AI Acceptable Use Policy For Small Businesses: A Free Template And Examples

An AI acceptable use policy is a short set of rules that tells your team which AI tools they may use at work, what information they may put into those tools, who checks the results, and what to do when something goes wrong. For a small business, it can fit on two pages.

Most teams already use AI, with or without permission. In Microsoft and LinkedIn's 2024 survey of 31,000 people in 31 countries, 75% of knowledge workers said they used AI at work, and 78% of those users brought their own AI tools (Microsoft (opens in a new tab)). Rules have not kept up. ISACA's 2026 poll of more than 3,400 digital trust professionals found that only 38% of organizations have a formal, comprehensive AI policy, and 25% have none at all (ISACA (opens in a new tab)).

This guide gives you everything needed to write an AI acceptable use policy in about a week: what to include, a free template you can copy, examples of clear and unclear rules, a worked example and a rollout plan. It is written for owners and managers of businesses with roughly 5 to 200 people, and it assumes no legal or technical background. It is not legal advice, so have a lawyer review the final version, especially if you handle health, financial or children's data.

What Is An AI Acceptable Use Policy?

An AI acceptable use policy is a workplace document that sets the rules for using artificial intelligence tools at work. It lists the approved tools, sorts information into what may and may not be shared with AI, requires a person to check AI output before it is used, and explains how to report mistakes.

You may also see it called an AI policy for employees, an AI use policy, a generative AI policy or an artificial intelligence acceptable use policy. The names differ, but the job is the same.

"AI" here means any tool that writes, summarizes, translates, creates images or audio, analyzes data or takes actions on your behalf. That includes chatbots such as ChatGPT, Claude and Gemini, writing assistants, meeting note-takers, AI features added to software you already pay for, and AI agents that can send emails or update records.

Three documents are easy to mix up. Table 1 shows how they differ.

A small business usually needs the first one now. You can add AI rules as a new section of an existing IT policy, but a separate AI acceptable use policy is easier to find, update and train people on. A full governance policy becomes useful once you start building or buying AI systems that make or support decisions.

Why Small Businesses Need An AI Acceptable Use Policy Now

The US Census Bureau found that 19.8% of US businesses used AI as of May 2026. Use was highest among larger firms, reaching 37% of firms with 250 or more employees, and it rose among firms with 20 or more employees between December 2025 and May 2026 (US Census Bureau (opens in a new tab)). Without a policy, each person decides alone what is safe, and most will not know how the tool treats what they type.

Three risks come up again and again.

1. Confidential Data Leaves The Business

Anything typed into an AI tool is sent to the company that runs it. Depending on the plan, that company may keep it and use it to train future models. In 2023, Samsung temporarily restricted generative AI on company computers after Bloomberg reported that staff had uploaded sensitive code to ChatGPT, and the company warned workers not to enter personal or company information into such services (CNBC (opens in a new tab)). The same mistake is easy to make with a client contract, a staff list or a customer spreadsheet.

2. Wrong Answers Reach Clients

AI tools can produce confident text that is false. In June 2023, a US federal judge in New York fined two lawyers and their firm $5,000 after they filed a court brief citing judicial opinions that ChatGPT had made up, complete with fake quotes (Mata v. Avianca (opens in a new tab)). The tool was not the problem. The lack of a check before the work left the office was. Our guide to shipping RAG that doesn't hallucinate explains why these errors happen.

3. Nobody Knows What Is Allowed

When there are no rules, careful staff avoid useful tools and careless ones use anything. Using AI tools without the business knowing is often called shadow AI. ISACA's 2025 poll found that 81% of respondents believed people in their organization used AI whether or not it was permitted (ISACA 2025 (opens in a new tab)). A policy gives people a clear yes for low-risk uses, which makes the risky ones easier to spot and stop.

A policy also prepares you for rules that already apply in some places. If your business operates in the European Union, the EU AI Act asks businesses that use AI systems to take measures to support AI literacy among their staff. A July 2026 amendment softened the wording, but the duty still applies (EUR-Lex (opens in a new tab)). If you hire in New York City, using an automated tool to screen candidates requires a bias audit within the past year and notice to candidates (NYC DCWP (opens in a new tab)). Your policy is where these rules turn into everyday instructions.

