An AI use policy is a one- or two-page document that tells your team which AI tools they can use for work, what information they can never paste in, and who checks AI-written work before a customer sees it. You can write the first version in an afternoon. Start with an approved tool list, a "never share" list, and a review rule, then walk your team through it.
Your office manager drafts customer emails in ChatGPT. Your estimator asks Gemini to summarize a bid. Your part-time bookkeeper pastes a spreadsheet into a free AI tool to clean it up. You might not know about any of it.
That's normal. AI tools cost nothing to try and sit on every phone. The trouble starts with the things nobody talked about: a customer's name and address typed into a free chatbot, a quote with a made-up number, a blog post quoting a statistic the AI invented. A short AI use policy prevents most of that, and you can write the first version yourself without a lawyer or an IT department.
Why a small business needs an AI policy
Three problems show up in almost every small business that uses AI without ground rules.
- Customer data ends up in the wrong place. On a personal ChatGPT account, OpenAI can use your chats to train its models unless you switch off "Improve the model for everyone" in the Data Controls settings. OpenAI's business plans leave your data out of training by default. Most employees have no idea which kind of account they're using.
- Mistakes go out under your name. AI tools write with confidence even when they get facts wrong. If a customer email lists the wrong price or warranty term, the customer blames you.
- Customers get an uneven experience. When one employee runs every email through AI and another refuses to touch it, your business sounds like two different companies.
Banning AI outright rarely works. People keep using it on their phones, where you can't see what they share. A clear policy lets your team save time and keeps the risk small.
What to put in your AI use policy
Keep it to five sections and one or two pages. Your team should be able to read it in five minutes.
1. Approved tools
List the AI tools your team may use for work and which accounts to use them on. For example: "Use ChatGPT through the company Business account only. Copilot is fine inside our Microsoft 365. Ask the owner before trying any other AI tool for work."
A business plan costs a monthly fee per seat, but it gives you an admin view of who has access and keeps your data out of training by default. For a team that uses AI every day, that's worth pricing out.
2. Information that never goes into AI
Be specific. A vague rule like "don't share sensitive data" means something different to each person. Start with this list and add anything unique to your industry:
- Customer names paired with phone numbers, addresses, or account details
- Social Security numbers, card numbers, and bank information
- Employee records, pay, and medical information
- Passwords and login codes
- Anything covered by a client contract or NDA
Then show people the workaround. Asking "Write a polite reply to a customer upset about a late install" gets the same quality draft as pasting in the customer's full email with their name and address.
3. A person checks the work
Anything AI helps write that goes to a customer, gets posted publicly, or involves money needs a human read before it goes out. Check names, dates, prices, and any statement of fact. A roofing company in Lincoln might let its office staff draft estimate follow-ups with AI, with the owner reading each one before it sends.
4. Honesty with customers
Decide when you'll tell customers AI is involved. A chatbot on your website should say it's an automated assistant and offer a way to reach a person. Our post on what an AI chatbot can and can't do covers that in more detail.
Put one hard rule in writing: no AI-written reviews or testimonials. The FTC's rule against fake reviews, in effect since October 2024, covers reviews generated by AI.
5. One owner for the policy
Name one person who answers questions, approves new tools, and updates the policy. In a business with a handful of employees, that's probably you.
How to roll it out in a week
- Ask what your team already uses. Make it safe to answer honestly. You're taking inventory, and nobody is in trouble.
- Pick your tools and set up accounts. Turn off model-training settings wherever the tool offers them.
- Write the policy. Use the five sections above and plain language. One page beats five.
- Walk through it at a staff meeting. Twenty minutes is enough. Show one prompt that follows the rules and one that breaks them.
- Get a signature. Have each person sign or acknowledge the policy, and keep a copy with your employee handbook.
- Schedule a review. Put a reminder on your calendar every six months. AI tools add features and change their settings often.
A sample policy outline you can adapt
[Business Name] AI Use Policy
Approved tools: ChatGPT (company Business account), Copilot in Microsoft 365.
Never enter: customer contact or account details, financial numbers, employee records, passwords, client contract information.
Review rule: A person reads anything AI helps write before it goes to a customer, gets posted, or involves money.
Customers: Our website chatbot identifies itself as automated. We never post AI-written reviews.
Questions and new tools: Ask [name]. Next policy review: [date].
Treat this as a starting point, not legal advice. If you handle health, financial, or legal records, have your attorney review the final version.
Want help getting your team on board?
TGRW Tech offers hands-on AI training for small business owners and staff in Omaha, Lincoln, Fremont, and across eastern Nebraska. We can help you pick the right tools, set them up with safe settings, and write a policy your team will follow. Reach out and we'll get back to you with a free quote within 48 hours.
Frequently asked questions
Do I need an AI policy if I only have a few employees?
Yes, if anyone on your team uses AI for work. A business with three people can get by with half a page.
Should I just ban ChatGPT at work?
Bans tend to push AI use onto personal phones, where you can't see what gets shared. Approving one or two tools with clear rules gives you more control.
Is the free version of ChatGPT safe for business use?
For low-risk tasks like brainstorming, it can be, as long as you turn off model training in Data Controls and keep customer and employee information out. For daily work, a business plan gives you more control over your data.