A company AI policy template for small teams

Most small companies didn’t decide to adopt AI. Employees started using it, one tab at a time. That is fine until someone pastes a client contract into a free tool, sends a draft with an invented statistic, or asks whether the company allows all this and nobody can answer.

A good policy fixes that without banning the useful part. This guide explains what to decide, gives you a copyable template and shows how to roll it out. It is current as of September 2026.

This is not legal advice. It is a practical starting point written by an AI trainer, not a lawyer. Laws on privacy, employment, records and sector regulation vary by state, country and industry. Before you adopt a policy, have someone qualified review it against your obligations, especially if you handle health, financial, education or children’s data, or have contracts that restrict where data can go.

Why a small company needs one

• Data leaves the building. Anything typed into an AI tool goes somewhere, and terms differ between free, paid and business plans. See is it safe to put company data in ChatGPT.
• Errors get sent under your name. AI can produce false facts with confidence. The remedy is a rule that a person checks and owns what goes out. See how to stop AI hallucinations.
• Contracts may restrict it. Clients may require confidentiality or forbid sending their material to third-party tools.
• People need clarity. A clear yes reduces both misuse and fear. Employees who know the rules use AI more, and more safely.

For a shorter take, see does my company need an AI policy.

Step 1: Make eight decisions

Before you write anything, get the owner or leadership team to answer these. Each answer becomes a line in the policy.

1. Which tools are approved? Name them, and name the plan or account type (work account, not personal). An approved list is easier to follow than a vague “use good judgment.”
2. What data can never go in? Typical list: passwords and keys, payment card data, government IDs, health information, employee HR records, client confidential material, unreleased financials, legal privileged material.
3. What data is fine? Public information, your own published content, generic drafting with no identifying details.
4. What needs approval first? Perhaps client documents, personal data or any new tool.
5. Who checks the output? State that a named person is responsible for anything AI helped produce.
6. When must you disclose AI use? To clients, in regulated communications, in hiring or performance decisions.
7. What decisions must a human make? Hiring, firing, pay, credit, medical or legal decisions about a person should not be left to AI.
8. Who owns the policy, and when is it reviewed? Name a person and a date.

If you find yourself unsure about an answer, write “ask [name]” and revisit it after the review.

Step 2: Copy the template

Adapt everything in brackets. Keep it to two pages. People don’t read longer policies.

[COMPANY NAME] AI USE POLICY
Version 1.0 · Effective [date] · Owner: [name, role] · Next review: [date]

1. PURPOSE
We want employees to use AI tools to work faster and better while protecting our clients, our people and our business. This policy sets simple rules for that.

2. WHO AND WHAT IT COVERS
This applies to all employees, contractors and interns using AI tools for company work, on any device. "AI tools" means chat assistants, writing and image generators, meeting summarizers, coding agents and AI features built into other software.

3. APPROVED TOOLS
You may use only these tools for company work, signed in with your company account:
- [Tool 1, plan]
- [Tool 2, plan]
Do not use personal accounts or unapproved tools for company work. To request a new tool, contact [name]. We will check its data terms, security and cost before approving it.

4. DATA RULES
Never enter into any AI tool:
- Passwords, API keys, access tokens or security codes
- Payment card numbers or bank account details
- Government ID numbers
- Health information or employee HR records
- Client confidential information or documents, unless the client agreement allows it and [name] has approved the use
- Unreleased financial results or legal privileged material
- [Add company-specific items]
You may enter: public information, our published materials, and generic content with names and identifying details removed.
When unsure, ask before you paste.

5. YOUR RESPONSIBILITY FOR OUTPUT
AI can be wrong, biased or out of date. You are responsible for everything you send, publish or act on, even if AI helped.
- Check facts, numbers, names, quotes and links against a reliable source.
- Do not present AI-generated citations or statistics without verifying them.
- Do not send AI-drafted external messages without reading them in full.

6. DECISIONS ABOUT PEOPLE
Do not use AI as the deciding factor in hiring, firing, promotion, pay, discipline, credit, or health or legal matters. A person must make and be accountable for these decisions.

7. DISCLOSURE
Tell clients when AI materially contributed to a deliverable if their contract requires it or they ask. [Add any industry-specific disclosure rules.] Do not present AI output as a human's confidential expert opinion.

