The short answer
An AI policy for a small business should fit on one page and answer six questions: which tools staff can use, what they can put in, what they can't, who checks the result, when to tell customers, and who to ask. The free template below covers all six. Copy it and change the parts in brackets.
Why you need one, even if you're small
Your staff are probably using AI already, some of them on free personal accounts. An AI policy isn't about stopping that. It tells people what's fine, what isn't, and who to ask, so they can use the tools without worrying and without putting customer data at risk.
Keep it to one page. Long policies don't get read.
What to put in it
A useful policy answers six questions:
- Which tools can we use? Name them. "ChatGPT Business via the company account" is clear. "Approved AI tools" isn't.
- What can we put in? And just as important, what we can't.
- Who checks the result? A person is responsible for what goes out, not the AI.
- When do we tell people AI was used? For most internal work, never. For some customer work, maybe.
- Who do I ask? One named person.
- When do we review this? AI tools change fast. Every six months is about right.
The template
Copy this, change the parts in brackets, and remove what doesn't fit.
1. Tools we use
We use [Claude Team / ChatGPT Business] through the company account. Don't use personal or free AI accounts for work. If you want to try another tool for work, ask [name] first.
2. What you can put in
You can use AI for drafts, summaries, translations, ideas and checking text. You can put in our own documents, like price lists, routines and templates.
3. What you can't put in
- Passwords, bank details or ID numbers
- Health information, or other sensitive information about people
- Customer names and contact details, unless the task needs them
- Information we've promised to keep confidential, like a client's plans or a tender
When in doubt, remove names and details first, or ask.
4. You check everything
AI can be wrong and sound confident about it. You are responsible for anything you send, publish or decide, just as if you'd written it yourself. Check facts, numbers, names and dates.
5. Being open about it
We don't need to label internal notes or drafts. If a customer asks whether we used AI, we answer honestly. We don't publish customer reviews, images of real people or quotes written by AI as if they were real.
6. Review
We look at this policy again in [month, year].
Tips for rolling it out
- Go through it at a team meeting. Ten minutes, with room for questions, beats an email nobody opens.
- Give examples. "Pasting in a customer's complaint to get help with a reply: fine, but remove their name and address."
- Pair it with the right tools. A policy that says "use the company account" only works if there is a company account. See Claude Team or ChatGPT Team.
- Link it to privacy. If you want the background on GDPR and data, read Is it safe to put company data into ChatGPT?
Does the law require one?
Not by name for most small businesses. But GDPR expects you to protect personal data, and the EU AI Act expects staff who use AI at work to know enough to use it sensibly. A one-page policy and a short session with the team is a simple way to show you've done both.
Questions people ask
Does a small business need an AI policy?
It's not required by name, but it's the simplest way to protect customer data and show staff know how to use AI sensibly, which GDPR and the EU AI Act both expect.
What should an AI policy include?
Which tools are allowed, what can and can't be put in, who is responsible for checking, when to be open about AI use, who to ask, and when the policy is reviewed.
How often should we update our AI policy?
Every six months, or when you start using a new tool. AI tools change fast, and an outdated policy gets ignored.
Want help writing yours?
An AI policy fitted to your business is part of the AI workflow audit. We agree on the tools and rules together, and you get the finished page to hand out.
Want help with this?
This is what I do for small businesses. See The AI workflow audit, or start with the 90-minute audit.