What To Include In An AI Acceptable Use Policy

A useful AI acceptable use policy answers the questions staff actually face: can I use this tool, can I paste this, who checks it, and what if I get it wrong. These eight sections cover them. Each section below explains what to decide, and the template later in this guide turns those decisions into wording you can copy.

1. Scope: Who And What It Covers

Say that the policy applies to employees, contractors and interns, on company and personal devices used for work. Define AI broadly, so that a new feature inside an existing app counts. Email, document and design software increasingly has AI built in, and staff may not see it as "using AI" at all.

2. Approved, Limited And Banned Tools

Put every AI tool in one of three groups. Approved tools may be used for most work, through a company account. Limited tools may be used only with public information, for example a free image generator. Not allowed covers everything else, including browser extensions that read every page you visit. Keep the list in one place, such as a shared spreadsheet, and give people a simple way to request a new tool.

Approve the account, not just the brand. The same product can treat your data very differently depending on the plan, which the section on choosing tools below explains.

3. Data Rules: What Can Go Into An AI Tool

This is the most important section of any AI acceptable use policy. A three-color system is easy to remember: green for public information, amber for internal information, and red for confidential or personal information. Figure 2 shows what each color includes and where it may go.

Name real examples from your own business in each color, because staff remember "our client price list is red" far better than "commercially sensitive information". The rule for anything unclear is to treat it as red and ask. Customer interviews, survey answers and support transcripts are a common case, and our guide to customer research with AI covers consent and retention for that kind of material.

4. Human Review Of AI Output

State that the person who uses AI is responsible for the result. Require a named person to check facts, figures, names, quotes, citations and code before AI output goes to a client, gets published or is used in a decision. Decisions about people, such as hiring, pay, credit or whether someone gets a service, should never be made by AI alone. Our guide to human-in-the-loop design shows how to set up review steps that people actually follow.

5. Being Open About AI Use

Decide when staff must say that AI was used. A simple rule is to tell a client when AI produced a substantial part of their work, if the contract or the client asks for it, and never to present unreviewed AI output as a person's expert opinion. Ban the use of AI to imitate a real person's voice, face or writing without their permission. Our guide to building your brand with AI covers how disclosure affects customer trust.

6. Ownership And Copyright

In the US, AI output can be protected by copyright only where a person has determined enough of its expressive content. The US Copyright Office concluded in January 2025 that writing prompts alone is not enough (US Copyright Office (opens in a new tab)). For your policy, that means two rules: add real human work to anything where ownership matters, such as a logo or a book, and never ask AI to copy another creator's protected work.

7. AI Tools That Connect To Your Systems

Some AI tools do more than answer questions. They can read your inbox, open files, update customer records or send messages. Require approval before anyone connects an AI tool or agent to company systems, give it the least access it needs, and require a person to approve any action that sends money, deletes data or contacts a customer. Our guide to AI agent guardrails explains how to set these limits.

8. Reporting Mistakes And Breaking The Rules

Tell staff what to do if they paste red data by mistake or AI output causes an error: report it to the policy owner the same day, and keep the conversation so it can be checked. Say that reporting quickly will not be punished, because people hide mistakes they expect to be blamed for. Then say what happens when someone breaks the policy on purpose, using your usual disciplinary process.

How To Choose Which AI Tools To Approve

The same AI product can treat your data very differently depending on the plan. Business plans are usually kept out of model training by default, while individual plans may use what you type unless someone changes a setting. That is why an AI acceptable use policy should approve a specific plan and account, not just a product name. Table 2 shows how two widely used providers describe it.

Before you approve any AI tool, get written answers to six questions:

1. 1

   Does the provider use our inputs or outputs to train its models, and can we switch that off for everyone?

2. 2

   How long does it keep what we type, and can we delete it?

3. 3

   Can an administrator create, manage and remove staff accounts?

4. 4

   Which other services does it connect to, and what can it read or change there?

5. 5

   Where is the data stored and processed, if that matters for your clients or your industry?