8. AGENTS AND AUTOMATIONS
If a tool can take actions for you, such as sending email, editing files or moving data:
- Start with read-only access.
- Do not let it send, delete, pay or publish without your approval.
- Keep a record of what it did.
- Get [name]'s approval before connecting it to company systems.

9. INTELLECTUAL PROPERTY AND CONFIDENTIALITY
Do not paste material you do not have the right to use. Treat AI output as a draft that may resemble existing work; review before publishing. [Add guidance on ownership of AI-assisted work as advised by counsel.]

10. INCIDENTS
If you enter restricted data into a tool by mistake, or see AI produce harmful or seriously wrong output that was sent out, tell [name] immediately. You will not be penalized for reporting in good faith.

11. RECORDS AND MEETINGS
Do not record or transcribe meetings with AI unless participants have been informed and the recording is permitted. Store AI-generated summaries in [location] following our retention rules.

12. TRAINING AND REVIEW
Employees will receive training on this policy. It will be reviewed at least every [6/12] months or when tools or laws change.

13. CONSEQUENCES
Violations may lead to disciplinary action, up to and including termination, consistent with our other policies.

Acknowledged by: ____________ Date: ________

Adjust the tone to match your company. A five-person agency and a 200-person accounting firm need different levels of formality.

Step 3: Test it against real situations

Before you publish, run three or four scenarios past the draft. If the policy doesn’t clearly answer them, fix the wording.

• “I want to paste a client’s contract into an assistant to summarize it.” (Refer to your data rule and client agreement. See summarize PDFs and contracts with AI.)
• “I recorded a meeting and want an AI summary.” (See AI meeting notes that turn into action items.)
• “I built a script that files my email automatically.” (See automating Gmail with Claude.)
• “Can I use my personal AI subscription because it’s better?”
• “AI wrote a stat I can’t find a source for. Can I use it?”

Step 4: Roll it out so it sticks

1. Announce it as enablement. Lead with what people can do, then the limits.
2. Give a one-page cheat sheet. Three columns: Yes, Ask first, Never.
3. Train people. Thirty minutes with examples beats an email. Show good prompts, what a hallucination looks like, and how to check output.
4. Name a go-to person. A real human to ask “can I…?”
5. Collect acknowledgments. A simple signature or reply is enough.
6. Meet the new hires early. Include the policy in onboarding.

Step 5: Review and improve

Put a recurring date in the calendar. At each review, ask:

• Which tools do people actually use? Update the approved list.
• Which questions came up that the policy didn’t answer?
• Have any incidents or near misses shown a gap?
• Have laws, client contracts or vendor terms changed?
• Are people breaking the rules because the approved options are worse? If so, fix the tools, not just the rule.

Checklist before you publish

• A lawyer or qualified adviser has reviewed it against our obligations.
• Approved tools and plans are named and verified.
• The restricted data list matches our client contracts.
• Someone owns the policy and the review date.
• Employees know who to ask.
• Training is scheduled.
• The policy fits on two pages.

What public standards and regulators say

Where this template lines up with US government guidance. None of it requires a small company to adopt a specific policy.

• The National Institute of Standards and Technology says its AI Risk Management Framework is intended for voluntary use.
• The National Institute of Standards and Technology released its AI Risk Management Framework on January 26, 2023.
• The National Institute of Standards and Technology says its generative AI profile can help organizations identify unique risks posed by generative AI.
• The National Institute of Standards and Technology defines confabulation as the production of confidently stated but erroneous or false content.

Common mistakes

• Copying a big-company policy. Long documents don’t get read.
• Banning everything. People will use personal accounts instead, and you lose visibility.
• Vague rules. “Don’t share sensitive data” without a list invites guesses.
• No owner. Policies decay when nobody is responsible.
• Ignoring agents. Tools that act, not just chat, need approval rules. Learn the difference in what are AI agents.

Good prompting habits also reduce risk, since clearer requests mean fewer errors: see how to write AI prompts that work.

The second afternoon of our two-day class covers AI risks, data privacy and workplace policy: what never goes into an AI tool, how to catch hallucinated data, and the core elements a policy should cover.

Sources

• NIST, AI Risk Management Framework: “is intended for voluntary use”
• NIST, AI Risk Management Framework: “Released on January 26, 2023”
• NIST, AI Risk Management Framework: “identify unique risks posed by generative AI”
• NIST, AI 600-1: Artificial Intelligence Risk Management Framework: Generative AI Profile: “erroneous or false content”