How to use this template
- Download it in Word, or copy the text below.
- Replace everything in [brackets]: your company name, the tools you approve, who owns the policy.
- Adjust the lists to your business. A clinic and a marketing agency will draw different lines.
- Share it with the team, walk through sections 5 and 6, and have everyone sign.
- Put a date in the calendar to review it. AI tools change quickly.
This template is a starting point, not legal advice. If you handle health, financial or children's data, or work in a regulated industry, have a lawyer review it.
The policy
1. Purpose
This policy explains how [Company Name] staff may use artificial intelligence (AI) tools at work, so we get the benefits while protecting our customers, our data and our reputation.
2. Who it applies to
Everyone who works for or with [Company Name], including employees, contractors and temporary staff, whenever they use AI tools for company work, on company or personal devices.
3. Approved tools
Only use AI tools on this list for company work: [List approved tools, e.g. ChatGPT Team, Microsoft Copilot]. Ask [Policy Owner] before using any other tool. Use your company account, not a personal one.
4. What you may use AI for
- Drafting emails, posts and documents that a person reviews before sending
- Summarizing long documents, notes or meetings
- Brainstorming ideas and outlines
- Research, checked against reliable sources
- Help with spreadsheets, formulas and routine analysis
5. What you must not do
- Enter passwords, access codes or security details
- Enter customer or employee personal information, unless the tool is approved for it in section 3
- Enter payment card, bank, health or government ID information
- Enter confidential company information, such as pricing, contracts or plans, into tools not approved for it
- Use AI to make final decisions about people, such as hiring, pay or credit
- Present AI output as checked fact without checking it
6. Check everything
AI tools can be wrong, out of date or make things up. You are responsible for anything you send, publish or decide using AI. Check facts, figures, names and links before using the output.
7. Being open about AI
Tell customers when they are talking to an AI rather than a person. Follow any rules from clients or platforms about disclosing AI-generated content.
8. Ownership and copyright
Work you create with AI tools for [Company Name] belongs to [Company Name]. Don't use AI to copy other people's work, logos or brand material.
9. Security
Use strong passwords and two-factor authentication on AI accounts. Don't install browser extensions or plugins that connect AI tools to company systems without approval.
10. Problems and questions
If you think company or customer information was entered into an AI tool by mistake, or an AI output caused a problem, tell [Policy Owner] the same day. Questions about this policy go to [Policy Owner] at [Email].
11. Review
[Policy Owner] reviews this policy every [6 / 12] months, because AI tools change quickly. Last reviewed: [Date].
Acknowledgement
I have read and understand this policy. Name: __________________ Signature: __________________ Date: __________
Questions
- Does a small business need an AI policy?
- If anyone on the team uses AI tools for work, yes. A short policy prevents the most common problem: customer or company data pasted into tools that weren't approved for it.
- What should an AI usage policy include?
- Which tools are approved, what staff may and may not use them for, what data must never be entered, a rule to check all output, how to be open with customers about AI, and who to ask or tell when something goes wrong.
- Is this template legal advice?
- No. It's a practical starting point. Businesses in regulated industries or handling sensitive data should have a lawyer review their final policy.