How to Write an AI Use Policy for Your Small Business (Free Template)

In a lot of small offices, AI is already part of the workday. Someone drafts customer emails in ChatGPT, someone else summarizes meeting notes, and nobody is quite sure what’s allowed. An AI use policy fixes that. It doesn’t need to be long or written by a lawyer to be useful. It just needs to answer the questions your team is already guessing at.

Below is what a small business AI use policy should cover, a simple way to sort your data into safe and unsafe, and a free template you can copy and adapt this week.

Why a small business needs an AI use policy

The point isn’t to slow people down. It’s to remove the guesswork so they can use AI with confidence. Without a policy, three things tend to happen:

• Data ends up in the wrong place. Client details, financial numbers or employee information get pasted into personal accounts that nobody at the company controls.
• Mistakes go out the door. AI writes confident text that’s sometimes wrong. If nobody checks it, a customer sees the error before you do.
• Everyone uses a different tool. You end up paying for overlapping subscriptions, and nobody can help each other because nobody works the same way.

A one-page AI use policy solves most of this. It also protects your people: when the rules are written down, nobody has to wonder whether they’re about to get in trouble.

What an AI use policy should cover

Keep it short enough that people will read it. For most small businesses, these sections are enough:

• Approved tools. Which AI tools people can use for work, and who approves new ones.
• Data rules. What kind of information can go into those tools, and what never can.
• Human review. Who checks AI output before it’s used, especially anything a customer will see.
• Accountability. The person who uses the output owns it, mistakes included.
• Transparency. When customers should be told that AI was involved.
• Security. Company accounts only, strong sign-in, and approval before connecting AI to other apps.
• Reporting problems. What to do if something sensitive was entered by mistake.
• Review date. When the policy gets looked at again.

Sort your data into green, yellow and red

The hardest part of any AI use policy is the data rules. A simple traffic-light system makes them easy to remember:

Category	Examples	Rule
Green	Public website content, marketing drafts, general how-to questions, anonymized examples	Fine in any approved tool
Yellow	Internal documents, pricing, project notes, non-sensitive customer correspondence	Only in approved business accounts, never personal ones
Red	Social Security numbers, bank or card numbers, passwords and API keys, health information, anything under an NDA	Not allowed, unless a specific tool has been approved for it in writing

In North Carolina, the red category lines up with what state law treats as personal information. The Identity Theft Protection Act covers a person’s name combined with details like a Social Security number, driver’s license number or financial account number, and it requires businesses to notify affected people and the NC Attorney General’s Consumer Protection Division after a security breach. Keeping that kind of data out of AI tools is the simplest way to stay clear of trouble. For how each tool treats business information, see our guide on whether ChatGPT is safe for business data.

Free AI use policy template

Copy this into a document, replace the parts in brackets and delete anything that doesn’t apply to your business. It’s written to fit on a page or two.

1. Purpose

[Company name] encourages employees to use AI tools to work faster and better. This policy explains which tools we use, what information can go into them, and how we check the results. It applies to everyone who works for or with [Company name], including contractors.

2. Approved tools

• Approved tools: [for example, ChatGPT Business, Microsoft 365 Copilot, Claude Team, Gemini in Google Workspace]
• Use company accounts only. Personal AI accounts may not be used for company work.
• To use a new AI tool, browser extension or app integration, ask [name or role] first.

3. Data rules

• Green information (public or anonymized) can be used in any approved tool.
• Yellow information (internal business information) can only be used in approved company accounts.
• Red information can’t be entered into any AI tool unless [name or role] has approved that specific tool and use in writing. Red information includes Social Security numbers, bank and card numbers, passwords, health information, employee records and anything covered by a confidentiality agreement.

4. Human review

• A person reviews all AI output before it’s used.
• Anything sent to a customer, posted publicly or used in a financial decision must be checked by the person sending it.
• AI may not send emails, post content or change records on its own unless [name or role] has approved that specific automation.

5. Accuracy and accountability

• You’re responsible for anything you use, whether you wrote it or AI did.
• Check facts, numbers, names, dates and links before you rely on them.
• If AI gives you a source, open it and confirm it says what the AI claims.

6. Transparency

• Chatbots or automated replies that customers interact with must say they’re automated.
• Don’t present AI-generated images as real photos of our work, staff or customers.
• If a client contract requires us to disclose or limit AI use, follow the contract.

7. Security

• Sign in with company accounts and multi-factor authentication.
• Don’t share AI accounts or logins.
• Don’t connect AI tools to email, files, accounting or other systems without approval.

8. Reporting problems

If you think red information was entered into an AI tool, or AI output caused a problem, tell [name or role] the same day. Reporting quickly is what matters. Nobody gets in trouble for reporting.

9. Review

[Name or role] reviews this policy every six months, and whenever we add a new AI tool.

Policy owner: [name]. Last updated: [date].

How to roll out your AI use policy without a fuss

A policy nobody reads doesn’t help. A few things make it stick:

• Keep it to one or two pages. If it’s longer, people skim it.
• Walk through it in a 15-minute team meeting. Show examples of green, yellow and red data from your own business.
• Ask everyone to confirm they’ve read it. An email reply is enough for a small team.
• Pair it with a real first project. Rules are easier to remember when people are using them. Our 30-day plan to start using AI works well alongside this policy. When you’re ready to bring in the whole team, see our AI rollout plan.
• Update it when your tools change. If you add a new tool or connect AI to your QuickBooks Online or NetSuite data, revisit the data rules.

If you’re still deciding which tools to approve, our guide to what AI implementation costs compares the current business plans.

Useful references if you want to go further

You don’t need a big framework to get started, but these are worth knowing about:

• The NIST AI Risk Management Framework is a free, voluntary framework from the National Institute of Standards and Technology for managing AI risk. It’s thorough, and a good reference when your AI use grows.
• North Carolina’s Department of Information Technology publishes a Responsible Use of AI Framework for state agencies. It’s written for government, but it’s a readable example of how to think about AI risk.
• In September 2025, Governor Josh Stein signed Executive Order No. 24, which created a state AI Leadership Council and an AI Accelerator. It’s a sign that AI governance is getting more attention in North Carolina, so it’s worth having your own house in order.

Need help putting it in place?

A template gets you most of the way. Where small businesses usually want help is choosing the right tools, setting up admin controls and sign-in, and deciding what AI can safely connect to.

That’s the kind of work we do. Good People Technologies helps with AI implementation for small businesses in Asheville, Western North Carolina and across the state. If you’d like a second set of eyes on your policy or your setup, book a free 15-minute operations and technology audit.

Frequently asked questions

Does a five-person company really need an AI use policy?

Yes, though it can be a single page. Small teams are often the most exposed, because there’s no IT department checking which tools people use. A short AI use policy takes an afternoon to write.

Do we need a lawyer to write an AI use policy?

Not to get started. The template above covers the basics for most small businesses. If you’re in a regulated field like healthcare, finance or legal services, or your client contracts mention AI, have your attorney review it. This article is general guidance, not legal advice.

How often should we update it?

Every six months is a good rhythm, and any time you add a new AI tool or connect AI to another system. The tools change quickly, so the policy should too.

What’s the difference between an AI use policy and an acceptable use policy?

An acceptable use policy usually covers company technology in general: devices, email, internet use. An AI use policy focuses on AI tools specifically. Many small businesses add an AI section to their existing acceptable use policy, which works fine.