Write an AI use policy for your business in one afternoon (template included)

If anyone on your team uses ChatGPT, Claude, Copilot, or Gemini, you need a written AI policy, and it only has to be about a page long. It needs to answer five questions: which tools are approved, what information can go into them, what never can, who checks AI output before it goes out, and who to ask when unsure.

The template at the end of this article covers all five. Most owners can fill it in within an afternoon.

Why a small business needs one

The most common real risk is someone pasting client details into a free personal account, because nobody told them not to and no approved account existed.

Which account they use matters because of how the major AI providers treat your data. Their business and enterprise plans generally exclude your data from model training by default and give an administrator control over accounts. Consumer plans may use conversations for training unless someone finds the right setting. Terms change, so check the current ones for any tool you approve. The policy's job is to point people at the right accounts and make the rules easy to follow.

A policy also protects the quality of your work. AI drafts can be fluent and wrong, and someone needs to own what goes out under your name.

Make five decisions first

1. Which tools and accounts are approved

Name the specific tools and say that only company-managed business accounts count. If you use Microsoft 365, Copilot may be the natural fit; if you use Google Workspace, Gemini may be. Pick one or two, not five.

2. What information can go in

A three-level system is easy to remember:

Adjust the red list for your industry. Law firms, accounting practices, and medical offices have professional or legal duties that may be stricter than this.

3. Who checks the output

This is the most important rule, and the simplest: AI output is a draft, and the person who sends it owns it. Before anything goes to a client, a vendor, or the public, a person checks the facts, numbers, names, dates, and any citations or quotes against the source.

4. When to tell clients

Decide in advance. Common positions are to disclose when a client contract requires it, when a client asks, or when AI played a substantial part in producing a deliverable. Some professions have specific guidance; check yours.

5. Who owns the policy

Name one person to answer questions and approve new tools, and set a date to review the policy. Six months is reasonable; the tools change quickly.

The template

Copy this into a document, replace everything in square brackets, and delete anything that doesn't apply.

[BUSINESS NAME] AI USE POLICY
Effective [date]. Owner: [name]. Next review: [date].

WHY WE HAVE THIS POLICY
AI tools can save us time on drafting, summarizing, and
routine work. They can also expose confidential information
and produce confident mistakes. This policy lets us get the
benefit safely.

1. APPROVED TOOLS
Use only these tools, through company accounts:
  - [Tool, plan]   (for example: ChatGPT Business)
  - [Tool, plan]
Do not use personal or free accounts for any work task.
To request another tool, ask [name].

2. WHAT CAN GO INTO AI TOOLS
GREEN (any approved tool): public information, general
questions, marketing drafts, rewording your own writing.

YELLOW (approved tools only): internal procedures, general
business information, client work with names and identifying
details removed.

RED (never): passwords; bank, card, or account numbers;
Social Security or tax ID numbers; health information;
anything covered by a confidentiality agreement;
[industry-specific items]; client confidential information
unless [specific approved use].

When unsure, treat it as RED and ask [name].

3. CHECKING THE OUTPUT
AI output is a draft. If you send it, you own it.
Before anything leaves the business, check:
  - facts, figures, names, and dates against the source
  - any quote, citation, or reference actually exists
  - the tone fits how we talk to clients

4. TELLING CLIENTS
We tell clients about AI use when [a contract requires it /
they ask / AI substantially produced a deliverable / other].

5. AUTOMATIONS
Automations that use AI must have an owner, an activity log,
and a person approving anything that sends money, emails a
client, or deletes a file.

6. QUESTIONS AND MISTAKES
Ask [name] before, not after. If something sensitive went
into a tool by mistake, tell [name] the same day. Reporting
a mistake is always the right call.

Roll it out in one meeting

1. Set up the accounts first. If the approved tool isn't ready to use, people will keep using what they already have.
2. Walk through it in 20 minutes. Show two real examples of each level (green, yellow, and red) from your own work.
3. Keep a shared list of questions. Use them to write the next version of the policy.
4. Review it on the date you set.

Mistakes to avoid

• Banning AI entirely. People use it anyway, on their phones, with no rules at all.
• Writing ten pages. Nobody reads them, and a single page is much easier for people to remember and follow.
• A policy with no approved tool. If there's no easy, approved way to follow the rules, people keep doing what they did before.

Want it set up for you?

Our team AI setup covers the whole thing: business accounts configured with the right settings, a policy written for your industry, a shared library of prompts and templates for your actual work, and hands-on training with your own documents. For the data side of choosing tools, see the owner's guide to AI data safety.

This template is a practical starting point, not legal advice. If you handle regulated data, have whoever advises you on compliance review it.