AI usage policy for employees · free templateOne page of rules. Copy it, fill it in.

What a good AI policy covers

A good policy for a small business answers eight questions in plain words. If someone new can read it in five minutes and know what to do, it's working.

• Why it exists. One or two lines. People follow rules they understand.
• Which tools, which accounts. Name the approved tools and the plan. A policy that says "use AI responsibly" without naming a tool leaves people to pick their own, usually on a personal account. Our guide to whether ChatGPT is safe for business explains why the plan matters.
• What never goes in. A short, concrete list: customer personal data, passwords, financial account numbers, staff matters and confidential documents. Examples work better than categories.
• What always needs a person. Anything that goes outside the business, moves money, deletes something or carries legal weight. AI drafts; a named person approves.
• Checking before use. Whoever uses AI work owns it. Spell out what checking means: facts, figures, names, dates and tone.
• Being open. When to say AI helped, inside the team and with customers.
• What to do when something goes wrong. A no-blame way to report a slip the same day.
• Who to ask and when it's reviewed. A named person and a date in the calendar.

The AI usage policy template

Fill in everything in [brackets] and delete anything that doesn't apply to you. Keep the numbered sections in the same order, so people can find their way around it. Paste it into your handbook, a shared document or an email to the team.

[Company name] AI usage policy

Version [1.0] · Effective [date] · Policy owner: [name, role]

1. Why we have this policy
We want everyone here to use AI to save time on routine work. This policy keeps our customers, our team and our business safe while we do. It applies to everyone who works for or with [Company name], including part-time staff and contractors.

2. Approved AI tools and accounts
You may use these AI tools for work:
- [Tool and plan, e.g. ChatGPT Business] for [what, e.g. drafting, summaries, research]
- [Tool and plan] for [what]
Use only your own work account, signed in with your [company] email. Never use a personal AI account for company work, and never share a login.
Before you try any other AI tool, app or browser add-on for work, ask [name].

3. What never goes into an AI tool
Unless [name] has approved a tool for that exact use, never enter:
- Customer personal information, such as names with contact details, addresses, order or payment history and anything about health
- Passwords, login codes or security keys
- Bank, card or other financial account numbers
- Staff information, such as pay, performance, health or disciplinary matters
- Anything confidential: contracts, supplier pricing, legal matters or anything we've promised to keep private
- [Anything specific to your business or industry]
If you're not sure, leave it out and ask.

4. What always needs a person
AI can look things up, draft and suggest. A person decides. Get the OK from [named person or role] before AI-assisted work is used for:
- Anything sent to a customer, supplier or the public
- Money: payments, refunds, credits, discounts or prices
- Deleting or changing records in our systems
- Anything legal, HR or contract-related
- [Anything else, e.g. safety, medical or financial advice]
Any AI tool connected to our apps must be set up so these actions wait for a person's approval.

5. Check AI work before you use it
You are responsible for anything you send, publish or act on, whether or not AI helped. Before you use it:
- Check facts, figures, names and dates against the original source
- Check it follows our policies and sounds like us
- Never use made-up quotes, reviews, statistics or sources
If the AI can't show where an answer came from, treat it as a guess.

6. Be open about AI use
Tell your manager when AI did a significant part of a piece of work. If a customer asks whether AI was used, answer honestly. Don't present AI-written text as someone's personal advice or opinion. [Add any disclosure your industry or customers require.]

7. If something goes wrong
If you put something into an AI tool that you shouldn't have, or AI-assisted work went out with a mistake, tell [name] the same day. Reporting it quickly is always the right call, and you won't be blamed for doing so.

8. Who to ask
Questions about this policy or a particular tool: [name, email or chat channel].

9. Review
We review this policy every [6] months, and sooner if our tools or rules change. Next review: [date].

I have read this policy and will follow it.
Name: ____________________   Signature: ____________________   Date: __________

When we set up an AI assistant for a team, section 4 is built in rather than left to memory. The plan you sign lists what the assistant will do, who can ask for what and what always needs a person. Everyone has their own login and sees only what their role allows. Every request is saved. Nothing changes in your apps unless a person says yes.

How to roll it out in a week

1. Day 1: pick your tools and an owner. Decide which AI assistant the business will pay for, on a business plan, and who owns the policy. That's usually the owner or the office manager.
2. Day 2: fill in the template. Name the tools, the approvers and the person to ask. Add the information that's sensitive in your line of work.
3. Day 3: get it checked. Ask your lawyer, HR adviser or industry body to read it, especially if you handle health, financial, legal or children's information.
4. Day 4: set up the accounts. Give everyone their own work login. Ask people to stop using personal accounts for company work. Connect only the apps each team needs.
5. Day 5: walk the team through it. Twenty minutes, with real examples from your own work. "Can I paste this customer email in?" "Who approves this refund?" Then everyone signs.

Put a date in the calendar a month out. The first few weeks will turn up questions the policy didn't answer, so add the answers. A policy works best alongside hands-on practice, so pair it with training on your own apps and work. If people still aren't using AI after that, our guide on getting your team to actually use AI covers why.

Common mistakes

Banning AI outright

A ban doesn't stop people who already find AI useful. It moves their use onto personal accounts you can't see. Approving one tool and setting clear rules is safer, and you keep the time it saves.

Writing it like a contract

Twelve pages of legal language don't get read. Keep the policy to one or two pages of plain English, and keep the legal detail in your employment contracts and handbook.

Saying "use good judgment"

Everyone's judgment is different, and new staff don't know your business yet. Name the things that never go in and the actions that always need a person.

No named person

"Ask your manager" doesn't help when the manager doesn't know either. Name one person who can answer quickly and keep the list of approved tools current.

Rules on paper only

If an AI assistant connected to your apps can send emails or issue refunds by itself, a policy alone won't stop it. Set the tools up so the risky actions wait for a person's approval. Our guide to human in the loop shows how to sort tasks.

Set and forget

AI tools add features every few months. Review the policy on a date, and whenever you add a tool or connect a new app.

Common questions

Do small businesses need an AI usage policy?

Yes, if anyone uses AI for work. A small business usually has no IT team to catch a problem, so a short set of written rules does more of the work. It also gives new staff a clear answer on their first day.

Should we ban ChatGPT at work?

Usually not. A ban tends to move use onto personal accounts where you can't see it. Choosing one business plan, and writing down what never goes in and what needs a person, is safer and keeps the benefits.

Can employees use their personal ChatGPT for work?

Not with company information. A personal account belongs to the person, may use their chats for training unless they've switched it off and leaves with them when they go. Give them a work account on a business plan instead.

Is an AI acceptable use policy the same thing?

Near enough. An AI acceptable use policy, an AI usage policy and AI guidelines for employees all cover the same ground: which tools, what's off limits and what needs a person. Use whichever name fits your handbook.

Should employees sign the AI policy?

It helps. A signature turns "I think I saw that email" into "I read it and I'll follow it". Keep the signed copies with your other staff records, and ask new starters to sign it in their first week, alongside their own work login.

What if we work in a regulated industry?

Start from the same template, then add your industry's rules to sections 3, 4 and 6. Healthcare, financial services, legal, insurance and education businesses often have extra rules about client information, record keeping and what must be disclosed. Your regulator, industry body or lawyer can tell you what applies.

Who should own the AI policy?

One named person who can answer questions quickly, often the owner or an operations or office manager. They keep the tool list current and run the review.

How often should we update it?

Every six months, and whenever you add a new AI tool or connect AI to another app. Change the version number and date at the top each time, so everyone knows which one is current.