AI Acceptable Use Policy Template for Small Businesses (With a Simple Rollout Plan)

By AI Compass Editorial team · Updated November 1, 2026

The short answer: what an AI acceptable use policy needs to cover

An AI acceptable use policy is a short document that tells your team which AI tools they may use for work, what they may use them for, which data they may put into them, and who checks the output.

Not legal advice. This is general guidance from the AI Compass editorial team, and the template does not on its own make you compliant with any law. If you handle sensitive data, work in a regulated sector or have client contracts that mention AI, have a qualified adviser check your finished policy.

You may also see it called an AI use policy, a generative AI policy for employees or simply a ChatGPT policy. For a small business, these usually mean the same thing.

It should cover:

• Approved tools: which tools are allowed, and on which accounts.
• Data rules: what may and may not go into a tool. The template uses a green/amber/red system.
• Allowed uses: what staff are encouraged to use AI for.
• Banned uses: what is off limits.
• Human review: who checks AI output, and how.
• Client disclosure: when you tell clients AI was involved.
• Accounts and security: business accounts, multi-factor authentication, removing access.
• Incident reporting: what to do when something goes wrong.
• Review date: when the policy gets checked again.

For a team of 1 to 50 people, this fits in two to four pages. The complete example policy below is built to be edited, not adopted word for word. Once you have made the four decisions covered below, filling it in within an afternoon is realistic.

Why a small business needs an AI policy (even with five people)

The risks of AI use do not shrink with headcount. A five-person firm can expose a client's data as easily as a large one. It just has fewer people to notice.

Your team is probably already using AI. People try chatbots such as ChatGPT, Claude, Gemini or Microsoft Copilot on their own, often on personal accounts. This is sometimes called 'shadow AI'. It is rarely malicious. People want to get work done faster. A policy brings that use into the open so you can see it and guide it.

Data risk. When someone pastes a client email or a spreadsheet into a tool, that data goes to a third party. Depending on the tool, the plan and the settings, the vendor may store it, have it reviewed or use it to improve its models. Free and consumer plans can handle data differently from business plans, and these terms change over time.

Accuracy risk. Generative AI tools, including those built on large language models (LLMs), can produce answers that sound confident and are wrong. These are often called hallucinations. Invented figures, made-up citations and incorrect legal points are typical examples. Someone has to own the final check.

Contract and client risk. Some client contracts and NDAs restrict sharing information with third-party services. Pasting a client's document into an AI tool could breach those terms even if nothing leaks.

Intellectual property uncertainty. Whether AI-generated content can be owned, and whether it might reproduce someone else's work, is not settled. The answer also varies by country.

It is also permission. A good policy is not just a list of bans. It tells staff clearly what they can do, which removes guesswork and encourages useful, safe habits.

Four decisions to make before you fill in the template

The template depends on four choices. Make them first and the brackets become easy to fill.

1. Which tools will you approve?

List the tools people already use and the ones you want them to use. Decide whether you will pay for business or team plans. Business plans often come with more admin control and different data terms, but check each vendor's current terms rather than assuming. If you are still choosing, our guide on how to choose an AI writing assistant for your business walks through criteria and a short trial plan.

A practical starting point for many small teams is one general-purpose assistant on a business plan, plus the AI features already built into the software you use.

2. What is your red data, and are there any exceptions?

Red data is information that must not go into AI tools. Write down your own list. It usually includes customer and staff personal data, passwords and keys, payment details, health information and anything under NDA. Your sector may add more.

Then be realistic about how you work. An AI meeting notetaker hears names and voices. The AI built into your email suite reads customer emails. Both process personal data. Decide whether any specific tools may handle personal data under controlled conditions. If yes, the template lets you mark those tools in the register as an exception. If no, keep personal data red everywhere and remove those uses from the policy. Either choice is fine. A rule that contradicts daily work is not, because people will simply ignore it.

Some data should stay red in every tool, with no exceptions: passwords and keys, payment details, health information and other especially sensitive data, and anything a client has restricted.

3. Who is your AI lead?

Name one person. In a small business this is often the owner, an operations manager or an office manager. They approve tools, answer questions, handle incidents and run reviews. It does not need to be a technical person, just someone organised who will actually do it.

4. What is your stance on client disclosure?

Decide whether you tell clients about AI use always, only when asked or required, or for certain types of work. The template gives you three options to choose from.

The AI acceptable use policy template

How to use it: copy everything between the start and end markers into a document. Replace everything in [square brackets]. Delete sections that do not apply. Keep the language plain. If a sentence would confuse your team, rewrite it.