6. 6

   What does it cost per person, and what happens to our data if we stop paying?

If a provider will not answer these in writing, put the tool in the "not allowed" group. Our guide to choosing an AI vendor covers how to compare tools in more depth. If you plan to connect AI to your own systems and data, SensViz's guide to what businesses need before generative AI integration (opens in a new tab) explains the groundwork.

AI Acceptable Use Policy Template

Copy the template below into your own document and replace everything in square brackets. It is written in plain language on purpose, because a policy only works if people read it. Delete any section that does not apply to you, and keep the rest short.

AI Acceptable Use Policy Examples

The difference between a policy that works and one that is ignored is usually how specific it is. Table 3 compares common vague rules with clearer versions of the same rule.

Figure 3 turns the policy into five questions staff can answer before each task. You can print it or pin it in your team chat.

Here is how the policy answers three everyday situations.

Example 1: Rewriting A Client Email

A team member wants AI to make a reply to a client sound friendlier. The email contains the client's name and an invoice amount, which is amber or red depending on your rules. Under the template, they may use an approved tool through the company account, or remove the name and amount first. They read the result before sending it.

Example 2: Summarizing A Supplier Contract

A manager wants a quick summary of a 30-page contract. A contract is red information. Unless the policy owner has approved a specific tool for contracts in writing, the answer is no. If contracts are summarized often, that is a good reason to approve a business plan with suitable terms, rather than to let people use free tools.

Example 3: Drafting A Blog Post

A marketer uses AI to draft a post about a public topic. The input is green, so any approved or limited tool is fine. A person checks every fact and statistic before publishing, adds their own experience, and follows your rule on whether to say AI helped.

A Worked Example: A 25-Person Agency Writes Its Policy (Illustrative)

This example is hypothetical. It shows how the steps fit together, not the result of a real client project.

A 25-person marketing agency has no AI rules. The owner asks every team member which AI tools they use, promising no one will be in trouble for answering honestly. The answers list nine tools, mostly on free personal accounts, including two browser extensions and a meeting recorder that joins client calls.

The owner and one account director spend an afternoon sorting the agency's information into green, amber and red. Client briefs and campaign results become amber. Client contracts, payroll and anything containing customer lists from clients become red.

They approve one business AI plan for writing and research, keep a free image generator as a limited tool for public material only, and move the extensions and the meeting recorder to "not allowed" until they have read the terms. They then adapt the template above, cutting it to two pages.

In a 30-minute team meeting, the owner walks through the five questions in Figure 3 and the three examples, and everyone signs the acknowledgment. Three months later, the first review adds one new approved tool and one new red category: client data that a new contract labels confidential.

How To Write And Roll Out Your Policy In One Week

A small business can write an AI acceptable use policy and put it into practice in about a week, alongside normal work. The steps below assume one owner who can make decisions and one person who knows how the team works day to day.

1. 1

   Day 1: Find out what is already in use. Ask everyone which AI tools they use and what for, and promise that honest answers will not be punished. Include AI features inside existing software, browser extensions and meeting recorders.

2. 2

   Day 2: Sort your information. List the information your business handles and put each type into green, amber or red. Use your own examples, such as "client price lists are red".

3. 3

   Day 3: Decide on tools. Check the terms of each tool from day 1 using the six questions above. Approve a small number, ideally on business plans, and set up company accounts. Trial any tool you plan to pay for on past work first, as our AI proof of concept guide explains.

4. 4

   Day 4: Write the policy. Adapt the template, name a policy owner, and ask one or two staff members to read it and point out anything unclear. Have a lawyer review it if you handle sensitive data.

5. 5

   Day 5: Train and sign. Walk the team through the policy in a short meeting, using Figure 3 and the examples, and collect signed acknowledgments. Share the approved tools list where everyone can find it.

If you want to go further and find where AI could actually help the business, our AI readiness assessment guide takes the day 1 inventory and turns it into a list of first projects.

Keeping Your AI Acceptable Use Policy Current

AI tools and their terms change often, so set a review date when you publish the policy. Every six months is a sensible default, with an earlier review whenever one of these happens:

• You adopt a new kind of AI tool, such as an agent that can act in your systems.

