An AI use policy is a short set of rules for how your team uses AI at work: which tools are allowed, what information can go in, and who checks the results.
If anyone on your team uses ChatGPT, Claude, Copilot, Gemini or AI built into your software, you need one. Without it, everyone makes up their own rules.
Why Small Businesses Need One
- Your team already uses AI, often on personal accounts you can’t see.
- Clients are asking. Proposals and vendor questionnaires want to know how you protect their data.
- It stops the most common mistake: the wrong thing pasted into the wrong tool.
- New rules expect it, especially when AI helps make decisions about people. See our AI regulation guide.
What It Should Include
- Scope. Who it covers and which tools count, including AI inside other software.
- Approved tools, on company accounts only.
- Data rules. What never goes in: client confidential info, account numbers, SSNs, health info, passwords, anything under an NDA.
- Human review. AI output is a draft until a person checks it.
- Decisions about people. A person, not AI, makes the final call on hiring, pay, credit and the like.
- Disclosure. When to tell clients AI helped.
- New tools. Who approves them before they connect to company data.
- An owner who answers questions.
- Training and sign-off for everyone.
- Reviews every six months.
A Starting Template
Fastest route: build a tailored policy with our free generator and download it in Word. Or copy this outline and fill in the brackets. It’s a starting point, not legal advice.
- Purpose. This policy explains how [Company] staff may use AI tools at work while protecting clients, data and reputation.
- Scope. Any tool that generates text, images, code, audio or analysis, including AI inside [email, CRM, accounting software].
- Approved tools. [Tool 1], [Tool 2], on company accounts only. Anything else needs approval from [AI owner].
- Never enter: client confidential info, account or card numbers, ID numbers, health info, passwords or NDA material, unless [AI owner] approved that tool for it.
- Check the output. A person reviews AI work for accuracy, sensitive info and tone before it reaches a client or a decision. You own what you submit.
- Decisions about people. AI can organize information but can’t make final hiring, pay, promotion or credit decisions.
- Telling clients. Disclose when AI produced a significant part of a deliverable, or when asked.
- Connections. Get approval before connecting AI to email, files, calendars or accounts. Never give an AI agent your password.
- Mistakes. Tell [AI owner] right away if sensitive info goes into the wrong tool. Reporting quickly is always right.
- Review. Every [six] months, with everyone acknowledging each update.
Common Mistakes
- Banning AI. People use it anyway, out of sight. “Yes, with rules” works better.
- A 20-page policy. Nobody reads it. Two to four pages is enough.
- No owner, so nobody approves tools and the policy goes stale.
- No training, so nobody knows what’s in it.
- Forgetting built-in AI like meeting recorders and CRM add-ons.
From Policy to Proof
A written policy is one of the six areas in the Wrangl Platinum audit. The policy sets the rules. The audit shows clients you follow them.