AI Acceptable Use Policy Template for Small Businesses (With a Simple Rollout Plan)

On this page 10

1. The short answer: what an AI acceptable use policy needs to cover
2. Why a small business needs an AI policy (even with five people)
3. Four decisions to make before you fill in the template
4. The AI acceptable use policy template
5. How to adapt the template to your business
6. How to roll it out: a simple two-week plan
7. One-page quick-reference card for staff
8. Keeping the policy current
9. Common mistakes to avoid
10. When to get legal or professional advice

The short answer

An AI acceptable use policy is a short document that tells your team which AI tools they may use for work, what they may use them for, which data they may put into them, and who checks the output. For a team of 1 to 50 people, it fits in two to four pages. The template below is built to be edited, not adopted word for word, and it is a starting point, not legal advice.

• A green/amber/red data rule tells staff in seconds what may go into a tool.
• An approved-tools register records which tools are allowed, on which accounts, and which may handle personal data.
• A one-page staff card and a two-week rollout plan turn the document into habits.

The short answer: what an AI acceptable use policy needs to cover

You may also see it called an AI use policy, a generative AI policy for employees or simply a ChatGPT policy. For a small business, these usually mean the same thing.

It should cover:

• Approved tools: which tools are allowed, and on which accounts.
• Data rules: what may and may not go into a tool. The template uses a green/amber/red system.
• Allowed uses: what staff are encouraged to use AI for.
• Banned uses: what is off limits.
• Human review: who checks AI output, and how.
• Client disclosure: when you tell clients AI was involved.
• Accounts and security: business accounts, multi-factor authentication, removing access.
• Incident reporting: what to do when something goes wrong.
• Review date: when the policy gets checked again.

For a team of 1 to 50 people, this fits in two to four pages. The complete example policy below is built to be edited, not adopted word for word. Once you have made the four decisions covered below, filling it in within an afternoon is realistic.

Why a small business needs an AI policy (even with five people)

The risks of AI use do not shrink with headcount. A five-person firm can expose a client's data as easily as a large one. It just has fewer people to notice.

Your team is probably already using AI

People try chatbots such as ChatGPT, Claude, Gemini or Microsoft Copilot on their own, often on personal accounts. This is sometimes called 'shadow AI'. It is rarely malicious.

People want to get work done faster. A policy brings that use into the open so you can see it and guide it.

The risks a policy helps you manage

Data risk. When someone pastes a client email or a spreadsheet into a tool, that data goes to a third party. Depending on the tool, the plan and the settings, the vendor may store it, have it reviewed or use it to improve its models. Free and consumer plans can handle data differently from business plans, and these terms change over time.

Accuracy risk. Generative AI tools, including those built on large language models (LLMs), can produce answers that sound confident and are wrong. These are often called hallucinations. Invented figures, made-up citations and incorrect legal points are typical examples. Someone has to own the final check.

Contract and client risk. Some client contracts and NDAs restrict sharing information with third-party services. Pasting a client's document into an AI tool could breach those terms even if nothing leaks.

Intellectual property uncertainty. Whether AI-generated content can be owned, and whether it might reproduce someone else's work, is not settled. The answer also varies by country.

Four decisions to make before you fill in the template

The template depends on four choices. Make them first and the brackets become easy to fill.

1. Which tools will you approve?

List the tools people already use and the ones you want them to use. Decide whether you will pay for business or team plans. Business plans often come with more admin control and different data terms, but check each vendor's current terms rather than assuming.

If you are still choosing, our guide on how to choose an AI writing assistant for your business walks through criteria and a short trial plan.

2. What is your red data, and are there any exceptions?

Red data is information that must not go into AI tools. Write down your own list. It usually includes customer and staff personal data, passwords and keys, payment details, health information and anything under NDA. Your sector may add more.

Then be realistic about how you work. An AI meeting notetaker hears names and voices. The AI built into your email suite reads customer emails. Both process personal data.

Decide whether any specific tools may handle personal data under controlled conditions:

Quick decision

• Yes, some tools may handle personal datamark those tools in the register as an exception; the template lets you do this.
• No tool may handle personal datakeep personal data red everywhere and remove those uses from the policy.

Either choice is fine. A rule that contradicts daily work is not, because people will simply ignore it.

3. Who is your AI lead?

Name one person. In a small business this is often the owner, an operations manager or an office manager. They approve tools, answer questions, handle incidents and run reviews.

It does not need to be a technical person, just someone organised who will actually do it.

4. What is your stance on client disclosure?

Decide whether you tell clients about AI use always, only when asked or required, or for certain types of work. The template gives you three options to choose from.

