Writing an AI use policy for your team: a template outline

• An AI use policy is a short set of rules that tells your team how to use AI tools safely.
• One or two pages is enough for a small business. If nobody reads it, it does not work.
• Cover approved tools, what data is off limits, who checks the output and what to disclose.
• Review it every few months, because tools and habits change.
• Treat it as guidance for good judgement, not a list of fear.

Your team is probably using AI tools already, with or without your knowledge. One person drafts emails, another summarises documents, another makes images. Without shared rules, each person decides alone what is safe.

An AI use policy gives everyone the same starting point. It protects customer information, reduces embarrassing mistakes and makes it clear who is responsible. It also reassures staff who worry about being blamed for using the tools wrongly.

This outline is a general starting point, not legal advice. If your work involves health, finance, children or other sensitive areas, ask a qualified professional to review it.

Use these sections as headings in a simple document.

Purpose. Keep it human. For example: "We use AI to save time on routine work while protecting customers and our reputation."

Approved tools. List the tools the team may use for work, and say that others need approval from a named person. This reduces random sign-ups with work emails.

Data rules. This is the most important part. Say clearly that the following must never be pasted into AI tools: passwords, bank or card details, identity documents, private customer information, and confidential contracts. Explain how to replace real details with placeholders. Our guide on data privacy with AI tools goes through this in more depth.

Review rules. Decide which outputs need a human check. A sensible rule: anything leaving the company, anything affecting money, and anything about health, law or safety must be read and approved by a responsible person before use.

Disclosure. Decide when to tell people. For example, you might say that AI-made images or text used in marketing should be labelled where a reasonable person would care, and that AI must not pretend to be a real person in a conversation.

Ownership and credit. Say who is responsible for the final work. The person who publishes it owns the quality, whatever tool helped.

Problems. Give a simple path: tell the owner at once, do not hide it, fix what can be fixed, and learn from it. Staff should not fear punishment for honest reporting.

• Do not write long legal paragraphs nobody understands.
• Do not ban everything, because people will quietly work around the ban.
• Do not promise customers things you cannot control, such as that AI never makes mistakes.
• Do not copy another company's policy without adjusting it to your work.

1. Draft the policy in plain language, with two or three real examples.
2. Share it with the team and ask for their questions.
3. Fix anything that is unclear or unrealistic.
4. Ask everyone to confirm they have read it.
5. Put it where people can find it, such as the shared drive or the wall.
6. Add a calendar reminder to review it.

Five minutes of discussion in a team meeting often teaches more than the document itself.

Add a short "before you paste" checklist near your desk: Is it public? Is any person identifiable? Would I be comfortable if a customer saw this? Is there a safer way to ask? Also provide a quick contact for questions, so people ask before acting.

If your policy touches your website or customer chat, you can plan those pieces with the free web-developer helper, and see other guides on the blog.

Does a small business really need an AI use policy? If anyone on your team uses AI tools for work, yes. A short policy is simple to write and prevents avoidable mistakes.

How long should it be? One or two pages is usually enough. Shorter documents get read and followed.

Can I copy a template from the internet? Use it as a starting point only. Adjust it to your tools, your data and your kind of work.

Who should own the policy? Name one person, usually the owner or a manager, who answers questions and schedules reviews.