Small Business AI Policy: A Practical Employee Template
A small business AI policy tells employees which tools they may use, what information they may share and who checks the results. It should also explain how to report a mistake. A short policy with named owners is easier to apply than a document nobody understands.
What should a small business AI policy cover?
Cover six decisions: approved tools, permitted tasks, restricted data, human review, responsibility and incident handling. Include contractors who work with business information. The policy belongs alongside the operating processes in your small business management guide.
In the 2024 Microsoft and LinkedIn Work Trend Index, 80% of AI users at small and medium-sized companies brought their own AI tools to work. That figure concerns surveyed AI users, not every employee. Written rules make those individual choices visible.
Map actual work before writing restrictions
Ask staff to list the tools they already use, the tasks involved and the information entered. Include AI features inside familiar software, such as meeting summaries or suggested email replies. Buying a business subscription does not automatically approve every connected feature.
For each proposed use, record the tool and account type, purpose, allowed information, reviewer and approval date. A small business AI policy needs this supporting register because products, settings and permissions change more often than the policy itself.
Separate drafting from actions
Drafting a public product description is different from sending it to customers. Summarizing an approved document is different from changing a customer record. Give tools only the access required for the approved task, with human approval before consequential actions.
Check the account, not just the brand
Before approval, inspect the provider’s current retention, training-use, sharing, access and deletion terms for the exact plan. Check integrations separately. Removing a customer’s name may still leave identifiable details in an address, order history or unusual complaint.
Small business AI policy template for employees
The following is an original working template. Replace the bracketed fields, remove irrelevant provisions and check any sector-specific or contractual obligations before adopting it. It is an operational starting point, not a statement that your business meets every applicable law.
1. Purpose and ownership
“Our small business AI policy applies to employees and contractors using AI for company work. [Owner/role] maintains the policy and approved-tool register. The effective date is [date], and the next scheduled review is [date]. Questions go to [internal contact].”
2. Approved tools and accounts
“Use only the tools, account types and features listed in the register. Company work must use an approved company-managed account. Request approval before starting a trial, connecting an integration, installing an AI browser extension or enabling a feature that accesses business files.”
3. Permitted tasks
“Approved uses are [list specific tasks]. Examples may include drafting from public product specifications or organizing non-confidential notes. Approval is limited to the listed purpose and data. It does not permit the tool to publish, send messages, change records or make purchases.”
4. Restricted information
“Do not enter passwords, access tokens, payment-card details or government identification numbers. Do not upload customer records, employee records, confidential contracts or commercially sensitive material unless the exact use and system have separate written approval. If uncertain, stop and ask [owner].”
5. Human review and prohibited outputs
“The employee using AI remains responsible for checking its output against reliable source material. Check facts, calculations, promises, pricing and confidential details before use. Do not fabricate reviews, customer quotes, qualifications or results. AI output must not independently determine hiring, dismissal, credit or other high-impact decisions.”
6. Errors and incident reporting
“Report suspected disclosure, unexpected tool actions or harmful output to [contact] immediately. Stop the affected workflow and preserve relevant details securely. Do not paste exposed information into another tool while seeking help. [Owner] coordinates containment, provider contact and any required notifications.”
7. Training and acknowledgment
“Staff must complete the example-based briefing before using approved tools and acknowledge this small business AI policy. Exceptions require written approval specifying the task, data, safeguards and expiry date. Policy changes are communicated through [channel], with further training when responsibilities change.”
Put the template through a real task
Consider this illustrative example: a six-person repair company wants help drafting appointment reminders. An employee proposes uploading the booking spreadsheet, including names, addresses and notes about access to customers’ homes. The purpose sounds routine; the proposed data transfer deserves separate scrutiny.
Under the sample small business AI policy, the owner approves a generic reminder drafted from fictional details. Customer information stays in the existing booking system. Staff review the wording, and the booking system inserts the correct appointment information through its established process.
Give the reviewer a concrete checklist
The reviewer checks the service date, arrival window, cancellation terms and contact details against the company’s records. This review becomes part of the task’s standard operating procedure. “Check the AI” is too vague to train a new employee.
Practice one incident
During onboarding, present a fictional accidental upload and ask staff whom they would contact. Confirm that the named person has the access needed to respond. The small business AI policy should support your broader cybersecurity procedures, including account access and incident records.
Review the policy when work changes
Review it after a new integration, changed provider terms, an incident or a new category of customer information. A scheduled quarterly check is a practical starting point, not a universal legal deadline. Record what changed and who approved it.
The NIST AI Risk Management Framework offers a voluntary structure for managing AI risks. It can help organize a review, but using it does not certify a business or make a template legally compliant.
What should the owner monitor?
Track approved uses, exceptions, reported mistakes and the time spent checking outputs. Review whether the process still improves the task. Australia’s business.gov.au guidance on responsible AI use also emphasizes accountability, staff guidance and ongoing monitoring; local obligations still need their own assessment.
Does a very small team need a separate policy?
If staff or contractors use AI for business work, a small business AI policy gives them one shared set of decisions. A two-person firm may need only a short policy and tool register. The useful test is whether both people can explain what is allowed and who checks it.
Does the policy need to ban personal tools entirely?
The sample policy requires approved company-managed accounts so access and settings can be controlled. A business choosing exceptions should document their limits explicitly. An employee’s private subscription should never be treated as approved simply because the employee pays for it.