The AI acceptable use policy template

---

START OF TEMPLATE

[Company name] AI Acceptable Use Policy

• Version: [1.0]
• Effective date: [DD Month YYYY]
• Last updated: [DD Month YYYY]
• Policy owner (AI lead): [Name, role, email]
• Next review date: [DD Month YYYY]

1. Purpose and scope

[Company name] wants everyone to use AI tools where they help us do better work, faster. This policy explains how to do that safely. It protects our clients, our colleagues and the business.

Who it covers: all employees, contractors, freelancers and interns who do work for [Company name].

What it covers: any generative AI tool used for work. This includes:

• chatbots and AI assistants;
• writing and editing assistants;
• image, audio and video generators;
• coding assistants;
• AI meeting notetakers and transcription tools;
• AI features built into software we already use, such as email, documents, CRM and meeting tools;
• browser extensions that use AI.

It applies on company devices and on personal devices used for work.

2. Key terms

• Generative AI tool: software that creates text, images, audio, video or code from instructions.
• Prompt: what you type, upload or say to the tool. Output: what the tool produces.
• Personal data: any information about an identifiable person, such as a name, email, phone number, address, voice recording or ID number. Sometimes called PII. Some types, such as health information, are especially sensitive (called special category data in UK and EU data protection law).
• Confidential information: anything not public about our business or our clients, including anything covered by an NDA or contract.
• Approved tool: a tool listed in the register in section 3, used on the account type shown there.
• Green, amber and red data: the three data levels defined in section 4.

3. Approved tools and how to request a new one

Only use tools on the approved list below for work. Use the company-managed account, not a personal one.

A company-managed workspace account, such as the email and documents suite that [Company name] pays for and administers, counts as a business account for the data rules in section 4. A personal or free account you signed up for yourself does not.

The 'Personal data allowed?' column shows the only tools that may handle personal data (see section 4). If it says No, treat personal data as red in that tool.

Requesting a new tool

To request a new tool, email [AI lead] at [email] with the tool name, what you want to use it for and the data it would touch. The AI lead checks the data terms, cost and security settings before approving it. Please do not start using a tool for work until it is on the list.

Approved tools register

(In your own copy, you can merge both parts into one table.)

Part 1: what each tool may do

Part 2: approval and settings

4. Data rules: green, amber, red

Before you put anything into an AI tool, check this table. A quick rule of thumb: if you would not post it in a public forum, it is not green. If you are unsure, treat it as red and ask [AI lead].

Controlled exception for personal data

Personal data of customers or staff may only go into tools the register marks 'Personal data allowed: Yes'. A tool gets a Yes only if it is used on a business account and [AI lead] has checked the vendor's data processing terms and settings. Examples: [our email suite's built-in AI], [our approved meeting notetaker].

Even then, use only the personal data the task needs, and only for the approved uses in the register.

Always red, in every tool, with no exceptions

• passwords, API keys and access codes;
• bank, card or financial account details;
• health information and other special category data;
• anything under an NDA or a client contract that restricts sharing [unless the client has agreed in writing];
• unreleased financial results;
• HR, disciplinary or salary matters.

Removing names is not always enough. If the remaining details could still identify a person or a client, treat it as red.

Vendors' data-use and retention terms vary by plan and change over time. The AI lead checks them when approving a tool and at each review.

5. What you can use AI for

You are encouraged to use approved tools to:

• draft and edit emails, social posts, documents and proposals;
• summarise public, green or amber material;
• brainstorm ideas, headlines, outlines and options;
• get a starting point for research, as long as you verify facts against original sources;
• get help writing, explaining or debugging code, within the data rules;
• draft customer replies and quotes, either with personal details removed or in a tool the register approves for personal data;
• take meeting notes, but only with a notetaker the register approves for personal data, and with everyone in the meeting told and agreeing;
• [add uses specific to your business].

6. What you must not use AI for

Do not use AI tools to:

• enter red data, except personal data in a tool the register approves for it (section 4);
• make final decisions about people, such as hiring, firing, pay, credit or individual pricing, without a human reviewing and owning the decision;
• create deceptive content, impersonate anyone, or create deepfakes or synthetic media of real people;
• present AI output as verified fact or professional advice without checking it;
• bypass security controls or install unapproved AI browser extensions or plug-ins;
• create content that infringes others' rights or breaks the tool's terms of use;
• record or transcribe meetings or calls without the participants' consent.