• A provider changes how it uses or stores your data.

• A law or a client contract adds new requirements.

• An incident happens, even a small one.

For a fuller structure as you grow, the US National Institute of Standards and Technology publishes the AI Risk Management Framework. It is voluntary, free and, in NIST's words, meant for organizations "in any sector and any size" (NIST (opens in a new tab)). Its four functions, govern, map, measure and manage, are a useful checklist once you move from using AI tools to building AI into your own processes.

Common AI Policy Mistakes

• Banning AI completely. People keep using it on personal accounts, where you have the least control. A clear yes for low-risk uses works better.

• Copying an enterprise policy. Twenty pages of legal language is unlikely to be read. Two clear pages are.

• Approving a product, not a plan. A free personal account and a business account of the same tool can treat data very differently.

• Leaving out AI inside existing software. Email, document and design tools now include AI features that staff may not think of as AI.

• No owner and no review date. A policy without a named owner goes out of date within months.

• Punishing honest mistakes. If reporting a slip leads to blame, the next one will be hidden.

How Fossilite Approaches AI Policy

We build AI tools and automations for growing businesses, so we see what happens when AI arrives before the rules do. Our approach starts with how the work is done today: which tasks people already use AI for, what information those tasks involve, and where a mistake would be costly. We then help set the rules for tools and data before recommending any new AI system, and we suggest custom software or AI only where it is justified. If a simple policy and an approved business plan solve the problem, that is the right answer. Where AI will be built into a workflow, we design the review steps alongside it, as described in our guide to automating the busywork.

When To Get Outside Help

Most small businesses can write their own AI acceptable use policy with the template above. Outside help is worth considering when you handle regulated data such as health or financial records, when clients require specific AI terms in their contracts, or when you plan to connect AI tools to core systems. Ask a lawyer to review the policy itself, and choose any technical adviser the way our guide to choosing an AI consulting partner describes.

Frequently Asked Questions

These are the questions business owners ask most often about an AI acceptable use policy. Each answer stands on its own.

What Should An AI Acceptable Use Policy Include?

An AI acceptable use policy should include its scope, a list of approved, limited and banned tools, rules for which data may go into AI, a requirement for a person to check AI output, rules on disclosure and copyright, limits on AI connected to company systems, training, how to report mistakes, and a review date.

Do Small Businesses Need An AI Policy?

Yes, if anyone in the business uses AI tools, which is likely even without permission. A short AI acceptable use policy protects client and company data, reduces the chance of AI errors reaching customers, and gives staff a clear answer about what is allowed. It does not need to be long to work.

Is There A Free AI Acceptable Use Policy Template?

Yes. The template in this guide is free to copy and adapt. Replace the text in square brackets with your company's details, tools and rules, delete sections that do not apply, and keep the result short. Have a lawyer review it before you adopt it, especially if you handle sensitive or regulated data.

Should We Ban ChatGPT At Work?

A complete ban is rarely the best option for a small business, because people tend to keep using AI on personal accounts where you have no control. A safer approach is to approve a business plan with suitable data terms, limit what information can go into it, and require a person to check the output.

What Information Should Employees Never Put Into AI Tools?

Employees should not put confidential or personal information into AI tools unless the company has approved that tool and use in writing. That includes client files, contracts, personal details of customers or staff, financial records, health information, passwords and source code. When unsure, treat information as confidential and ask the policy owner.

Who Should Own The AI Policy In A Small Business?

One named person should own the AI policy, usually the owner, an operations manager or whoever looks after IT. They keep the approved tools list, answer questions, approve exceptions, handle reported mistakes and run the review every six months. Without a named owner, an AI policy quickly goes out of date.

How Often Should An AI Acceptable Use Policy Be Updated?

Review an AI acceptable use policy at least every six months, and sooner when you adopt a new kind of AI tool, a provider changes its data terms, a law or client contract adds requirements, or an incident happens. Update the approved tools list whenever a tool is added or removed.

Once your policy is in place, our AI readiness assessment guide is the next step for deciding where AI could help your business, and our guide to choosing an AI vendor helps when you are ready to buy.