AI Policy for Small Business: Free Template and What to Include
Short answer: A small-business AI policy is a one-page document that names the AI tools employees may use, lists what may never be pasted into them, requires a person to review AI output, and says how to report mistakes. Most small businesses need one now because employees are already using AI tools on their own. A free template you can copy is below. It is general guidance, so have your attorney review it before you adopt it.
If your team uses ChatGPT, Claude or any other AI tool, you already have an AI policy. It is just unwritten and different for each person. A written policy turns that into clear, shared rules.
Why a small business needs an AI policy
- Employees are already using AI. Many use free or personal accounts that have no company controls.
- Client and company data can leak. Pasting confidential information into the wrong tool can expose it.
- Output can be wrong. Unreviewed AI answers can reach clients and decisions.
- Insurers, clients and regulators ask. A written policy shows you are managing the risk.
What to include
| Section | What it says |
|---|---|
| Approved tools | The short list of AI tools allowed for company work and how to request a new one |
| Never enter | Data that must not be pasted into AI tools: client confidential, personal, health, payment and credentials |
| Human review | A person checks AI output before it reaches a client or drives a decision |
| Accounts and settings | Use company accounts with approved privacy and training settings |
| Reporting | Who to tell, and how fast, if something sensitive was entered by mistake |
| Training and review | How employees learn the rules and how often the policy is reviewed |
Free AI use policy template
Copy this into a document, replace the items in brackets and adjust it for your business.
[Company] AI Use Policy
1. Purpose. This policy explains how employees may use artificial intelligence tools at [Company] so we gain the benefits without exposing client, employee or company information.
2. Approved tools. Only these tools may be used for company work: [list approved tools and plans]. To request a new tool, contact [policy owner].
3. What must never be entered. Do not enter client confidential information, personal or health information, payment card data, passwords or credentials, or non-public financial records into any AI tool unless the tool is approved for that type of data.
4. Human review. A person must review AI output before it is sent to a client, published or used to make a decision. Do not present AI output as verified fact.
5. Accounts and settings. Use company accounts only. Do not use personal or free accounts for company work.
6. Privacy and retention. Approved tools must use the data-sharing and training settings approved by [policy owner].
7. Accuracy and ownership. Employees are responsible for the accuracy and appropriateness of anything they produce with AI.
8. Reporting. If you think sensitive information was entered into an AI tool by mistake, tell [policy owner] immediately.
9. Training. All employees complete AI use training within 30 days of this policy taking effect.
10. Review. This policy is reviewed every [6] months.
How to roll out an AI policy in five steps
- Find out what is in use. Ask employees which AI tools they use and what they paste into them.
- Pick approved tools. Choose business plans with the privacy settings you need and name them in the policy.
- Write and review the policy. Keep it to one page and have your attorney review it.
- Train your team. A short session with real examples works better than a long document.
- Review every six months. Tools and rules change quickly.
Common mistakes
- Banning AI outright, which pushes use out of sight
- Naming no approved tool, so people pick their own
- Ignoring industry rules such as client confidentiality or HIPAA
- Writing a long policy nobody reads
- Never reviewing it again
If you handle regulated or client-confidential data, confirm with your attorney or compliance advisor what may go into AI tools. See also our law firm and healthcare pages.
Frequently Asked Questions
What should be in an AI policy for a small business?
Approved tools, what may never be entered into them, a requirement for human review of AI output, rules for accounts and privacy settings, how to report mistakes, training and a review date.
Do small businesses really need an AI policy?
Yes. Employees are likely already using AI tools, and a written policy sets clear rules for protecting client and company information and for reviewing AI output.
Can I use ChatGPT or Claude for client work?
It depends on the plan, its settings and the rules that apply to your data. Free and personal accounts are generally not appropriate for confidential client information. Name approved business plans in your policy and confirm legal obligations with your attorney.
How long should an AI policy be?
One page is usually enough for a small business. A short policy that people read works better than a long one they ignore.
Can you help us write one?
Yes. An AI policy starter kit is part of our AI Readiness and Security Assessment, and the AI Quick-Win Assessment can include a one-page policy.
Next Step
Is your business ready for AI? Find out in 5 minutes, or book an assessment.
Or call (843) 884-1323.