START OF TEMPLATE

[Company name] AI Acceptable Use Policy

• Version: [1.0]
• Effective date: [DD Month YYYY]
• Last updated: [DD Month YYYY]
• Policy owner (AI lead): [Name, role, email]
• Next review date: [DD Month YYYY]

1. Purpose and scope

[Company name] wants everyone to use AI tools where they help us do better work, faster. This policy explains how to do that safely. It protects our clients, our colleagues and the business.

Who it covers: all employees, contractors, freelancers and interns who do work for [Company name].

What it covers: any generative AI tool used for work. This includes:

• chatbots and AI assistants;
• writing and editing assistants;
• image, audio and video generators;
• coding assistants;
• AI meeting notetakers and transcription tools;
• AI features built into software we already use, such as email, documents, CRM and meeting tools;
• browser extensions that use AI.

It applies on company devices and on personal devices used for work.

2. Key terms

• Generative AI tool: software that creates text, images, audio, video or code from instructions.
• Prompt: what you type, upload or say to the tool. Output: what the tool produces.
• Personal data: any information about an identifiable person, such as a name, email, phone number, address, voice recording or ID number. Sometimes called PII. Some types, such as health information, are especially sensitive (called special category data in UK and EU data protection law).
• Confidential information: anything not public about our business or our clients, including anything covered by an NDA or contract.
• Approved tool: a tool listed in the register in section 3, used on the account type shown there.
• Green, amber and red data: the three data levels defined in section 4.

3. Approved tools and how to request a new one

Only use tools on the approved list below for work. Use the company-managed account, not a personal one.

A company-managed workspace account, such as the email and documents suite that [Company name] pays for and administers, counts as a business account for the data rules in section 4. A personal or free account you signed up for yourself does not.

The 'Personal data allowed?' column shows the only tools that may handle personal data (see section 4). If it says No, treat personal data as red in that tool.

To request a new tool, email [AI lead] at [email] with the tool name, what you want to use it for and the data it would touch. The AI lead checks the data terms, cost and security settings before approving it. Please do not start using a tool for work until it is on the list.

Approved tools register

4. Data rules: green, amber, red

Before you put anything into an AI tool, check this table. A quick rule of thumb: if you would not post it in a public forum, it is not green. If you are unsure, treat it as red and ask [AI lead].

Controlled exception for personal data. Personal data of customers or staff may only go into tools the register marks 'Personal data allowed: Yes'. A tool gets a Yes only if it is used on a business account and [AI lead] has checked the vendor's data processing terms and settings. Examples: [our email suite's built-in AI], [our approved meeting notetaker]. Even then, use only the personal data the task needs, and only for the approved uses in the register.

Always red, in every tool, with no exceptions:

• passwords, API keys and access codes;
• bank, card or financial account details;
• health information and other special category data;
• anything under an NDA or a client contract that restricts sharing [unless the client has agreed in writing];
• unreleased financial results;
• HR, disciplinary or salary matters.

Removing names is not always enough. If the remaining details could still identify a person or a client, treat it as red.

Vendors' data-use and retention terms vary by plan and change over time. The AI lead checks them when approving a tool and at each review.

5. What you can use AI for

You are encouraged to use approved tools to:

• draft and edit emails, social posts, documents and proposals;
• summarise public, green or amber material;
• brainstorm ideas, headlines, outlines and options;
• get a starting point for research, as long as you verify facts against original sources;
• get help writing, explaining or debugging code, within the data rules;
• draft customer replies and quotes, either with personal details removed or in a tool the register approves for personal data;
• take meeting notes, but only with a notetaker the register approves for personal data, and with everyone in the meeting told and agreeing;
• [add uses specific to your business].

6. What you must not use AI for

Do not use AI tools to:

• enter red data, except personal data in a tool the register approves for it (section 4);
• make final decisions about people, such as hiring, firing, pay, credit or individual pricing, without a human reviewing and owning the decision;
• create deceptive content, impersonate anyone, or create deepfakes or synthetic media of real people;
• present AI output as verified fact or professional advice without checking it;
• bypass security controls or install unapproved AI browser extensions or plug-ins;
• create content that infringes others' rights or breaks the tool's terms of use;
• record or transcribe meetings or calls without the participants' consent.

7. Human review and accuracy

A human stays in the loop for everything AI helps produce. The person who uses AI owns the result. Before using any output:

• check names, numbers, dates, quotes and citations against a reliable source;
• check anything legal, medical, financial or safety-related with extra care;
• make sure it sounds like us and is right for the audience.

