An AI acceptable use policy tells employees which AI tools they may use, what information must never go into them, and how to check AI output before relying on it. A small business can write one in an afternoon, and one page is enough to start. The template below covers everything most businesses need; fill in the bracketed parts and share it with your team.
Your staff are almost certainly using AI already, whether or not you have approved it. Without written rules, each person decides alone what is safe to paste into a chatbot. A short policy replaces those guesses with one standard, and it gives you something to show when a client, auditor, or cyber insurer asks how you handle AI.
Key takeaways
- The two rules that prevent most AI problems: use only approved business accounts, and never put customer, financial, or confidential data into tools that are not approved for it.
- Banning AI rarely works. Employees move to personal phones and accounts where you have no visibility.
- Every policy needs an owner and a review date, because AI tools change faster than most policies.
- Pair the policy with a verification rule: AI-cloned voices and deepfake video mean urgent payment requests must be confirmed through a trusted channel.
- Regulated businesses (healthcare, finance, legal) need to tie the policy to their existing compliance rules, not write a separate one.
Why does a small business need an AI policy?
Most AI risk in a small business comes from good employees trying to work faster. Someone pastes a client contract into a free chatbot to summarize it. Someone installs a browser extension that reads every page they open. Someone adds an AI note-taker to a confidential call. None of them mean harm, and none of them know where that information goes next.
Free consumer AI tools may keep what you type and, depending on the provider and settings, use it to improve their models. Business plans usually offer stronger data terms, administrator controls, and no training on your content. A policy is how you steer people from the first kind of tool to the second. It is also increasingly expected: cyber insurance applications, client security questionnaires, and vendor reviews now ask whether you have written rules for AI use. Our page on using AI safely in a growing business explains the wider risks.
What should an AI acceptable use policy include?
- Purpose and scope. Who the policy covers (employees, contractors, interns) and which tools count as AI, including AI features built into software you already use.
- Approved tools. A short list of tools staff may use, with the account type that must be used (company account, not personal).
- Prohibited tools and uses. Free consumer accounts for company work, unapproved browser extensions, and AI note-takers on calls without consent.
- Data rules. What can go into approved tools, what needs a manager's approval, and what must never go into any AI tool.
- Human review. AI output is a draft. A person checks facts, figures, legal language, and anything sent to a client.
- Disclosure. When clients or the public must be told AI was used.
- Account security. Company sign-in with multi-factor authentication, no shared logins, and no connecting AI apps to company email or files without approval.
- Verification of requests. How staff confirm payment, password, or bank detail changes when a voice, video, or email could be faked.
- Reporting. Where to report a mistake, such as sensitive data pasted into the wrong tool, without fear of punishment.
- Ownership and review. Who owns the policy, how new tools get approved, and when the policy is reviewed.
Free AI acceptable use policy template
Copy this into a document, replace the bracketed text, and keep it to one or two pages. Shorter policies get read.
[Company Name] AI Acceptable Use Policy
Effective date: [date] · Policy owner: [name and role] · Next review: [date, no more than 12 months out]
1. Purpose. This policy explains how [Company Name] staff may use artificial intelligence tools safely. It applies to all employees, contractors, and interns, and to AI features inside other software we use.
2. Approved tools. You may use these tools for company work, signed in with your company account only: [list, for example: Microsoft 365 Copilot; ChatGPT Team; Claude Team]. Ask [policy owner] before using any other AI tool for work.
3. Not allowed. Do not use personal or free AI accounts for company work. Do not install AI browser extensions or connect AI apps to company email, calendars, or files without approval. Do not add AI note-takers or recorders to meetings without telling every participant.
4. Data rules.
Never enter into any AI tool: passwords or access codes; customer or patient personal information; payment, banking, or payroll details; [regulated data, for example health records]; anything a client contract says is confidential.
Only with manager approval, and only in approved tools: internal financial reports, pricing, contracts, and unreleased plans.
