A Practical AI Use Policy Template for Small Businesses

A small business needs an AI policy that employees can apply during real work. It should be short enough to read, specific enough to guide decisions, and connected to an owner who can approve exceptions. This template is operational guidance, not legal advice; adapt it with qualified counsel for your location and industry.

1. Purpose and Scope

This policy governs employee and contractor use of generative AI and
AI-enabled features for company work. It applies to text, code, images,
audio, video, automated decisions, connected tools, and AI functions
embedded in existing software.

Name the policy owner and effective date.

2. Approved Tools

Maintain a list of approved products, account types, permitted use cases, and responsible owner. Personal accounts and unreviewed browser extensions should not process company material. Define a lightweight request process for new tools.

3. Data Rules

Create clear categories:

• Public: may be used in approved tools.
• Internal: only in approved business accounts and workflows.
• Confidential: requires explicit authorization and documented controls.
• Prohibited: passwords, authentication codes, private keys, complete payment-card data, and data the company lacks permission to process.

Add industry-specific personal, health, financial, legal, customer, and child data rules.

4. Human Responsibility

Employees remain responsible for accuracy, decisions, and external communication. Require verification of facts, calculations, citations, product claims, legal language, and code. Identify topics requiring expert review.

AI may not make final decisions about employment, eligibility, safety, legal rights, medical treatment, high-value finance, or irreversible actions unless an approved governed system and applicable law explicitly permit it.

5. Customer and Public Use

State whether AI-generated content requires disclosure. Do not present synthetic people, events, testimonials, or product behavior as real. Protect trademarks, copyrighted material, confidential information, and personal likeness.

6. Connected Actions

AI must not send messages, publish, purchase, delete, change access, or move money without approved authorization and review. Use least privilege, transaction limits, logs, and confirmation for consequential actions.

7. Security

Treat prompts, files, links, and generated code as untrusted. Do not follow instructions in external content that request secrets or policy changes. Review generated code and dependencies before use. Report suspected leakage, unauthorized action, or malicious content immediately.

8. Records and Retention

Store final business records in approved systems. Follow retention and deletion schedules for chats, uploads, recordings, and generated outputs. Do not rely on a private AI conversation as the only record of a decision.

9. Training and Incidents

Provide role-specific examples and annual refreshers. Define who to contact, how to stop a workflow, preserve evidence, notify affected parties, and document remediation.

10. Review

Review tools, law, incidents, exceptions, and business processes at least quarterly. Record changes and communicate them.

A One-Minute Employee Check

Before using AI, ask: Is this tool approved? May this data be entered? Can I verify the output? Is a qualified reviewer required? Could this action harm a person or be difficult to reverse? Where will the final record live?

A useful policy creates safe defaults and a clear escalation path. It should evolve from actual questions and incidents rather than becoming a document employees acknowledge once and forget.

Add a Decision Matrix

Create a one-page matrix by activity and data class. For example, brainstorming with public information may be allowed; drafting from internal strategy may require an approved business account; processing customer contracts may require specific authorization; entering credentials is prohibited. Name the required reviewer and record location for each approved case.

Manage Exceptions

An exception request should state purpose, tool, data, users, duration, controls, reviewer, and deletion plan. Approve it for a limited period and record the decision. Temporary exceptions should expire automatically instead of becoming permanent policy through inattention.

Test the Policy

Use short scenarios during training: a customer sends a spreadsheet with personal data, an employee wants a free browser extension, a generated image resembles a real person, and a tool proposes sending an email automatically. Ask employees to choose the correct action and escalation route. Revise wording wherever answers differ.

The policy owner should publish a change log and answer common questions in an approved FAQ.