Free resource · Updated October 2026

A free one-page AI use policy for small businesses.

Copy it, edit the brackets, and have your counsel review it. It covers approved tools, what staff must never paste into an AI tool, review rules and incident reporting.

Not legal advice. This is a starting template, not legal or compliance advice. Have your attorney or compliance advisor review it for your industry, especially if you handle health, legal, financial or other regulated information.

[Company name] AI Use Policy

Effective [date] · Owner: [name, title] · Review: every six months

1. Purpose

We use AI tools to work faster and better while protecting our clients, our employees and our business. This policy sets the rules.

2. Approved tools

  • Only tools on this list may be used for work: [list tools and plan type, for example "ChatGPT Business", "Microsoft Copilot"].
  • Do not use personal or free AI accounts for work tasks.
  • To request a new tool, email [owner]. We check its data terms before approving it.

3. Never enter

  • Client confidential or privileged information, unless the tool is approved for it in writing.
  • Health information, Social Security numbers, bank or card numbers, or other regulated personal data.
  • Passwords, keys or access codes.
  • Unreleased financial results or deal information.
  • Anything we've promised a client to keep private.

When in doubt, remove names and details first, or ask [owner].

4. Review every output

  • AI can be wrong and can invent facts, citations and numbers. A person is responsible for everything sent or filed.
  • Check facts, figures, quotes and sources before using AI output in anything client-facing.
  • Do not present AI output as your own verified analysis without review.

5. Disclosure

We tell clients when AI materially contributes to their work if they ask, or if a contract or professional rule requires it. [Adjust for your industry.]

6. Incidents

If someone enters information they shouldn't, or finds an AI error that reached a client, tell [owner] right away. Prompt reporting is never penalized; hiding a mistake is.

7. Training

Everyone who uses AI at work completes [a short training] within [30 days] of starting, and refreshes it yearly.

8. Changes

We'll update this policy as tools, laws and professional guidance change. The latest version lives at [location].

Want help tailoring it? The AI Opportunity Audit includes a policy draft fitted to your firm and your tools. See the audit or book a free 30-minute call.