Resources / Free guide
A simple AI use policy for your team
One page your people will actually read, and a sample you can adapt
4 min read
Most small businesses fall into one of two camps. Either they've banned AI and their staff use it anyway on their phones, or they've said "go for it" and have no idea what's being pasted where.
Neither works. A one-page policy is the middle ground, and it takes about an hour to write.
Why bother
- Your people are already using it. SHRM calls this "shadow AI": unapproved tools, plus AI features quietly added to software you already pay for.
- You can still be on the hook. SHRM's September 2026 guidance is blunt: a policy doesn't remove your liability if an employee pastes client data into an unapproved tool. Training and consistent enforcement matter as much as the document.
- Fake reviews carry real fines. The FTC's rule banning fake reviews and testimonials, including AI-written ones, carries penalties of up to $53,088 per violation.
What a good policy covers
Drawing on SHRM and NIST's AI framework, a policy for a small team needs these pieces:
- Which tools are approved. Name them. Business accounts, with training turned off.
- What it's for. The jobs you want people using it on.
- What never goes in. The short list everyone memorizes.
- A person checks everything before it goes to a customer or goes public.
- Extra sign-off for high-stakes uses. Hiring decisions, legal, money, anything customer-facing.
- How to report a mistake, without getting punished for reporting it.
- A review date. The tools change every few months. So should the policy.
Sample policy
Copy this, change the bracketed parts, and cut anything that doesn't fit your business.
[Business name] AI use policy
Effective [date]. Next review [date six months out].
1. Why we have this
We use AI to save time on routine work. This policy keeps our customers' information and our reputation safe while we do it.
2. Approved tools
You may use these, signed in with your work account:
- [Claude / ChatGPT / Gemini / Microsoft Copilot]
- [Any AI features built into tools we already use, such as our email or CRM]
Not approved: personal AI accounts for work tasks, browser extensions, and third-party AI apps not on this list. Ask [name] before trying a new one.
3. Good uses
- First drafts of emails, posts and documents
- Summarizing long documents and meeting notes
- Brainstorming, outlines and checklists
- [Your specific jobs, such as quotes, proposals or scheduling]
4. Never put these into any AI tool
- Social Security, driver's license or other ID numbers
- Full bank, card or account numbers
- Passwords, PINs or login codes
- Customer health information or medical records
- Other employees' personnel or pay information
- Anything covered by a confidentiality agreement
- [Anything specific to your industry]
When in doubt, swap the details. Use "Client A" instead of the client's name.
5. A person reviews everything
AI makes mistakes and states them confidently. Before anything AI-assisted goes to a customer or the public, a person checks every name, number, date, price and claim.
6. Uses that need sign-off from [name]
- Anything to do with hiring, firing, pay or performance
- Legal, financial or contract language
- Advertising claims and customer-facing campaigns
7. Things we never do
- Post AI-written reviews or testimonials, or invent customers
- Present AI-generated work as a customer's words or experience
- Use AI to make a final decision about a person
8. If something goes wrong
If you pasted something you shouldn't have, or AI-assisted work went out with a mistake, tell [name] the same day. You won't be in trouble for reporting it. Hiding it is what makes it a problem.
9. Acknowledgment
I've read this policy and I'll follow it.
Name: ____________ Date: ____________
How to roll it out
- Walk through it in a team meeting. Fifteen minutes. Ask what they're already using. You'll learn something.
- Set up the business accounts first, with training turned off, before you ban personal ones.
- Get signatures and keep them on file.
- Put the review date on your calendar. Six months is about right for now.
What we're still not sure about
Florida lawmakers tried twice in 2026 to pass an AI bill covering chatbots, minors and AI disclosure. Both versions died in the House, and nothing currently on the books governs how small private employers use AI. That could change in the next session, so check before you rely on this page.
We're not lawyers, and this sample isn't legal advice. Have an employment attorney review your final version, especially sections 6 and 7.
Checked against SHRM, NIST, the FTC's fake reviews rule and Florida legislative reporting, October 2026.
Want it as an editable template? The AI Use Policy Template
Want your whole team set up, with a written policy built for your business? AI training for your team, on-site or remote
Want the policy rolled out with training?
Hands-on AI training built around your business, at your office or on Zoom, with a written policy your team will follow.