What Should an AI Use Policy Cover?
A small company needs an AI use policy people can remember. Here is the one-page charter I would start with, including data rules, review gates, approved tools, and a reporting route.
A small company’s AI policy should define approved tools, forbidden data, human review points, and a simple incident-reporting route. Start with a one-page charter, a named owner, and a monthly review while usage is changing.
What should an AI use policy say first?
A small company’s AI policy should answer four questions before it mentions model theory: which tools staff may use, what data they may enter, which decisions require human review, and how to report a mistake. Keep the first version to one page, name an owner, and review it after real use exposes gaps.
That is the whole job. The policy is a working boundary around ordinary tasks, not a ceremonial document that sits in an employee handbook while everyone uses ChatGPT anyway.
I would put the following sentence near the top:
Employees may use approved AI tools for approved work, but remain responsible for checking outputs, protecting company and personal data, and escalating decisions that affect a person’s rights, money, employment, or safety.
This wording is a practical translation of the risk-management approach in NIST’s AI Risk Management Framework and its Generative AI Profile, NIST-AI-600-1, published on July 26, 2024. NIST describes these documents as voluntary resources for identifying and managing AI risks. They are useful scaffolding for a 50-person firm because they do not require you to create a new department before you can set a boundary.
Which AI tools should employees be allowed to use?
Start with a short approved-tools list owned by one person. Name the product, the account type, the permitted work, and the data class allowed in it. “ChatGPT” is too vague. A company account with contractual privacy terms is a different risk decision from an employee’s personal account, even when the chat window looks identical.
For each tool, record:
- Product and plan, such as ChatGPT Business or Microsoft 365 Copilot.
- Business owner and renewal date.
- Allowed data, such as public material or internal drafts.
- Forbidden data, such as credentials, client exports, health records, or unredacted contracts.
- Human review required before sending, publishing, hiring, firing, pricing, or making a customer decision.
A useful registry row could say: Microsoft 365 Copilot, owned by Operations, internal drafts allowed, customer exports forbidden, human review before external email. That is enough detail for a manager to make a decision without asking IT to interpret a policy paragraph.
The FTC’s January 2024 guidance on privacy and confidentiality commitments is a useful reason to ask what happens to business data after it enters a model service. The FTC warns that companies may reveal sensitive or confidential information through models and APIs. Your policy should therefore prohibit employees from assuming that a free or personal tier has the same data handling terms as an approved business account.
I would review the registry once a month for the first quarter. That is a calendar habit, not a governance theatre exercise.
What data can employees put into an AI tool?
Use three labels that match your existing security language: public, internal, and restricted. If the company has no labels, this is the moment to create them. The policy should give an example beside each label so an employee can decide in ten seconds.
Public can include a published service page or a draft headline with no client details. Internal can include an operating procedure after names, account numbers, and unique customer details have been removed. Restricted includes passwords, API keys, payment data, medical information, identity documents, legal advice, unreleased financial results, and a customer file that could identify a person.
The default rule is simple: restricted data stays out of general-purpose AI tools unless the tool has been approved for that data and the owner has documented the reason. Redaction is better than wishful thinking. Replace names with roles, remove exact addresses, and shorten a dataset to the fields needed for the task.
The ICO’s guidance and statements on generative AI point back to UK GDPR principles such as purpose limitation and accuracy. A small business serving UK customers should make those principles operational: say why personal data is being used, use the minimum needed, and correct AI-generated errors before they affect someone. This is a policy design point, not a claim that one template makes every use lawful.
When must a person check the AI output?
Make human review mandatory where an error can cost someone money, access, employment, privacy, or safety. That includes customer-facing claims, sales proposals with pricing, recruitment screening, performance reviews, credit or eligibility decisions, regulated advice, and anything sent to a regulator.
The reviewer must have enough context to challenge the output. Clicking “looks good” is not review. Ask the employee to check the source material, calculations, names, dates, and policy citations, then record approval in the normal system used for that work. Do not build a separate approval portal for a workflow that happens twice a month.
