Writing an AI Use Policy for a Small Company

If your staff are using AI tools, and they almost certainly are, you already have an AI policy. It just happens to be unwritten, inconsistent and invented one person at a time. A short written policy gives people clear permission to use these tools well and clear lines they must not cross. This guide gives you a structure you can adapt in an afternoon.

In plain English

The goal is not to ban AI or to write a legal treatise. It is to answer five questions in language everyone understands: which tools may I use, what may I put into them, what must I check, who is responsible, and who do I tell if something goes wrong.

This is general guidance, not legal advice. Have a lawyer or compliance adviser review the final document, especially if you handle regulated data.

Step 1: find out what is happening now

Before writing rules, ask staff, without blame, which AI tools they use and for what. You will learn what to approve, what to replace and which risks are real. A policy that ignores actual behavior is ignored.

Step 2: the one-page structure

1. Purpose. Why the policy exists: to benefit from AI while protecting customers, staff and the company.

2. Approved tools. A named list, such as "the company-licensed assistant" and any others you have reviewed. State that unapproved tools are not for company data. Review the list on a schedule, because products change.

3. Data rules. The heart of the policy. Define categories in simple terms:

Category	Examples	Rule
Public	Published marketing text, public documentation	Fine in approved tools
Internal	Meeting notes, internal procedures	Approved tools only
Confidential	Customer data, contracts, financials, source code, credentials	Only in tools approved for that data, with a business reason
Restricted	Passwords, keys, health records, payment data, anything regulated	Never in AI tools unless explicitly approved

4. Accounts. Use company accounts for company work, never personal ones. Learn what each tool does with data: whether chats are kept, and whether they may be used to improve models. Check the settings and terms when you approve a tool.

5. Human responsibility. The person who uses AI output owns it. Check facts, numbers, names, quotes and code before use. Do not present unreviewed AI output to customers as expert advice.

6. Prohibited uses. For example: making hiring, firing, credit or similar decisions about people with AI alone; generating deceptive content; uploading others' confidential or copyrighted material you have no right to share; bypassing security controls.

7. Disclosure. When must you tell customers or colleagues that AI was involved? Decide, and say so. Some contracts and regulations require it.

8. Code and automation. If staff use coding assistants or agents, require review and testing before anything reaches production, and keep secrets out of prompts. Agents that take actions need approvals for risky steps.

9. Incidents. If someone pastes something they should not have, they report it immediately, with no punishment for honest, prompt reporting. Name the contact.

10. Review. Who owns the policy, and when is it revisited? A sensible rhythm is a few times a year at first.

Step 3: make it usable

• Keep it to one or two pages with examples. Include a short "yes, you can" list: drafting, summarizing public material, brainstorming, explaining.
• Put a quick decision rule at the top: "If you would not post it on a public website, check the data rules first."
• Provide approved tools so people have a good legal option. Bans without alternatives push usage underground.
• Offer a short training session using real examples.

Step 4: roll out and check

• Have each person confirm they read it.
• Spot-check by asking, not by spying: what are people finding hard?
• Update it when tools or laws change.

Technical notes for IT

• Back the policy with controls: single sign-on for approved tools, blocking or flagging unapproved services where appropriate, and data loss prevention rules where available.
• Check each vendor's data terms, retention settings and administrative controls before approving it for confidential data.
• Review sharing and permissions on internal documents before enabling assistants that search company content, since conversational search exposes old oversharing.
• Keep an inventory of AI tools, owners, data types and review dates.

Next steps

• Run a short anonymous survey on current AI use.
• Draft the data-rules table for your business.
• Pick one approved assistant and configure its privacy settings.
• Read our guide on keeping private data safe.
• Schedule a review date in your calendar now.