A Simple AI Acceptable Use Policy Template for Small Businesses

If your business employs between 10 and 250 people, your team is already using artificial intelligence. They are pasting customer emails into ChatGPT to draft polite replies, asking Claude to tidy up spreadsheet formulas, and using web extensions to transcribe client calls.

Most of this happens under the radar. Staff do not hide it out of malice; they hide it because they have work to do and these tools save them an hour a day. The common executive response swings between two extremes: ignore it entirely and hope nothing leaks, or download a 40-page corporate governance framework written for an investment bank that bans everything and guarantees staff will simply use their personal phones instead.

Neither approach works. What a growing company needs is a practical, plain-English acceptable use policy. It should fit on two pages, protect your commercial interests, and give your team clear guardrails so they can work efficiently without putting the business at risk.

Why Traditional IT Policies Fall Short for AI

Most IT acceptable use policies were written to stop people downloading malware or browsing inappropriate websites during working hours. Generative AI presents a fundamentally different challenge: staff are actively pushing company data outside your network to get answers back.

The risks you face are rarely apocalyptic. You are unlikely to be brought down by a rogue autonomous agent tomorrow. The real risks are mundane, immediate, and expensive:

• Confidentiality breaches: An employee pastes an unannounced restructuring plan, a customer dispute, or proprietary financial records into a consumer-grade tool that uses prompts for training.
• Hallucinations presented as fact: A junior team member relies on an AI tool to summarize a contract or generate statutory figures, misses an error, and sends it directly to a client.
• Copyright and licensing issues: Using code, graphics, or commercial copy generated by tools with unclear licensing or terms that assign rights away from your business.
• Shadow IT proliferation: Department heads subscribing to untested AI web apps on company credit cards, scattering customer records across dozens of unvetted software vendors.

A good policy does not stop staff from being productive. It replaces anxiety and guesswork with explicit boundaries.

The Core Principles of an SMB AI Policy

Before pasting words into a document, your leadership team needs to agree on four fundamental rules. These apply regardless of whether you are an engineering firm, an accountancy practice, or a logistics operator.

First, human accountability is absolute. The employee whose name is on the email, report, or code review carries full responsibility for its accuracy. Blaming an algorithm is not an acceptable defence inside your business, nor will your clients accept it.

Second, context determines safety. Drafting an outline for an internal training deck carries minimal risk. Pasting personal identification data, payroll spreadsheets, or commercially sensitive contracts into a public tool carries severe risk.

Third, business data belongs inside business systems. If a tool cannot provide commercial data protection - meaning the vendor contractually guarantees your inputs are not used to train their models and are isolated to your tenant - it cannot be used with sensitive business data.

Fourth, disclosure must be standard. Team members must feel safe admitting they used an AI tool. If you penalize disclosure, you drive usage underground, which makes quality control impossible.

The AI Acceptable Use Policy Template

You can adapt the following text directly for your employee handbook. Keep it brief. If staff need a law degree to understand your policy, they will ignore it.

---

### Policy Statement: Generative AI Use

1. Purpose and Scope This policy applies to all employees, contractors, and temporary staff at [Company Name]. It governs the use of all artificial intelligence systems, tools, and services (including, but not limited to, large language models, image generators, automated transcription tools, and coding assistants) used for business purposes or on company hardware.

2. Approved Tools Staff may only process company information using tools formally approved by management. - Tier 1 (Enterprise-Secured): Tools covered under our enterprise commercial agreements (e.g., Microsoft Copilot within our Microsoft 365 tenant). These tools offer commercial data protection and may be used with internal business data, subject to Section 3. - Tier 2 (Consumer or Free AI): Public platforms (e.g., free ChatGPT, public web tools). These may only be used for generic tasks involving publicly available information. - Prohibited Tools: Any browser extension, automated meeting bot, or tool not vetted by the IT team that captures audio, screen, or keystroke data.

3. Data Classification and Privacy You must never enter the following categories of information into any AI tool unless explicitly authorized and using a Tier 1 approved platform: - Personal Identifiable Information (PII) relating to clients, employees, or suppliers (names, contact details, financial records). - Commercially sensitive information, including pricing models, client proposals, unpublished financials, trade secrets, or legal advice. - Client-owned data that is governed by external Non-Disclosure Agreements (NDAs).

When in doubt, anonymize the text entirely before submitting it, or do not use the tool.

4. Quality Control and Human Oversight AI systems are prone to errors, fabrications ("hallucinations"), and bias. - You are personally responsible for verifying the factual accuracy, tone, and quality of any work you produce with AI assistance. - Never send AI-generated work directly to a client, partner, or public channel without thorough human review and editing. - AI must not be used as the sole decision-maker for hiring, performance evaluations, disciplinary issues, or credit decisions.

5. Copyright and Intellectual Property Outputs generated by AI may have uncertain legal status regarding intellectual property ownership. - Do not use AI to generate public-facing branding, logos, or core commercial deliverables without prior sign-off from your line manager. - If an output is substantially derived from an AI prompt, keep a record of the source and prompts used.

6. Breaches of this Policy Deliberate input of proprietary code, protected client data, or confidential records into unapproved public AI systems will be treated as an information security incident under our standard disciplinary procedure.

---

Evaluating Consumer AI Against Enterprise Tools

When implementing a policy like this, leaders quickly realize that the divide between consumer software and enterprise software matters more in AI than anywhere else.

Free or entry-level AI subscriptions often include clauses in their terms of service that allow the platform vendor to retain user inputs to train future models. If an employee submits an excerpt from an internal investigation, that text may become part of the vendor's underlying training data.

For companies standardizing on platforms like Microsoft 365, tools such as Microsoft Copilot operate under an entirely different security architecture. Copilot inherits the existing permissions, access controls, and compliance boundaries of your tenant. The data stays within your boundary; it is not used to train the base model, and staff only see information they already have permission to access in SharePoint or Exchange.

When evaluating your options, prioritize software that provides: - Commercial data protection in writing. - Strict tenant isolation. - Integration with your existing identity management (like Entra ID). - Compliance with UK/EU GDPR and industry regulations.

If you give your staff robust, enterprise-grade tools, compliance with your acceptable use policy becomes easy. If you deny them safe tools, they will continue using risky ones out of convenience.

Rolling Out the Policy

A policy announced by a company-wide email and filed in a shared drive changes nothing. To make it stick, take three practical steps over the next fortnight.

First, run an open, non-judgmental workshop. Show the team what safe usage looks like. Demonstrate how to anonymize text, how to spot subtle factual errors in generated content, and how to verify sources.

Second, clearly identify who can approve new tools. If a department head finds an AI tool that could transform their workflow, give them a simple one-page form to request a review rather than making them wait six months for an answer.

Finally, review the policy every six months. The capabilities of these platforms shift monthly. A policy that made sense last autumn may block valuable features today, or leave a newly invented data risk unaddressed.

Draft your policy, run the workshop, and establish clear operational boundaries. Your team will move faster, and you will sleep better.