Training and policy
AI policy template for small businesses (free to copy)
An AI policy for a small business sets out which AI tools staff may use, what information never goes into them, and who checks the output before it is used. The template below does that in nine short parts you can copy into a document and fill in this week.
Photo by Unseen Studio on Unsplash
I wrote this from the policy starter I use in my AI training, cut down for a business of 10 to 100 people. Each part has a default you can keep or change. Replace the words in brackets with your own.
This is a starting point, not legal advice. Have a lawyer read your version before you rely on it, most of all the parts about client data and hiring.
What an AI usage policy needs to cover
There are nine parts. Most small businesses can fill in all nine in about an hour, then walk the team through it in a 30-minute meeting.
- Purpose: what the policy is for and who it covers.
- Approved tools: which AI tools staff may use for work.
- What AI is never used for.
- What never goes into AI, sorted into four data tiers.
- Checking the output before anyone uses it.
- Telling people when AI helped.
- Costs and new tools.
- Reporting a mistake.
- Reading and signing the policy.
1. Purpose
Say what the policy is for and who it covers. Copy and edit:
- This policy explains how people at [Company name] may use AI tools at work. It covers everyone who works for us, including part-time staff and contractors.
2. Approved tools
Name the tools by plan, so nobody has to guess. Copy and edit:
- Staff may use only these AI tools for work: [tool name and plan, for example the business plan of ChatGPT, Claude, Copilot, or Gemini].
- Use the business account for work. A personal account is never used for anything beyond public information.
- Ask [owner's name] before trying a new AI tool for work.
3. What AI is never used for
Draw the hard lines first. Copy and edit:
- AI never makes decisions about hiring, pay, performance, or letting someone go.
- Nothing on the never-paste list in part 4 goes into any AI tool.
- AI tools that are not listed in part 2 are not used for work.
4. What never goes into AI: the four data tiers
Every piece of information falls into one of four tiers. When someone is not sure, they treat it as confidential and ask.
- Public: anything already published, like your website or a press release. Fine in any approved tool.
- Internal: meeting notes, drafts, and internal numbers. Only in the business account of an approved tool.
- Confidential: contracts, pricing, plans not yet announced, and anything a competitor would want. Only where this policy names the tool and a person checks the result.
- Restricted: never pasted anywhere. That means customer records, account numbers, staff personal details, passwords, and [anything your clients or your industry forbid].
5. Checking the output
AI writes drafts. People decide what gets used. Copy and edit:
- Every AI output is a draft until a person checks it against the source.
- The person who uses an output is responsible for it.
- These need a second person to sign off: [for example, anything sent to a client, and anything with a price or a number in it].
6. Telling people when AI helped
Copy and edit:
- We say when AI helped wherever a client, a contract, or the law asks us to.
- Clients or contracts that require this: [list them, or write none].
7. Costs and new tools
Copy and edit:
- [Owner's name] approves new AI tools and paid seats.
- Requests go to [email or channel] and get an answer within [number] working days.
8. Reporting a mistake
Make it easy to speak up early. Copy and edit:
- If AI output causes a problem, or someone pastes something they should not have, stop, tell [name] within [time], and keep a copy of what went in and what came out.
- Reporting a mistake is how we improve these rules. It is not a reason for discipline.
9. Reading and signing
Copy and edit:
- Everyone reads this policy and confirms it in writing when they start, and again each time it changes.
- [Owner's name] reviews this policy every [three or six] months.
Before anyone pastes anything
Put this short check at the bottom of the policy, or on a card by every desk.
- I know which of the four tiers this is.
- Nothing in it is on the never-paste list.
- The tool is on the approved list, and I am in the business account.
- I know who checks the output before it is used.
- If I am not sure of the tier, I treat it as confidential and ask.
How to roll it out in a week
If you want your team to practice the rules in a hands-on session, privacy is the first thing my AI Workshop covers. Either way, this order works.
- Day 1: fill in the brackets. It takes about an hour.
- Day 2: send it to your lawyer for a read.
- Day 3: walk the team through it in 30 minutes, with real examples of each data tier from your own business.
- Day 4: everyone reads it and signs.
- Day 5: share the four tiers on one page where everyone can find them, and set a date to review it in 90 days.
AI training
Hands-on AI training for your team
Your team learns AI on its own work, in a session set up for your industry. Pick a 3-hour workshop or a full day, on site or online.
Written by
Milos Vranes
I train small business teams to use AI on their own work, and I build the automations that come after. I have built automation systems for five years.
Anthropic certified and a verified n8n creator. Every system I write about is one I have built.