The FTC’s business guidance on AI has repeatedly warned companies against unsupported or exaggerated claims about AI capabilities. Put that into the charter as a plain instruction: AI may draft a claim, but a responsible employee must verify the evidence before the claim reaches a customer. The person who sends the email owns the mistake.
For recruitment or employee decisions, involve HR or the designated manager before deployment. The European Commission’s AI Act page says the Act’s AI literacy obligations and prohibitions on certain practices applied from February 2, 2025. A company with EU operations should check the current rules for its role and use case instead of treating a US-only policy as universal.
What should employees do when AI makes a mistake?
Give people a low-friction reporting route. Put an email address or form in the policy, name a backup owner, and define what happens next: stop the affected workflow, preserve the prompt and output, assess who may be affected, correct the result, and decide whether a customer, employee, vendor, insurer, or regulator needs notice.
Do not punish a person for reporting an honest mistake. Punish concealment or reckless reuse after a warning. If the reporting route feels like calling the police on yourself, people will paste the sensitive file and say nothing.
Keep a small AI register with the tool name, purpose, owner, data class, review gate, and incidents. A spreadsheet is enough for a small team. NIST’s AI RMF uses the functions Govern, Map, Measure, and Manage. You can borrow that logic without copying the whole framework: decide who owns the use, describe the risk, test the output, and change or stop the workflow when the evidence is bad.
How do you train staff without turning this into a course?
Run a 30-minute session using the tools people already want to use. Show one safe prompt, one redaction example, one hallucinated answer, and one customer-facing output that requires review. Ask each participant to rewrite a risky prompt before they leave.
The European Commission’s AI literacy Q&A says Article 4 of the AI Act applied from February 2, 2025, and that no specific governance structure is mandated for that obligation. For an EU-facing company, that is a useful reminder that literacy can be handled proportionately. A short role-based briefing may be more useful than a compulsory certificate nobody remembers.
Record attendance and keep the policy version in the same place as the training note. When the approved-tools list changes, run a short refresher for affected staff.
What belongs on the one-page AI charter?
Use this as a starting draft, then have your lawyer or privacy lead adapt it to the jurisdictions and work your company actually handles:
- Use approved tools only. Personal accounts and unapproved browser extensions are not for company work.
- Protect restricted data. Never enter credentials, secrets, payment details, identity documents, health information, or unredacted customer files into a general-purpose tool.
- Check before release. Verify facts, calculations, sources, names, dates, and tone before an AI-assisted output reaches a customer, candidate, employee, regulator, or public channel.
- Keep people in decisions. AI can assist with a decision. A named employee remains accountable for decisions affecting a person’s money, access, employment, privacy, or safety.
- Disclose when appropriate. Follow the company’s customer, client, contractual, and legal disclosure duties.
- Report problems quickly. Send the prompt, output, tool name, data involved, and affected workflow to [owner or address].
- Ask when unsure. If the data class or tool status is unclear, stop and ask before pasting.
Where should an SMB start?
That charter will not solve every AI risk. It will do something more useful: give a busy account manager a decision she can make at 4:47 p.m. without opening a 20-page policy.
If you want help turning your current tools and workflows into an approved registry plus a one-page charter, contact deuce.works. Start with the spreadsheet. The policy comes after you know what people are actually doing.
Which sources support this charter?
Frequently asked questions
- What should an AI acceptable-use policy cover?
- It should cover approved tools, prohibited data, required human review, employee training, disclosure duties, and a route for reporting mistakes or suspected data exposure.
- Can employees use ChatGPT for company work?
- They can use it only if the company has approved the specific account and use case. Personal accounts should not receive restricted company, customer, employee, or confidential data.
- What AI uses should require human review?
- Require human review for customer-facing claims, pricing, recruitment, performance decisions, regulated advice, and any output that can affect a person’s money, access, employment, privacy, or safety.
- How long should an SMB AI policy be?
- Start with one page that employees can use during real work. Keep the tool registry, training note, and incident procedure beside it instead of burying basic rules in a long IT policy.