Higher-stakes work gets a second review by [role or name] before it goes out. This includes client deliverables, published content, contracts and anything with prices or commitments.

Where practical, keep the prompt or source material with the work, so we can trace how it was produced.

8. Transparency with clients and the public

[Choose one option and delete the others.]

• Option A: We tell clients when AI tools have helped produce any deliverable.
• Option B: We tell clients about AI use when they ask, or when a contract requires it.
• Option C: We always disclose AI use for [AI-generated images / published articles / other categories], and otherwise on request.

In all cases, client contract terms come first. Label AI-generated images, audio and video where it is relevant to the audience.

9. Intellectual property and copyright

The law on copyright and AI-generated material is unsettled and varies by country. So:

• do not assume we own AI output outright; ask [AI lead] before relying on that for important work;
• do not prompt tools to imitate specific copyrighted works, or the style of living artists, for commercial use [adjust to your stance];
• where possible, check generated text and code for passages that look copied from elsewhere;
• respect client terms about who owns the work and whether AI may be used on it.

10. Accounts, access and security

• Use business accounts only for work. No personal AI accounts for company or client material.
• Turn on multi-factor authentication (MFA). Use single sign-on where we have it.
• Do not share logins.
• [AI lead] removes access when someone leaves or changes role.
• When setting up a tool, review its data, history and training settings and record them in the register.
• Be careful with AI tools or extensions that connect to email, file storage or calendars. Grant the minimum access needed, and ask [AI lead] first.

11. Reporting mistakes and incidents

Mistakes happen. Speed matters more than blame.

If red data was put into a tool not approved for it, or a harmful or wrong AI output went to a client or the public, tell [AI lead] within [24 hours]. Use [email / phone / chat channel].

The AI lead will:

1. record what happened, when, and which tool and data were involved;
2. delete the conversation or file if the tool allows, and check the vendor's deletion options;
3. assess straight away whether it is a personal data breach that may need to be reported to a regulator, taking advice if needed (some laws set short deadlines for this);
4. inform the client if the contract or the situation requires it;
5. update this policy or the training if it would help prevent a repeat.

Reporting a mistake promptly will not be treated as a disciplinary matter. Hiding one may be.

12. Training, enforcement, review and acknowledgement

• New starters get a short briefing on this policy in their first [week].
• Breaches are handled under [our disciplinary policy / the contractor agreement].
• This policy is reviewed every [6 months], and sooner if tools, vendor terms, client requirements or laws change.

Acknowledgement

I have read and understood the [Company name] AI Acceptable Use Policy, version [1.0].

Name: ______________________

Signature: ______________________

Date: ______________________

END OF TEMPLATE

How to adapt the template to your business

The template works as a base for most small businesses. Some sectors need tighter rules in specific places.

A one-page version for solo freelancers

If you work alone, you do not need twelve sections. Write one page with:

1. My tools: the AI tools I use, on which plan, the settings I have checked, and which (if any) I allow to handle personal data.
2. My red data: what I never put into AI tools, including all client data under NDA.
3. My review rule: I check every fact, figure and citation before delivery.
4. What I tell clients: for example, 'I use AI tools for drafting and research support. All work is reviewed and edited by me, and I never put your confidential information into them.'
5. If something goes wrong: I tell the client promptly and follow any contract terms.

Keep it somewhere you can share with clients who ask.

A note on regions

Rules differ by country and change, so treat this as a prompt for checking, not a summary of the law.

• EU and UK: GDPR and UK GDPR apply to personal data you put into AI tools. If a vendor processes personal data on your behalf, these laws generally expect a written contract with it, often called a data processing agreement or addendum. That is one thing the AI lead should look for before marking a tool 'Personal data allowed: Yes'.
• EU AI Act: the EU AI Act entered into force in August 2024. Its AI literacy obligation (Article 4) has applied since 2 February 2025 to organisations that use AI systems. In practice, that means taking steps so staff understand the tools they use, which a policy plus a short training session helps you show.
• UK guidance: the UK ICO publishes guidance on AI and data protection.
• US: consider state privacy laws, such as the CCPA in California, and the FTC's business guidance, which covers deceptive claims, including claims about AI.
• Further reading: the NIST AI Risk Management Framework is voluntary and more detailed than most small businesses need, but it is a useful reference if you want to go deeper.

