The short answer: A small business needs a written AI policy once more than one person on the team is using AI tools for work, which today is nearly everyone. At minimum it should name the approved tools, state what information should never be typed into them, require a human check before anything reaches a customer, and say who to ask when a situation is not covered.
A small business needs a written AI policy once more than one person is using AI tools on company work, which today is nearly everyone. The policy does not need to be long. It needs to name the approved tools, say plainly what data never goes into them, require a human check before anything reaches a customer, and say who to ask when a situation is not covered. This post walks through why it matters, exactly what to include, a sample outline you can adapt, and how to actually get it in front of your team.
This post covers policies for businesses. If you run a school or district, the considerations around student work and academic integrity are different enough to deserve their own guide: see how to write an AI policy for your school instead.
Why a small business needs one
Most small businesses did not decide to adopt AI as a company. It arrived piecemeal: one person on the team started using ChatGPT for emails, another tried it for reports, and now half the team is using AI tools on real work with no shared rules about how. That is the moment a written policy stops being optional.
Without one, three things tend to happen. Cautious employees, unsure what is allowed, quietly avoid the tools altogether and you lose the upside. Less cautious employees paste in whatever is convenient, including things that should never leave the building, because nobody told them otherwise. And when something does go wrong, whether it is a factual error that reached a customer or sensitive information typed into the wrong tool, there is no shared standard to point back to, only a series of individual judgment calls made under time pressure.
A policy fixes all three by replacing guessing with a shared, written answer.
What it must cover
Approved tools
Name the specific tools your team is expected to use. This is not about restricting people to one option; it is about making clear which tools your business has actually vetted, so employees are not independently deciding to run client data through whatever free tool they found that week.
What data never goes into AI
This is the section that matters most. Be specific rather than general. Most consumer and free-tier AI tools may use what is typed in to train future models, so the safe assumption is that anything entered could end up somewhere else. Name the categories explicitly: customer and client personal information, financial account numbers, anything covered by a confidentiality agreement or NDA, employee records, medical information, and anything you would not be comfortable posting publicly. “Use good judgment” is not a policy. A list is.
Customer information specifically
Customer data deserves its own line even though it overlaps with the section above, because it is the category employees are most likely to handle daily without thinking of it as sensitive. A name and an address in isolation might feel harmless to paste into a tool; a name, an address, and a health condition together are exactly the kind of thing the data rule exists to stop.
Checking outputs before they go anywhere
AI produces drafts, not finished work. The policy should say plainly that a human reviews anything before it reaches a customer, a vendor, or gets filed anywhere official, and that the employee who sends it is responsible for what is in it, the same as if they had written it themselves without AI. This single line does more to prevent embarrassing mistakes than any tool restriction.
Disclosure to customers
Decide, in writing, whether and when your business tells customers that AI was involved. There is no single right answer here, and reasonable businesses land in different places. What matters is that the decision is made once, by the business, rather than left to each employee to decide differently in the moment.
Who to ask
Every policy hits a situation it did not anticipate. Name a specific person employees can ask when something is not covered, so the default response to an unclear situation is a quick question rather than a guess in either direction.
A sample outline you can adapt
This is a starting shape, not a finished document. Adjust the specifics to your business before using it.
- Approved tools. Name them. Anything outside this list needs approval first.
- Never enter this information into any AI tool. Customer personal details, financial account numbers, anything under an NDA, employee records, medical information.
- Customer and client data. The specific rule for how customer information may or may not be used with AI tools, including any exceptions.
- Review before it goes out. Every AI-assisted email, proposal, report, or document is reviewed by a person before it is sent. The sender is responsible for accuracy.
- Disclosure. When, if ever, AI involvement is mentioned to a customer.
- Questions. Who to ask, and how, when a situation is not covered above.
Writing this from a blank page takes longer than it should. The free AI policy generator asks a short set of questions about your business and produces a plain-English draft in a couple of minutes, covering the same ground as the outline above, that you can then adjust and hand to your team the same day.
Common mistakes small businesses make
A few patterns show up often enough to name directly.
Writing a policy nobody reads. A five-page document with legal language borrowed from a template rarely gets past the first paragraph. The businesses that actually see the policy followed keep it to one page in plain English, the same voice you would use explaining a rule out loud.
Banning AI outright instead of setting rules for it. A flat ban feels safe on paper, but employees are already using these tools on their phones whether or not the business sanctioned it. A ban you cannot enforce teaches people that the written rules are not the real rules, which undermines every other policy in the business, not just this one.
Treating the policy as a one-time document. A policy written before anyone on the team has actually used the tools for a month will miss real situations. For example, a ten-person bookkeeping firm might write a policy assuming AI is only used for internal notes, then discover three months in that someone has been using it to draft client-facing summaries of financial statements, a use the original policy never anticipated. Plan to revisit the policy after real use, not just before rollout.
Leaving out the review step. A policy that covers approved tools and data rules but says nothing about checking outputs before they go out is missing the step that prevents the most visible mistakes. An AI draft that invents a detail or gets a fact wrong is a training problem if nobody reviews it, and a non-issue if someone does.
No named owner. Without someone accountable for updating the policy as the business starts using AI in new ways, it quietly goes stale. Assign it to a specific person, even in a small business where that person wears several hats already.
How to roll it out
A policy that only exists as a file in a shared drive does not change behavior. A few things that make the rollout actually land:
- Walk through it out loud. A short team meeting, or better, folding it into an AI training session, gives people a chance to ask how the rules apply to their specific job rather than reading a document in isolation.
- Keep it somewhere people will actually see it. Pinned in the tool the team already uses daily, not a page seven folders deep.
- Revisit it after real use, not before. The first draft rarely anticipates every situation your team will run into. Plan to update it after a month of real use rather than treating the first version as final.
- Pair it with training, not instead of it. A policy tells people the rules. Training shows them how to actually use the tools well within those rules. See AI training for employees for what a session that reinforces the policy looks like.
If your business is in the Triangle and wants help building both the policy and the training that goes with it, AI training and consulting in Raleigh-Durham covers what that looks like in person or remote, and AI training in Raleigh-Durham, NC goes into the local specifics.
Frequently asked questions
Does a small business really need a written AI policy?
Yes, once more than one person is using AI tools on company work, which for most businesses is already true. Without a written policy, each employee guesses at the rules on their own, and guesses are inconsistent. A one-page policy replaces guessing with a shared answer everyone can point to.
What should an AI acceptable use policy include?
At minimum: which tools are approved, what information should never be entered into an AI tool, how customer and client data is handled, a requirement to check outputs before they go out, whether and when to disclose AI use to customers, and who to ask when something is unclear. A short outline covering each of these is in the body of this post.
What should never be put into an AI tool?
Customer and client personal information, financial account details, anything covered by a confidentiality agreement or NDA, employee records, and anything you would not be comfortable posting publicly. Most free and consumer-tier AI tools may use what you type to improve their models, so treat the input box as public unless you know otherwise.
Do employees have to tell customers when they used AI?
That is a decision for your policy to make explicit rather than leave to individual judgment. Some businesses disclose AI use on any customer-facing content; others only require disclosure where a customer directly asks, or where accuracy really matters, like a legal or medical answer. The important part is stating the rule so employees are not each deciding differently.
How long should an AI policy be?
Short enough that people actually read it. One page covers approved tools, the data rule, the review rule, and who to ask. A longer document tends to get skimmed once and then ignored.
How do we roll out a new AI policy to the team?
Do not just email it. Walk through it in a short team meeting or as part of an AI training session, so people can ask questions about their specific job, then keep it somewhere easy to find rather than buried in a shared drive nobody opens.