Allowed in approved tools: public information, general drafting, and internal documents that contain none of the above.
5. Check the output. AI can be confidently wrong. Review facts, numbers, names, and legal or technical claims before using AI output, and never send AI-written content to a client without reading it first.
6. Disclosure. Tell clients when AI produced a substantial part of work delivered to them, or whenever their contract requires it.
7. Verify before you act. Voices, video, and emails can be faked with AI. Confirm any request to send money, change bank details, share passwords, or buy gift cards by calling the person back on a number you already have. Never use contact details from the request itself.
8. Report mistakes. If you put information into an AI tool that this policy does not allow, tell [policy owner or IT contact] right away. Quick reports let us limit the damage, and honest mistakes reported promptly will not be punished.
9. New tools. Request new AI tools through [process, for example a form or ticket]. [Policy owner] reviews the tool's data terms, security, and cost before approving it.
10. Acknowledgement. I have read and will follow this policy. Name: ______ Signature: ______ Date: ______
Prefer a worksheet? The four-part starter version is on our free AI guide page, and the full guide includes it as a printable page.
How do you roll out an AI policy in 30 days?
- Week 1: find out what is in use. Ask staff which AI tools they use and for what, without blame. Check your Microsoft 365 or Google Workspace admin center for AI apps that people have connected. Our shadow AI guide walks through where to look.
- Week 2: approve and configure. Pick the tools you will support, buy business accounts, turn on multi-factor authentication, and switch off settings that let providers train on your data.
- Week 3: publish and train. Share the policy, run a 30-minute session with real examples from your business, and collect signed acknowledgements.
- Week 4: enforce and adjust. Block or remove tools that are not approved, set up a simple request process for new ones, and fix the parts of the policy that confused people.
Common mistakes to avoid
- Banning AI outright. It pushes use onto personal devices and removes your visibility.
- Writing a ten-page policy. Nobody reads it. Put the details in a separate procedure if you need them.
- Approving nothing. A policy that only says no leaves people with no safe option.
- Forgetting built-in AI. Email, CRM, meeting, and document tools now ship with AI features, sometimes switched on by default.
- No owner. Without one, the approved list goes stale within months.
What about healthcare, finance, and other regulated businesses?
If you handle protected health information, financial data under the NYDFS cybersecurity rules, or confidential legal matters, your AI policy has to match the rules you already follow. Only use AI tools covered by an appropriate agreement with the vendor, such as a business associate agreement for health data, and record AI tools in the same risk assessments and vendor reviews as any other system. Our IT security compliance guide covers how those requirements fit together, and our guide to using AI under HIPAA and NYDFS covers which AI plans qualify.
How Spot On Tech can help
Through our AI governance service, we help businesses in New York and New Jersey find the AI tools already in use, choose and configure approved ones, write a policy that fits how the team works, and train staff on it. Our AI implementation team then helps people get real value from the approved tools. For more practical rules, see our AI security tips for business.
Frequently asked questions
What is an AI acceptable use policy?
It is a short company policy that sets which AI tools employees may use, what information they must keep out of those tools, how AI output gets checked, and who to contact with questions or mistakes.
Does a small business really need an AI policy?
Yes, if anyone on the team uses AI for work, which is likely. A one-page policy prevents the most common data leaks and answers the AI questions now appearing on insurance applications and client security reviews.
Can employees use free ChatGPT for work?
It is safer not to. Free consumer accounts give the business no control over the data and may allow it to be used for training. Approve a business plan with stronger data terms and require staff to use their company account.
Who should own the AI policy?
Someone with authority to approve tools and enforce rules, often an operations leader, office manager, or IT lead, working with your IT provider. The owner keeps the approved tool list current and reviews the policy at least once a year.
How often should an AI policy be updated?
Review it at least every 12 months, and sooner when you adopt a major new tool, a vendor changes its data terms, or a regulation that applies to you changes.
