AI Acceptable Use Policy for a Small Business: What to Include

What an AI acceptable use policy is

An AI acceptable use policy is a short written set of rules for using AI tools at work: chat assistants, writing and meeting-note tools, and the AI features now built into email, office and accounting software. It answers five questions: which tools are allowed, what information must stay out of them, who checks the output, when AI use must be disclosed, and what to do when something goes wrong.

It does not need legal language or many pages. One or two pages that people actually read do more than a long document nobody opens. This guide is general information, not legal advice; if you work in a regulated field, have a lawyer review your final version.

Why a small business needs an AI policy now

In most small businesses, staff already use AI informally: one person drafts emails with it, another summarizes notes, a third writes social posts. Without shared rules, the same risks repeat:

Private data in the wrong place. Depending on the tool and its terms, what someone types into a consumer AI service may be stored, reviewed or used to improve the service.
Wrong output sent as fact. AI tools can produce confident text that contains invented details, wrong figures or the wrong tone.
Personal accounts for business work. When someone leaves, the business cannot see or remove what was done in their personal account.
Unclear answers to customers who ask whether a person or an AI wrote what they received.

A written policy turns individual habits into shared rules, and it protects employees too: people use AI with more confidence when they know where the lines are.

What to include in an AI acceptable use policy

Approved tools. Name each tool, what it may be used for and who approved it. Anything not on the list needs approval before use with company work.
Data that must never be entered. A plain list, with examples (see the next section).
Human review. AI output is a draft. The person who uses it is responsible for checking facts, figures, names and tone.
Disclosure. When staff must tell a manager, customer or client that AI was used.
Accounts and passwords. Work happens in business accounts the company controls; passwords and access codes never go into an AI tool.
Records. What is kept: the approved tool list, final versions of important work, and a note where AI was used on it.
Incidents. What to do, and whom to tell, when private data was entered by mistake or wrong AI output went out.
Training. A short walkthrough when the policy starts, for each new hire, and whenever tools or rules change.
Owner and review date. One named person keeps the tool list current, answers questions and reviews the policy on a set date.

Data that must never go into an AI tool

Spell this out with examples. "Sensitive data" means different things to different people; a list does not. Unless the owner has approved a specific tool for that specific data, never enter:

Customer names with contact details, account numbers or order history.
Employee records: pay, health information, reviews, disciplinary notes.
Passwords, access codes, security answers and API keys.
Card numbers, bank details and tax records.
Contracts, pricing plans and other confidential business information.
Files, emails or notes that a client or vendor shared in confidence.

If your business handles health, financial, legal or children's information, specific laws may limit where that data can go. Treat those categories as off-limits to AI tools until someone has checked the rules that apply to you.

Five rules everyone can remember

Use only approved AI tools for work. Want to try a new one? Ask first.
Leave private data out. When in doubt, remove names, numbers and identifying details.
Treat output as a draft. Check it before you send, post, file or rely on it.
Keep work in business accounts. Not in personal AI accounts.
Report problems right away. A quick report lets the business fix a mistake; a hidden one grows.

Sample AI acceptable use policy outline

Copy this outline and fill in your own tools, names and examples:

Purpose. We use AI tools to save time and support good work. This policy explains how to use them safely.
Approved tools. Only tools on the approved list may be used for company work. The list says what each tool may be used for.
Information that must not be entered. Customer data, employee records, financial details, passwords and confidential business or client material, unless a tool has been approved for that data.
Human review. A person reviews all AI output before it is used and is responsible for its accuracy.
Disclosure. Employees disclose AI use when a manager asks, when the business requires it, or when a customer would reasonably expect to know.
Accounts. Use business accounts. Never enter passwords or login codes into an AI tool.
Records. The business keeps the approved tool list. Employees note AI use on important or customer-facing work.
Incidents. Report mistakes, data entered by accident or unapproved use to [name] as soon as possible.
Training. Everyone receives a short briefing on this policy and on each tool they use.
Owner and updates. [Name] owns this policy and reviews it every [period] or when tools change.

How to roll out the policy

Ask how AI is already used. Which tools, for which tasks, and whether any customer or business data was involved. Make it safe to answer honestly.
Pick the approved tools. Keep the first list short. Prefer business plans with admin controls and clear data terms.
Write the policy with your own examples: your invoices, client notes, schedules and marketing drafts.
Walk the team through it, mainly the data list and the review rule, and take questions.
Hand out a one-page summary with the five rules and the owner's name.
Review it on the set date, and whenever you add a tool, change how customer data is handled, or keep getting the same question.

Where ASL fits

A policy is easier to follow when the software enforces part of it. ASL AI Hub is built for small teams that share AI accounts and need budgets, approvals and a record of who ran what.

Administrators set which providers, tasks and modes are allowed, budgets, retention, and whether high-risk work needs a named approver; separate roles keep writing policy apart from auditing and approving. Provider keys are stored encrypted and never returned to the browser or phone, and every run returns a signed receipt.

If your rules need to live inside your own workflow, ASL's custom software development work builds tools with explicit permissions, and for AI features the plan states who reviews the output and what happens when it is wrong.

Frequently asked questions

Does a small business need an AI policy?

If anyone uses AI tools for work, yes. A one- or two-page policy that names approved tools, lists data that must never be entered and requires human review prevents the most common mistakes.

What should an AI acceptable use policy include?

Approved tools and their uses, data that must never be entered, human review of output, when to disclose AI use, business accounts and passwords, records, incident reporting, training, and a named owner with a review date.

Can employees use free AI chat tools for work?

Only if the business approves them for specific tasks after reading their data terms. Business plans usually give more control over retention and training use. Never put private data into a tool that has not been approved for it.

Should we tell customers when we use AI?

Disclose when AI shapes what a customer receives and they would reasonably assume a person did the work, or when a law or industry rule requires it. Say so plainly and keep a person responsible for the result.

Is a sample AI policy legal advice?

No. A sample outline is a starting point. Adapt it to your tools and data, and have a lawyer review it if you work with health, financial, legal or children's information.

Related guides

Explore the complete product

Read features, current access and limitations

AI Acceptable Use Policy for a Small Business: What to Include, With a Sample Outline