How do I write a simple AI policy for my staff?
A small-business AI policy fits on one page. List the approved tools and require business accounts, name what never goes in (passwords, card numbers, customer details, health information), require a person to check anything that reaches a customer, say who to ask, and set a review date. This isn't legal advice.
The short version
- Keep it to one page, in plain words, and give everyone a copy.
- Name the approved tools, and require business accounts for business work.
- List what never goes in: passwords, card numbers, customer details, health information.
- A person checks anything AI helped write before it reaches a customer or goes public.
- Say who to ask, and review the policy every six months. This isn’t legal advice.
Why have a policy at all?
Your staff are probably already using AI tools, on their phones and personal accounts. A short policy doesn’t stop that. It points it in a safe direction. It answers the questions people would otherwise guess at: Can I use it for this? Which account? What can I paste? Who checks it?
The US government’s NIST AI Risk Management Framework, released January 26, 2023, is the best-known public framework for this. NIST says it’s “intended for voluntary use,” and its Generative AI Profile (NIST-AI-600-1, July 26, 2024) covers risks specific to tools like chat assistants. NIST notes the framework is being revised under the White House AI Action Plan. It’s written for larger organizations, but the ideas scale down: know which tools you use, know the risks, and put a person in charge of checking.
What goes in a one-page policy?
Copy this outline and fill in your own details.
1. Purpose
One sentence: “We use AI tools to save time on routine writing and research. People stay responsible for everything we send and publish.”
2. Approved tools and accounts
- Name the tools staff may use for work, and which plan.
- Require a business account set up by the business, not a personal one. Business plans from the main vendors say they don’t train on your data by default. Microsoft’s page on enterprise data protection and Google’s Workspace privacy hub are two examples. Our guide to what’s safe to share compares four vendors.
- Say how new tools get approved: “Ask [name] first.”
3. Never put these into any AI tool
- Passwords, login codes or recovery codes.
- Card numbers, bank details or tax IDs.
- Customers’ names with contact details, order histories or anything that identifies them.
- Health information.
- Anything covered by a confidentiality agreement.
- Staff reviews, pay or discipline.
4. Good uses
Give examples so people know what’s encouraged: first drafts of routine emails, summarizing long documents you’re allowed to share, rewording, outlines, brainstorming. Our guide to what AI is good and bad at has more.
5. Checks before anything goes out
- A person reads and edits anything AI helped write before it reaches a customer or the public.
- Facts get checked: names, numbers, dates, prices, laws, links.
- Complaints, refunds, prices and legal matters are written by a person from the start. See using AI for customer replies.
6. Honesty
- No AI-written reviews or testimonials, ever. See what the FTC says.
- No AI-made photos presented as real jobs or real staff. See AI images and copyright.
- If a chatbot or AI assistant talks to customers, it says it’s automated.
7. Connected apps
AI features that connect to email, files or calendars need approval first, because they can read more than anyone would paste by hand.
8. Who to ask, and what to do if something goes wrong
Name one person. If someone pastes something they shouldn’t, they tell that person straight away, with no blame. Quick reporting matters more than avoiding embarrassment.
9. Review date
“We’ll review this policy every six months, or sooner if a tool changes its terms.”
What are the common mistakes?
- A ten-page policy nobody reads. One page, plain words.
- Banning AI outright. People use it anyway, on personal accounts, with no rules.
- No examples. “Use AI responsibly” doesn’t tell anyone what to do on Monday.
- Forgetting new hires. Add the policy to onboarding.
- Never updating it. Vendor settings and plan names change several times a year.
- Copying a big company’s policy that doesn’t fit how a five-person team works.
What if staff ignore it?
Start by asking why. Often the approved tool is harder to reach than the personal one, or the policy doesn’t cover what they actually do. Make the right way the easy way: business accounts set up and signed in, a shared facts sheet for customer replies, and a quick person to ask. If customer data was involved in a slip, act on it as the what’s safe to share guide describes, and talk to a lawyer where needed. This isn’t legal advice.
What does it cost, and how long does it take?
Writing the first version takes an hour or two. Business accounts cost more than free tiers; check each vendor’s pricing page. A ten-minute team meeting to walk through it is worth more than the document itself.
How does E-3 handle this?
E-3 works this way itself: AI does routine work, people check it, and the client approves changes before they go live. Accounts we set up for clients are created in the client’s name, with E-3 added as a user. We’re happy to talk through which tools and accounts fit your business.
Related questions
Next step
- Next: What does the FTC say about AI claims and AI-written reviews?The next guide in AI tools for small business.
- Free website checkPublic checks on your own site, then an action plan of what to fix first.
Still stuck? Ask E-3 for an answer from our help guides.
Rather we handled ai tools for small business for you?
It’s part of what we do every week for small businesses, as part of seo and ai search. Start with a free check of your site and profile, or call and ask.