How to Write an AI Acceptable Use Policy for a Small Business (Free Template)

An AI acceptable use policy tells your team which AI tools they may use for work, what information never goes into them, and who is responsible for what comes out. For a small business it can be three or four pages. The point is not legal armor. It is giving people clear, simple rules so they can use AI with confidence instead of guessing.

Insurers, auditors and larger customers have started asking whether you have one. More importantly, without one, every employee is writing their own policy in their head.

The five sections that matter

• Approved tools: the specific AI tools and account types allowed for company work, and how someone requests a new one.
• Data rules: what may go into an AI tool, what may only go into an approved business account, and what never goes in at all.
• Human review: a person checks every AI output for accuracy before it is sent, published or relied on, and that person owns the result.
• Disclosure: when customers or colleagues should be told AI helped, for example in proposals, reports or anything that sounds like professional advice.
• Accounts and access: AI tools are used with company accounts, protected with multi-factor authentication, and closed when someone leaves.

Sort your data into three buckets

The data section is where most policies get vague. A simple traffic-light system works better than a long list.

• Green, any approved tool: public information, marketing drafts, general how-to questions, your own writing with no customer details.
• Yellow, approved business accounts only: internal documents, non-public pricing, project plans, anonymized customer questions.
• Red, never: personal information such as Social Security numbers, health or financial details, passwords and keys, and anything a contract or regulation says must stay protected.

What to leave out

• A list of every AI product on the market. Name what is approved and say everything else needs a request.
• Technical detail about how models work. Staff need rules, not a lecture.
• Blanket bans. They push AI onto personal phones where you have no visibility at all.

Make it stick

Give the policy an owner, have each employee acknowledge it, walk through it in a short training session with real examples from your business, and review it once a year. AI tools change quickly, so the approved list will change too. A policy that is updated is worth far more than one that is perfect on day one.

Download the free template

We built a fill-in AI Acceptable Use Policy template for small businesses, with every section above, the three data buckets and an acknowledgement page. Download it free from our Guides page and adapt it to your company. If you are planning to turn on Microsoft 365 Copilot, our Copilot and Secure AI Readiness service includes writing and rolling out the policy for you, along with the permission cleanup Copilot needs first.