AI Policy Template for Small Business (Free, Copy-and-Edit)
Your staff are probably already using AI tools, with or without permission. A short AI policy turns that into something you can manage: which tools are allowed, what information can go into them, and when a person must check the output. Copy the template below, fill in the brackets, and use the risk scorecard before each new AI use.
Why a small business needs an AI policy
An AI acceptable use policy isn't red tape. It answers three questions staff are already asking themselves: Am I allowed to use this? What can I paste into it? Do I need to check what it writes? Without answers, careful people avoid AI altogether and less careful people paste client files into free accounts.
A policy works best once you know how AI will actually be used. That's why we suggest mapping the processes where staff want to use it first. Each mapped task shows which data is involved and where a human check belongs. See our process mapping page for the method.
This template is a starting point, not legal advice. If you're in a regulated profession or handle sensitive data, have it reviewed against your obligations.
The AI policy template
Copy everything in the box, replace the bracketed text and delete anything that doesn't apply. Keep it to two pages so people actually read it.
[COMPANY NAME] AI ACCEPTABLE USE POLICY
Version: [1.0] Owner: [NAME/ROLE] Review date: [DATE]
1. PURPOSE
This policy explains how staff may use AI tools (such as chat
assistants, writing tools, transcription and AI features inside
our software) so we get the benefits while protecting clients,
colleagues and the business.
2. APPROVED TOOLS
Only these AI tools may be used for work:
- [Tool, plan type, who has access]
- [Tool, plan type, who has access]
Requests for new tools go to [OWNER]. Personal or free accounts
must not be used for client or company information.
3. INFORMATION RULES
Never enter into any AI tool:
- Passwords, keys or account numbers
- [Regulated data: health, payment card, government ID, etc.]
- Anything a client contract says must stay confidential
[unless the tool is approved for it in writing]
Only enter into approved tools:
- Client names and matter/project details
- Internal financial and staff information
Anyone may enter:
- Public information, and made-up examples
4. HUMAN REVIEW
A person must review AI output before it is:
- Sent to a client or the public
- Used for a financial, legal, HR or safety decision
- Added to a client file or official record
The reviewer is responsible for the final content.
5. DISCLOSURE
[State when clients must be told AI was used, e.g. if
required by contract, regulation or professional rules.]
6. NEW AI USES
Before using AI for a new task, complete the AI risk
assessment (see Section 8) and get approval from [OWNER].
7. PROBLEMS
Report mistakes, data entered in error or unexpected AI
behaviour to [OWNER] the same day.
8. TRAINING AND REVIEW
Staff confirm they have read this policy. It is reviewed
every [6/12] months or when tools change.
Signed: ____________________ Date: __________How to fill it in
- Approved tools: list the specific plan, not just the product. Business plans often have different data terms from free ones, so check the vendor's current terms before approving.
- Information rules: think in three tiers: never, approved tools only, and anyone. Most firms find the middle tier does most of the work.
- Human review: tie this to what the output is used for, not to which tool made it.
- Owner: one named person who approves new tools and answers questions. In a small firm that's often the operations lead or a partner.
AI risk assessment template: score each use before you launch it
The policy sets the rules. The risk assessment applies them to a specific task, such as "AI drafts first replies to client emails" or "AI summarises meeting notes". Run one for each new AI use. Weighted items count more because they carry more risk.
Keep each completed scorecard with the policy. When an AI use changes, such as moving from drafting to sending, score it again.
Nonprofit AI policy template notes
The same template works for nonprofits with a few additions. Add donor and beneficiary information to the "never" or "approved only" tiers, depending on your data protection commitments. Mention volunteers explicitly, since they often use personal devices and accounts. And consider adding a line on grant applications and funder reports, as some funders have their own rules on AI-written content.
An AI checklist for rolling it out
- Map the tasks where staff already use or want to use AI.
- Choose and set up approved tools on business plans.
- Fill in the policy and run the risk assessment on each mapped task.
- Hold a 30-minute session to walk staff through it with real examples.
- Collect signatures and put the policy where people will find it.
- Review after three months: what's being used, what's been asked about, what's gone wrong.
Once the rules are in place, the next question is which tasks are worth using AI for. The AI readiness assessment and AI ROI calculator help with that.
AI use policy vs. AI policy: what's the difference?
People search for both, and in a small firm they're usually the same document. If you want to separate them, the AI policy sets the firm-wide position (why you use AI, who owns it, how risk is managed), while the AI use policy is the practical rulebook for staff: which tools are approved, what each may be used for, what data must never go in, and what has to be checked before it goes out. The template above covers both.
AI use policy examples that work in practice tend to share three things: a short list of approved tools by name, plain "never" rules about client and personal data, and one sentence saying a person reviews anything client-facing. If staff can't remember the rules after one read, the policy is too long. Pair it with the AI governance checklist to assign owners, and the AI literacy quiz to check the rules landed.
Frequently asked questions
What should an AI policy for a small business include?
Approved tools, rules on what information can go into them, when a person must review output, who approves new uses, how to report problems and when the policy is reviewed.
What is an AI acceptable use policy?
A short document telling staff how they may use AI tools at work, focused on protecting client and company information and making sure a person checks important output.
Is this AI policy template free to use?
Yes. Copy it, edit it for your business and have it reviewed if you work in a regulated field.
What is an AI risk assessment template?
A scorecard you complete for each specific AI use, rating its data sensitivity, impact and controls, so you can approve, add safeguards or stop before launch.
Do nonprofits need a different AI policy?
The core is the same. Add rules for donor and beneficiary data, volunteers and funder requirements.
How often should we update our AI policy?
At least once a year, and whenever you add a tool or start using AI for a new kind of task.