7. Human review and accuracy

A human stays in the loop for everything AI helps produce. The person who uses AI owns the result. Before using any output:

• check names, numbers, dates, quotes and citations against a reliable source;
• check anything legal, medical, financial or safety-related with extra care;
• make sure it sounds like us and is right for the audience.

Higher-stakes work gets a second review by [role or name] before it goes out. This includes client deliverables, published content, contracts and anything with prices or commitments.

Where practical, keep the prompt or source material with the work, so we can trace how it was produced.

8. Transparency with clients and the public

[Choose one option and delete the others.]

• Option A: We tell clients when AI tools have helped produce any deliverable.
• Option B: We tell clients about AI use when they ask, or when a contract requires it.
• Option C: We always disclose AI use for [AI-generated images / published articles / other categories], and otherwise on request.

In all cases, client contract terms come first. Label AI-generated images, audio and video where it is relevant to the audience.

9. Intellectual property and copyright

The law on copyright and AI-generated material is unsettled and varies by country. So:

• do not assume we own AI output outright; ask [AI lead] before relying on that for important work;
• do not prompt tools to imitate specific copyrighted works, or the style of living artists, for commercial use [adjust to your stance];
• where possible, check generated text and code for passages that look copied from elsewhere;
• respect client terms about who owns the work and whether AI may be used on it.

10. Accounts, access and security

• Use business accounts only for work. No personal AI accounts for company or client material.
• Turn on multi-factor authentication (MFA). Use single sign-on where we have it.
• Do not share logins.
• [AI lead] removes access when someone leaves or changes role.
• When setting up a tool, review its data, history and training settings and record them in the register.
• Be careful with AI tools or extensions that connect to email, file storage or calendars. Grant the minimum access needed, and ask [AI lead] first.

11. Reporting mistakes and incidents

Mistakes happen. Speed matters more than blame.

If red data was put into a tool not approved for it, or a harmful or wrong AI output went to a client or the public, tell [AI lead] within [24 hours]. Use [email / phone / chat channel].

The AI lead will:

1. record what happened, when, and which tool and data were involved;
2. delete the conversation or file if the tool allows, and check the vendor's deletion options;
3. assess straight away whether it is a personal data breach that may need to be reported to a regulator, taking advice if needed (some laws set short deadlines for this);
4. inform the client if the contract or the situation requires it;
5. update this policy or the training if it would help prevent a repeat.

Reporting a mistake promptly will not be treated as a disciplinary matter. Hiding one may be.

12. Training, enforcement, review and acknowledgement

• New starters get a short briefing on this policy in their first [week].
• Breaches are handled under [our disciplinary policy / the contractor agreement].
• This policy is reviewed every [6 months], and sooner if tools, vendor terms, client requirements or laws change.

Acknowledgement

I have read and understood the [Company name] AI Acceptable Use Policy, version [1.0].

Name: ______________________

Signature: ______________________

Date: ______________________

END OF TEMPLATE

---

How to adapt the template to your business

The template works as a base for most small businesses. Some sectors need tighter rules in specific places.

A one-page version for solo freelancers

If you work alone, you do not need twelve sections. Write one page with:

1. My tools: the AI tools I use, on which plan, the settings I have checked, and which (if any) I allow to handle personal data.
2. My red data: what I never put into AI tools, including all client data under NDA.
3. My review rule: I check every fact, figure and citation before delivery.
4. What I tell clients: for example, 'I use AI tools for drafting and research support. All work is reviewed and edited by me, and I never put your confidential information into them.'
5. If something goes wrong: I tell the client promptly and follow any contract terms.

Keep it somewhere you can share with clients who ask.

A note on regions

• EU and UK: GDPR and UK GDPR apply to personal data you put into AI tools. If a vendor processes personal data on your behalf, these laws generally expect a written contract with it, often called a data processing agreement or addendum. That is one thing the AI lead should look for before marking a tool 'Personal data allowed: Yes'.
• EU AI Act: the EU AI Act entered into force in August 2024. Its AI literacy obligation (Article 4) has applied since 2 February 2025 to organisations that use AI systems. In practice, that means taking steps so staff understand the tools they use, which a policy plus a short training session helps you show.
• UK guidance: the UK ICO publishes guidance on AI and data protection.
• US: consider state privacy laws, such as the CCPA in California, and the FTC's business guidance, which covers deceptive claims, including claims about AI.
• Further reading: the NIST AI Risk Management Framework is voluntary and more detailed than most small businesses need, but it is a useful reference if you want to go deeper.

How to roll it out: a simple two-week plan

A policy only works if people follow it. This plan turns the document into habits.

