy is more practical: clearly permit low-risk approved uses, prohibit sensitive uses without approval and require human review for consequential work.
What belongs on the approved-tool list?
Tool name, owner, approved account type, permitted data classes, allowed use cases, integrations, renewal date and who can approve exceptions.