AI Use Policy for Employees: A Plain-English Template for Small Teams

Estimated read time: 10 minutes

Your employees are already using AI. The question is whether they are doing it with company data, on personal accounts, with no rules, and no one checking the output. In most small businesses the honest answer is yes to all four, and nobody planned it that way. Someone pasted a client email into a chatbot to save ten minutes, it worked, and it spread.

An AI use policy fixes that without banning anything. This guide covers what to put in one, how to keep it short enough that people read it, and includes a plain-English template you can adapt. It is general business guidance, not legal advice, so have an attorney review the final version if you handle regulated data.

TL;DR

• Write a one to two page policy. A long one will be ignored.
• Spell out what data may never go into an AI tool: customer personal data, passwords, financials, anything under NDA, and unreleased work.
• Name the approved tools, and require work accounts rather than personal ones.
• Make a human accountable for every AI-assisted output, especially anything customer-facing.
• Decide when you disclose AI use to customers, and be consistent.
• Review the policy every six months. The tools change faster than the paperwork.

Why a small business needs an AI policy now

Small teams are the most exposed, because they have the least structure. A large company has an IT department that blocks tools and a legal team that vets vendors. A ten-person company has a group chat and trust. That works until someone uploads a customer list to a free tool whose terms allow training on user inputs.

There are four practical risks.

• Data leakage. Confidential or personal information entered into a consumer AI tool may be stored, reviewed by the vendor, or used to improve models depending on the plan and settings.
• Bad output treated as fact. AI tools produce confident mistakes, invented citations, and flawed numbers. Without a review step, those mistakes reach customers.
• Security and manipulation. AI tools that read email or browse the web can be tricked by hidden instructions. We covered one example in our piece on an AI email summary prompt injection attack.
• Compliance and contracts. Client agreements often restrict how their data is handled, and some states are passing AI-related rules. See our overview of Colorado’s AI law and small business compliance for one example of where regulation is heading.

A policy does not eliminate those risks. It makes the expectations explicit, which helps in two ways: employees stop guessing, and if something goes wrong, you can show you had reasonable rules.

What to include: the eight sections

You do not need legal language. You need clear answers to eight questions.

• Purpose and scope. Who and what the policy covers: employees, contractors, interns, and every AI tool including chatbots, image generators, meeting note takers, and AI features inside other software.
• Approved tools. Which tools are allowed and for what.
• Data rules. What can and cannot be entered.
• Accounts and settings. Work accounts only, with specific privacy settings.
• Human review. Who checks AI output and when.
• Customer-facing use and disclosure. Where AI can touch client work and how you tell people.
• Intellectual property and attribution. Ownership of outputs, and rules about using copyrighted or competitor material as inputs.
• Reporting and consequences. How to flag a mistake or incident without fear, and what happens for willful violations.

The data rules that matter most

If you only write one section carefully, make it this one. People do not need a lecture on how language models work. They need a simple test they can apply in five seconds.

A useful framing is three tiers.

• Never enter (red). Customer or employee personal information, health or financial records, passwords and API keys, login credentials, anything covered by an NDA or client contract, unreleased financials, and legal matters.
• Enter only in approved business tools (yellow). Internal documents, draft marketing, meeting notes, and anonymized customer feedback. These can go into tools on your approved list that have business-grade privacy terms.
• Fine in general (green). Public information, generic brainstorming, rewriting your own non-sensitive text, and learning a topic.

Then add a simple rule of thumb: if you would not email it to a stranger, do not paste it into a tool that is not on the approved list. Make the examples concrete and specific to your business. A bookkeeper’s red list looks different from a design agency’s.

Approved tools and accounts

Most data problems come from personal accounts and free tiers, not from AI itself. Business plans from major vendors typically offer stronger controls: options to exclude your data from model training, admin dashboards, and contractual commitments. Terms differ by vendor and change often, so read the current terms for any tool you approve, or ask the vendor in writing.

Your policy should say:

• A short list of approved tools and what each is approved for. For help choosing, see our guides to AI writing tools and AI meeting note takers.
• That work happens on company-managed accounts, not personal logins.
• Who approves new tools, and how an employee requests one. A simple form beats a ban, because bans just push usage underground.
• That AI features embedded in other software count too. Many tools quietly added AI assistants and meeting recorders in the last two years.
• That plugins, browser extensions, and agents that connect to company accounts need approval before installation.

If you are not sure what AI is already in your stack, our SaaS AI risk audit is a good way to inventory it.

Human review and accountability

The most important principle in any AI policy fits in one sentence: the human who uses the output owns it. If an employee sends a client a report with a made-up statistic, the fact that an AI wrote it is not a defense, internally or externally.

Make that practical:

• Anything customer-facing, legal, financial, or safety-related gets reviewed by a person who understands the subject before it goes out.
• Facts, figures, quotes, and citations are verified against a primary source. AI tools can and do invent them.
• Code, formulas, and automations are tested before use.
• Employees should be able to say where a claim came from. “The chatbot said so” is not a source.
• AI is not used to make or recommend hiring, firing, pay, lending, or similar decisions about people without an explicit review process. If you hire, read our AI small business hiring guide first.

