One page, not ten
Past one page, nobody reads it again. Technical settings go into a separate note for whoever manages the accounts.
Blog · Free tool · AI policy · small business
AI policy template: build yours in 5 minutes
Tick the tools you allow, the information that must never leave the company and what a person always checks. The policy writes itself as you go, on one page, ready to print or open in Word. Nothing is sent: it all runs in your browser.
Short answer
An AI policy answers four questions
An AI use policy tells your team which tools to use, what information never goes into them, what a person checks and who to ask. No law requires one, but it is the simplest way to bring hidden AI use into the open without banning everything.
Rules that name things
A rule that names the tool and the type of file sticks. A general principle about responsible AI changes nothing people do.
A name to contact
When in doubt, an employee needs to know who to ask. Without that name, they decide alone, usually for the shortest path.
Generator
Your policy, written while you tick
The boxes ticked at the start are a cautious baseline for a small business. Change what does not fit you: the policy updates with every click.
AI use policy
Version 1, November 3, 2026 · reviewed every year
1. Why this policy
AI can save you time. This policy sets the few rules that protect the clients, the team and the data of the company. It applies to everyone who works for the company, including employees, interns and contractors.
2. Approved tools
For work, use only these tools, with the business account the company opened for you:
- ChatGPT
- Claude
A new tool joins this list once the managing director approves it.
A personal or free account is used only with public or made-up information.
3. Information that never goes into an AI tool
Unless a specific use is approved in writing, never paste this information into an AI tool:
- personal data about clients, prospects or employees
- health data
- payroll, employment contracts and staff records
- passwords, access codes and API keys
- contracts and documents covered by a non-disclosure agreement
- unpublished financial figures
- complete client lists
When in doubt, remove names and figures, or replace them with made-up examples.
4. What AI can do for you
These uses are encouraged:
- drafting or rewording an email, a memo, a document
- summarising a long document or a meeting
- translating a text
- preparing for a meeting or a client call
- finding ideas and building an outline
- analysing a spreadsheet that holds no personal data
5. What a person always checks
A person reads and approves the result before it is used for:
- anything sent to a client or a partner
- prices, quotes and contracts
- hiring and staff reviews
- anything published: website, social media, press
- financial decisions
- legal, tax or medical advice
AI can be wrong and sound sure of itself: check figures, names, dates and sources.
When a published text or image comes mostly from AI and readers could assume otherwise, you say so.
6. Your responsibility
You remain the author of what you send or publish, even when AI wrote it. Do not reuse a text or an image as is when you do not know where it comes from.
7. If in doubt, or after a mistake
Your contact for any question about AI: the managing director. If restricted information goes into a tool by mistake, tell that person the same day so the conversation can be deleted and next steps decided.
8. Training and updates
Everyone gets a short induction before using an AI tool for work, then a refresher every year.
This policy is reviewed every year and whenever a new tool is added. Review owner: the managing director.
Nothing you type leaves your browser: no data is sent or stored.
Next
Three things to do once the policy is written
1 · Present
Twenty minutes in a team meeting
Read it together with three examples from your own work: an email AI can draft, a file that never goes in, a quote that a person checks.
2 · Equip
Open business accounts
Allowing ChatGPT or Claude without business accounts sends the team back to personal ones. The guide on ChatGPT for business and GDPR explains the difference.
3 · Follow up
Review at the pace you chose
Review the policy whenever a new tool arrives. When the team quietly works around a rule, the rule is what needs to change.
Not sure yet which tools your team really uses? Start with the article on shadow AI in business: it shows how to take stock without looking for someone to blame.
Legal frame
What the law asks, and what it does not
No law requires a company to write an AI policy. If you operate in the EU, though, Article 4 of the AI Act has applied since 2 February 2025: a business that uses AI systems must take measures so that its staff have a sufficient level of AI literacy, given their role and the context of use.
The text sets no duration and no certificate. Keep a simple record: who was trained, when and on which tools. The training section of the policy is a starting point, and AI training for business works on your own cases.
If you want to be able to discipline staff for breaking the policy, ask an employment lawyer how to make it binding where you operate, for example through your staff handbook. The generator gives you a working draft, not legal advice.
FAQ
Frequently asked questions
Is an AI use policy mandatory?
No. No law requires an AI policy as such. In the EU, Article 4 of the AI Act does require businesses, since 2 February 2025, to make sure the people who use AI on their behalf have sufficient AI literacy. A policy plus a short training is the simplest way to show it.
What should an AI use policy include?
At least: the approved tools and which account to use, the information that never goes in, what a person checks before use, who to contact and how often the policy is reviewed. The rest can wait for version two.
Can a company ban ChatGPT at work?
Yes, but a ban with no approved alternative pushes use onto phones and personal accounts, where you see nothing. It works better to approve one or two tools with business accounts and say clearly what never goes in.
Is the generated policy legally binding?
It sets clear rules, but it does not replace legal advice. To discipline staff for breaking it, the policy usually has to become part of your formal workplace rules. Ask an employment lawyer before you rely on it that way.
Are my answers stored?
No. The policy is generated in your browser: nothing you type is sent or stored. If you close the page without copying or downloading the text, it is gone.
Next step
Where to go from here
The policy sets the rules. The team still needs the right accounts and the right habits, and that is where I can help.
The AI audit
90 minutes on your tasks and tools, then a written plan: what you hand to AI, what you keep, and in which order.
AI training for business
Four private sessions on your own documents. Everyone leaves knowing how to use AI within your policy.
AI automation
When a task comes back every week, I automate it on your tools, with a human check on anything that commits the company.