Week 1: decide and write

Week 2: introduce and switch over

One-page quick-reference card for staff

Copy this, add your names and pin it where people will see it.

AI at [Company name]: the quick version

Dos and don'ts

Traffic light

Who to ask and what to do if something goes wrong

Who to ask: [AI lead name], [email or chat channel].

If something goes wrong: tell [AI lead] within [24 hours]. Do not try to fix it quietly. Note what happened and which tool. Reporting quickly will not get you into trouble.

Keeping the policy current

AI tools change quickly, so set a fixed review, such as every six months. Also review the policy when any of these happen:

• you add or drop a tool;
• a vendor changes its terms, plans or data settings;
• a client contract adds AI requirements;
• an incident or near miss happens;
• a relevant law or regulator guidance changes;
• staff keep asking the same question, which usually means a rule is unclear.

Common mistakes to avoid

• Banning AI outright. It often does not stop use. It pushes it onto personal accounts, where you have no visibility or control.
• Copying an enterprise policy. Twenty pages written for a legal department will not get read. Short and specific beats complete and ignored.
• Rules that contradict real work. If the policy bans all personal data but the team relies on an AI notetaker, people will ignore the rule. Write a controlled exception instead, or drop the tool.
• No named owner. If everyone owns it, nobody approves tools or handles incidents.
• Ignoring built-in AI. AI features in email, documents, CRMs and meeting software process your data too. Put them in the register.
• Forgetting contractors and freelancers. They often handle client data and use their own tools. Include them and ask them to sign.
• Never updating it. A policy written once and left alone goes out of date as tools and terms change.
• Assuming a paid plan means data is never kept. Paid and business plans may offer better data terms, but retention and use vary. Read the current terms for each tool and plan.

When to get legal or professional advice

Get a qualified adviser to review your policy if any of these apply:

• You work in a regulated sector, such as health, finance, legal services or education involving minors.
• You process personal data at scale, or special category data such as health information.
• You want to approve AI tools for personal data and are not sure whether the vendor's terms are adequate.
• Your client contracts include clauses about AI, data processing or subcontracting.
• You use, or plan to use, AI in decisions about people, such as hiring, performance or credit.
• You operate in, or serve customers in, several countries.
• You have had an incident that may involve a personal data breach.

If none of these apply, a careful owner can often finish and roll out this policy without outside help. Revisit that decision as your business and your AI use grow.

Frequently asked questions

Does a small business really need an AI acceptable use policy?

If anyone on your team uses AI tools for work, yes. A short policy reduces the risk of confidential data going into the wrong tool and of wrong AI output reaching clients. It also gives staff clear permission for good uses. For a small team, two to four pages is enough.

Is an AI policy a legal requirement?

There is generally no single law that requires a document called an AI policy. However, data protection laws, sector rules and, in the EU, the AI Act's AI literacy obligation may require you to control how staff use AI and make sure they understand it. A written policy is a practical way to show that. Check the rules for your jurisdiction and sector with a qualified adviser.

Can employees use the free version of ChatGPT or other chatbots for work?

It depends on your policy and the vendor's terms. Free and consumer plans may handle data differently from business plans, so many businesses allow free tools for green data only, such as public information and generic questions. Check each tool's current terms and settings before deciding.

Should we tell clients when we use AI?

Follow your client contracts first. Otherwise, pick a stance from the template: disclose on all deliverables, disclose on request or when required, or disclose for specific categories such as images and published articles. Transparency about AI-generated images and published content is increasingly expected.

What is the difference between an AI policy and an AI acceptable use policy?

An acceptable use policy focuses on what staff may and may not do with AI tools. A broader AI policy or governance framework may also cover strategy, buying decisions and risk assessment. For most small businesses, one document covers both.

Who should own the AI policy in a small business?

One named person, often the owner, an operations manager or an office manager. They approve new tools, answer questions, handle incidents and run reviews. They do not need to be technical, just organised and available.

What should someone do if they pasted confidential data into an AI tool?

Report it to the AI lead straight away. Delete the conversation if the tool allows it. The AI lead should then quickly assess whether it is a personal data breach that needs reporting to a regulator, because some laws set short deadlines, and tell the client if the contract or situation requires it. No-blame reporting encourages people to speak up quickly.

How often should we update the policy?

Set a fixed review, such as every six months. Also update it when you add a tool, a vendor changes its terms, a client brings a new requirement, the law changes or an incident happens.

Does the policy cover AI features inside tools we already use?

It should. Built-in AI in email, documents, CRMs and meeting software processes your data too. List these features in the approved-tools register, check their settings like any other tool, and record whether each one is approved to handle personal data.