Customers, disclosure, and honesty

Decide in advance what you tell customers. There is no single standard, and some contracts and regulations may require disclosure in specific cases. A sensible baseline for most small businesses:

• Do not pass off AI-generated work as human-created if a client has asked for human work or if the contract says so.
• Be transparent when a customer is chatting with an automated assistant, especially for support.
• Do not use AI to fabricate testimonials, reviews, credentials, or case studies. That is both dishonest and, in many places, illegal.
• If a client contract restricts AI use, follow the contract and tell your team which clients are affected.

The point is consistency. A customer who learns you used AI is usually fine with it. A customer who learns you hid it, or fed their data into it without asking, is not.

A plain-English policy template

Copy this into a document, replace the bracketed parts, and trim anything that does not fit your business. Aim for one or two pages.

[Company Name] AI Use Policy

1. Purpose. We use AI tools to work faster and better. This policy sets simple rules so we protect our customers, our data, and our reputation. It applies to all employees, contractors, and interns, and to every AI tool, including chatbots, image generators, meeting recorders, and AI features inside other software.

2. Approved tools. You may use the tools on our approved list: [list tools and uses]. To request a new tool, email [name or address]. Do not install AI plugins, extensions, or agents that connect to company accounts without approval.

3. Accounts. Use your company account for any work-related AI use. Do not use personal accounts for company work. Keep the data-sharing and training settings we have specified: [settings].

4. Data rules. Never enter customer or employee personal information, health or financial records, passwords or keys, confidential client material, unreleased financials, or legal matters into any AI tool unless the tool is approved for that specific use. When in doubt, ask [name] before you paste.

5. Review and accountability. You are responsible for everything you send, publish, or deliver, whether or not AI helped. Check facts, numbers, quotes, and links against a reliable source. Have a qualified person review anything customer-facing, legal, or financial before it goes out.

6. Customers and disclosure. Follow client contracts that restrict AI use. Do not present AI-generated work as human-made when someone has asked for human work. Tell customers when they are interacting with an automated assistant. Never use AI to create fake reviews, testimonials, or credentials.

7. Intellectual property. Do not enter copyrighted material or a competitor’s confidential information into AI tools. Review AI output for similarity to existing work before publishing. Save the prompts and sources for significant work products.

8. Reporting. If you think you shared something you should not have, or that AI output caused an error, tell [name] right away. Reporting quickly will not be punished. Hiding it will be taken seriously. Willful violations of this policy may lead to disciplinary action.

9. Review. We will review this policy every six months and when we adopt major new tools. Last updated: [date]. Owner: [name].

How to roll it out without a revolt

The fastest way to get a policy ignored is to drop it in an email and expect compliance. A better approach:

• Start with what people already do. Ask the team which tools they use and for what. You will learn about tasks you never thought of, and people are more likely to follow rules they helped shape.
• Lead with permission, not prohibition. Tell them what is encouraged first. The policy should read as “here is how to use this safely,” not “here is how you will be punished.”
• Hold a 20-minute walkthrough. Use real examples from your business. Show a red-tier mistake and a green-tier win.
• Make the approved path easy. If your approved tool is slower or harder than the free one, people will route around it. Pay for the business plans you recommend.
• Assign an owner. One named person answers questions and approves tools. Without an owner, the policy decays.
• Collect signatures or acknowledgments. A simple confirmation that each person read it is enough for most small teams.

Keeping it current

AI products change monthly. A tool that was off limits in March may offer better privacy controls by September, and a trusted tool may add a feature that records every meeting by default. Put a six-month review on the calendar. At each review, check the approved list, re-read vendor privacy terms for your main tools, scan for new incidents in the news, and ask the team what is not working.

It is also worth reviewing after any significant event, such as a vendor outage, a data incident, or a client asking new questions about your AI use. Our piece on building an AI vendor continuity plan covers the resilience side of the same problem.

Common mistakes

• Writing a ten-page document. Nobody reads it. Two pages, plain language.
• Banning AI outright. It does not work and you lose the productivity gains. People use it anyway, just out of sight.
• Leaving out contractors and freelancers. They often handle your most sensitive material.
• Ignoring AI built into existing tools. Note-takers, email assistants, and CRM features count.
• No named owner. A policy without an owner is a suggestion.
• Never testing it. Walk through two or three realistic scenarios with the team to see where the rules are unclear.

FAQ

Do I need an AI policy if I am a solo founder? You do not need a formal document, but a one-page set of personal rules helps, especially if you handle client data. It also makes it easy to hand over when you hire your first person.

Can employees use free AI tools for work? You can allow it for low-risk tasks using public information, but prohibit entering any confidential or personal data. Business plans generally offer stronger privacy options.

Does an AI policy protect me legally? It is not a shield, but it shows you took reasonable steps and gives you a basis for enforcing expectations. For regulated industries, ask a lawyer to review it.

Should we disclose AI use to customers? It depends on your contracts, your industry, and what the customer expects. Be honest when asked, follow any contract terms, and do not pass off AI work as human when it matters.

What about AI note takers in meetings? Treat them as a recording tool. Check consent laws where you operate, tell participants, and be careful in client or confidential meetings.

How often should we update the policy? Every six months at minimum, and after any major change in tools or incidents.

Is this legal advice? No. It is general guidance for small businesses. Have counsel review your final policy if you operate in a regulated field or handle sensitive data.

Related Coverage

• AI Small Business Hiring Guide: how AI changes who you hire and how
• Colorado AI Law Compliance: a concrete look at where AI regulation is heading
• SaaS AI Risk Audit: find the AI already living in your software stack

Faceted Media Magazine covers business, AI, and entrepreneurship for the people building what’s next.