AI Acceptable Use Policy Template for Small Businesses

An AI acceptable use policy tells staff which AI tools they may use for work, what information they may put into them, and what checking is required before AI output is used. For a small business it can be two pages long and still cover what matters.

Below is a complete template you can copy and edit, followed by an approved-tools register, a data classification table and five worked “is this allowed?” examples. Square brackets mark the parts to replace. It is a practical starting point rather than legal advice; if you handle regulated data, have it reviewed.

Before you write it

Spend 30 minutes on two things first.

1. Find out what is already in use. Ask staff which AI tools they use for work and on which accounts. Personal accounts are common, and they matter because their data settings differ from business plans.
2. Check each tool’s data settings. On personal accounts, OpenAI, Anthropic and Google each describe default settings under which chats may be used to improve models or reviewed, with settings to change that. Their business and API plans do not use your data for training by default. The details and links are in Is it safe to put company data into ChatGPT, Claude or Gemini?.

The template

[COMPANY NAME] — AI Acceptable Use Policy
Version [1.0] · Effective [DATE] · Owner: [NAME, ROLE] · Next review: [DATE]

1. Purpose
This policy explains how staff may use AI tools (such as chat assistants,
writing tools and AI features inside other software) for company work, so
that we get the benefits while protecting customer and company information.

2. Who it covers
All employees, contractors and temporary staff using AI tools for company
work, on any device or account.

3. Approved tools
Only tools listed in the AI Tools Register may be used for company work.
Use them only through the company account listed there, not a personal
account. To request a new tool, email [OWNER] with what it is for. Do not use
it until it has been added to the register.

4. Information rules
Green — may be used in any approved tool: public information, your own
writing with personal details removed, made-up example data.
Amber — approved business accounts only, and only what the task needs:
internal documents, customer names, non-public figures.
Red — never put into any AI tool: passwords, API keys and access codes;
payment card or bank details; government ID numbers; health, HR or
disciplinary records; client material we are contractually bound to keep
confidential; [ADD YOUR OWN].
If unsure, treat it as Red and ask [OWNER].

5. Checking output
You are responsible for anything you send, publish or act on, whether or not
AI helped write it. Before use, check facts, figures, dates, names, quotes and
any promise made to a customer against the source. Do not rely on AI output
for legal, tax, medical or safety decisions without review by a qualified
person.

6. Customers and the public
[Choose one: We tell customers when they are dealing with an automated
system / We do not use AI to reply to customers without a person reviewing
each reply.] Do not present AI-generated images of real people, products
or places as real photographs.

7. Decisions about people
Do not use AI tools to make or recommend decisions about hiring, pay,
discipline or dismissal, or credit, without [OWNER]'s written approval and
a human making the final decision.

8. Connected tools and automation
Do not connect an AI tool to company email, calendars, files or other systems,
or let it send messages or make changes on your behalf, unless the
connection is listed in the register.

9. Problems and mistakes
If you put Red information into an AI tool, or AI output caused an error that
reached a customer, tell [OWNER] the same day. Reporting quickly is expected
and will not in itself lead to disciplinary action.

10. Review and acknowledgement
[OWNER] reviews this policy every [6/12] months and when tools change.
I have read and will follow this policy.
Name: ______  Signature: ______  Date: ______

The AI tools register

Keep this as a simple shared spreadsheet. It changes more often than the policy, so it lives separately.

The “Last checked” column is for the data settings: when someone last confirmed the plan’s training and retention terms on the provider’s own pages.

Five “is this allowed?” examples

Use these in a short team briefing. The answers follow the template as written.

1. A salesperson pastes a customer’s complaint email, including name and address, into the company ChatGPT workspace to draft a reply. Allowed for the name (Amber, approved business account), but the address is not needed for the task, so it should be removed. The reply must be checked before sending (section 5).
2. The office manager uses a personal Gemini account to summarise a supplier contract. Not allowed. The contract is at least Amber, and a personal account is not in the register for Amber data (sections 3 and 4).
3. A bookkeeper asks Claude for a SUMIFS formula using column headers and made-up rows. Allowed. This is Green data. Our spreadsheet formulas guide shows how to test the formula.
4. A manager asks an AI tool to rank job applicants from their CVs. Not allowed without written approval and a human decision (section 7).
5. Someone realises they pasted a client’s account password into a chat. Report to the owner the same day and change the password (section 9).

Rolling it out

• Brief people for 15 minutes. Walk through the traffic-light rules and the five examples. Most mistakes come from not knowing which account is approved.
• Give people prompts that already follow the rules. Our office prompt templates use placeholders instead of personal details, and How to write a good AI prompt covers checking the answer.
• Make the approved route easy. If staff use personal accounts because no business account exists, the policy will be ignored. Compare plan costs in ChatGPT Plus vs Claude Pro vs Google AI Pro, and estimate whether the rollout pays for itself with how much time AI really saves a small business.

Official guidance

For a broader framework, the US National Institute of Standards and Technology (NIST) publishes the AI Risk Management Framework. NIST says AI RMF 1.0 was released on January 26, 2023 and is intended for voluntary use, and it released a Generative AI Profile (NIST-AI-600-1) on July 26, 2024 to help organisations identify risks specific to generative AI. NIST also notes the framework is being revised. It is much more detailed than a small business needs day to day, but it is a useful checklist when you review this policy. If you operate under data protection law such as UK or EU GDPR, also read your regulator’s guidance on AI and personal data before finalising sections 4 and 7.

Written by Editorial team · Last updated: 2026-11-01 · Facts last verified: 2026-11-01 · Editorial policy