How to roll it out: a simple two-week plan

A policy only works if people follow it. This plan turns the document into habits.

Week 1: decide and write

1. Ask staff which AI tools they already use. Make it clear there is no blame. You want an honest list, including browser extensions and AI features inside existing software.
2. Decide your approved tools and fill in the register. Choose plans, check each vendor's current data terms and settings, and note what you found. Decide which tools, if any, may handle personal data.
3. Fill in the template and get it reviewed. Replace the brackets and delete what does not apply. If you are in a regulated sector or handle sensitive data, send it to an adviser now.

Week 2: introduce and switch over

4. Hold a 30 to 45 minute team session. Walk through real examples from your own work. Is this client email green, amber or red? Can I summarise this meeting, and in which tool? Let people ask questions.
5. Share the quick-reference card and collect acknowledgements. Send the policy, pin the card and ask everyone, including contractors, to sign.
6. Move people to business accounts and check settings. Stop using personal accounts for work material. Turn on MFA. Review data and training settings.
7. Set a review date and a channel for questions. Put the next review in the calendar and tell people where to ask, such as a chat channel or the AI lead's email.

One-page quick-reference card for staff

Copy this, add your names and pin it where people will see it.

AI at [Company name]: the quick version

Do:

1. Use approved tools on your company account.
2. Check the traffic light before you paste anything in.
3. Remove names and identifiers from amber material.
4. Check every fact, figure, quote and citation before you use the output.
5. Ask [AI lead] when you are unsure, or when you want to try a new tool.

Don't:

1. Put red data into AI tools. Personal data only goes into tools the register approves for it.
2. Use personal AI accounts for work.
3. Install AI browser extensions without approval.
4. Record or transcribe meetings without consent.
5. Let AI make final decisions about people.

Traffic light:

• Green: public information, your own drafts, generic questions. OK in approved tools.
• Amber: internal or client material with names removed. Approved tools on business accounts only.
• Red: personal data, passwords, payment details, health information, NDA material. Never, unless the register says a specific tool is approved for personal data. Passwords, payment details, health information and NDA material: never, in any tool.

Who to ask: [AI lead name], [email or chat channel].

If something goes wrong: tell [AI lead] within [24 hours]. Do not try to fix it quietly. Note what happened and which tool. Reporting quickly will not get you into trouble.

Keeping the policy current

AI tools change quickly, so set a fixed review, such as every six months. Also review the policy when any of these happen:

• you add or drop a tool;
• a vendor changes its terms, plans or data settings;
• a client contract adds AI requirements;
• an incident or near miss happens;
• a relevant law or regulator guidance changes;
• staff keep asking the same question, which usually means a rule is unclear.

Treat the approved-tools register as a living document. Update it when something changes, not just at review time. Re-check vendor data terms periodically, especially for tools approved for personal data, because features, limits and defaults change often and the changes are not always announced prominently.

Common mistakes to avoid

• Banning AI outright. It often does not stop use. It pushes it onto personal accounts, where you have no visibility or control.
• Copying an enterprise policy. Twenty pages written for a legal department will not get read. Short and specific beats complete and ignored.
• Rules that contradict real work. If the policy bans all personal data but the team relies on an AI notetaker, people will ignore the rule. Write a controlled exception instead, or drop the tool.
• No named owner. If everyone owns it, nobody approves tools or handles incidents.
• Ignoring built-in AI. AI features in email, documents, CRMs and meeting software process your data too. Put them in the register.
• Forgetting contractors and freelancers. They often handle client data and use their own tools. Include them and ask them to sign.
• Never updating it. A policy written once and left alone goes out of date as tools and terms change.
• Assuming a paid plan means data is never kept. Paid and business plans may offer better data terms, but retention and use vary. Read the current terms for each tool and plan.

When to get legal or professional advice

This template is a starting point, not legal advice. It is general guidance from the AI Compass editorial team, and on its own it does not make you compliant with any law. Get a qualified adviser to review your policy if any of these apply:

• You work in a regulated sector, such as health, finance, legal services or education involving minors.
• You process personal data at scale, or special category data such as health information.
• You want to approve AI tools for personal data and are not sure whether the vendor's terms are adequate.
• Your client contracts include clauses about AI, data processing or subcontracting.
• You use, or plan to use, AI in decisions about people, such as hiring, performance or credit.
• You operate in, or serve customers in, several countries.
• You have had an incident that may involve a personal data breach.

If none of these apply, a careful owner can often finish and roll out this policy without outside help. Revisit that decision as your business and your AI use grow.