AI Policy Template: How to Write a Company AI Policy

An AI policy template is a ready-made set of rules for how employees use AI tools such as ChatGPT, Claude, Gemini, and Microsoft Copilot: which tools are approved, what information can go into them, and who checks the output. Copy the small-business AI acceptable use policy below, replace the bracketed fields, and you can have a working policy in place within two weeks.

You need one because your team is probably using AI already, approved or not. Without written rules, customer data ends up in personal accounts, unchecked AI errors reach clients, and nobody knows who is accountable when something goes wrong.

This guide is written for businesses with roughly 5–500 employees. It isn't legal advice, so have an attorney review your final version, especially in a regulated industry.

Why every company using AI needs a written policy

Any company whose employees use AI tools needs a written policy, because the risk comes from everyday use, not from big AI projects. A sales rep pastes a customer list into a free chatbot. A bookkeeper asks an assistant to summarize a client's tax return. None of them is being reckless; they're getting work done without rules.

Three things go wrong without a policy:

1. Data leaks into accounts you don't control. Free and personal AI accounts may use conversations to improve the vendor's models, depending on settings, and you can't audit or delete what employees put there.
2. Errors reach customers. AI tools sometimes produce confident, wrong answers, often called hallucinations. If nobody is required to check, those errors end up in proposals, emails, and contracts.
3. Nobody owns the outcome. When a mistake surfaces, "the AI wrote it" isn't an answer a customer, regulator, or court will accept.

A policy also speeds up adoption, because people who know the rules stop guessing. Governance is one of the five pillars in our AI readiness framework, and it's usually the quickest pillar to improve.

Example: Consider a 15-person accounting firm where three staff members draft client emails in personal chatbot accounts. With a policy, the firm moves everyone to one business account with training on company data turned off, bans tax IDs and bank details from prompts, and requires a partner to review AI-drafted advice.

What should an AI policy include?

A complete company AI policy covers 12 topics, and a small business can handle most of them in a few sentences each. Here's what each section answers and a sensible default:

Four of these sections need the most thought. The template covers the rest.

Approved tools and accounts

Name specific products and plans, because the same AI product can carry very different data terms depending on the plan. Business plans from the major vendors don't use your company data to train models by default; consumer plans may, unless the user changes a setting. Vendors revise these terms, so confirm the current version before you approve a tool.

Keep an approved AI tools register, and include AI features inside software you already pay for, such as meeting transcription and CRM email drafting, because they handle the same data.

Data classification: what can and can't go into AI tools

Data rules are the heart of an AI acceptable use policy. The template uses four levels: Public information can go anywhere; Internal information only into approved business tools; Confidential information, such as customer details, pricing, and financials, only into tools approved for it; and Restricted information, such as Social Security numbers, card numbers, passwords, and patient records, only with written approval for a specific tool.

Two habits make these rules workable. Strip identifying details before prompting, since "a client in the restaurant business" works as well as the client's name for most drafting. And when in doubt, treat information at the higher level. Healthcare practices should allow patient information only in tools covered by a signed HIPAA business associate agreement (BAA).

Prohibited uses and human review

Ban the uses that are off-limits in any tool: unreviewed decisions about hiring, pay, credit, housing, insurance, or health care; impersonation and realistic fakes of real people; misleading claims; and fake reviews. The FTC's rule on consumer reviews, in effect since October 2024, explicitly covers AI-generated fake reviews.

The core accountability rule is that the person who uses AI is responsible for the result as if they had written it. Scale review to the stakes. Customer-facing content needs the author to verify every fact, figure, and quote, while contracts, financial statements, medical or safety information, pricing commitments, and production code need a second qualified reviewer.

AI agents, meaning AI systems that take actions such as sending emails or updating records, need extra rules: named approval, only the permissions they need, and a log of what they did.

Disclosure and intellectual property

Disclose AI when a reasonable customer would want to know, and always when a law or contract requires it. In practice, chatbots say they're AI and offer a way to reach a person, and AI-generated images don't misrepresent your products or work.

For intellectual property, state that AI-assisted work belongs to the company and require real human creative input for logos and other work you need to own. The U.S. Copyright Office has said material generated entirely by AI isn't protected by copyright without sufficient human authorship.

AI laws and frameworks to know (as of October 2026)

No US law requires every private business to have an AI policy, but several laws regulate specific AI uses, and a written policy is the simplest way to show you manage them. Here's what's in effect or scheduled as of October 2026.

The NIST AI Risk Management Framework. The NIST AI Risk Management Framework is a free, voluntary framework released in January 2023, with a Generative AI Profile added in July 2024; NIST is revising it under the White House AI Action Plan. Its four functions translate well for a small business: Govern (this policy and a named owner), Map (an inventory of where you use AI), Measure (review, testing, and an incident log), and Manage (fixing problems and updating the rules).

The Texas Responsible Artificial Intelligence Governance Act (TRAIGA). House Bill 149 took effect January 1, 2026, and reaches anyone who does business in Texas or serves Texas residents. For private companies, it mainly prohibits developing or deploying AI intended to encourage self-harm, harm to others, or crime; to unlawfully discriminate against a protected class; to infringe constitutional rights; or to produce child sexual abuse material. Government agencies must tell consumers when they're interacting with AI, and licensed health care providers must disclose AI use in a patient's care.

The Texas attorney general enforces the act, must give a 60-day cure period before suing, and can demand documentation of an AI system's purpose, data, outputs, and safeguards. The act also lists substantial compliance with NIST's Generative AI Profile, or another recognized AI risk management framework, among the circumstances that protect a company from liability. A written policy and an inventory of AI uses are the start of that documentation.

Colorado's AI law. The requirements in Colorado's original AI Act never took effect. In May 2026 the state replaced it with Senate Bill 26-189, which applies from January 1, 2027, to automated decision-making technology used in consequential decisions about employment, housing, lending, insurance, health care, education, and government services. Companies that deploy it must give consumers notice, explain adverse outcomes, and offer data correction and human review.

Other rules that touch AI. Illinois has regulated AI in employment decisions since January 1, 2026, New York City requires bias audits of automated hiring tools, and California has rules on automated decision systems in employment. Existing laws still apply, including the FTC Act, HIPAA, the Gramm-Leach-Bliley Act (GLBA), state privacy laws, and copyright. Companies with EU customers or staff also face the EU AI Act, which phases in over several years.

Federal policy is unsettled. A December 2025 executive order directed the Justice Department to challenge state AI laws the administration considers burdensome, but as of October 2026 Congress hasn't passed a law preempting them, so state laws still apply.

Small-business AI acceptable use policy template

Copy the policy below into your handbook or document system. Replace everything in brackets, delete rules that don't apply, and add your industry's requirements. It's written for a company of 5–500 people without full-time compliance staff.

How to roll out your AI policy in two weeks

You can go from no policy to a trained team in 10 working days if one person owns the project. Here's the schedule we recommend.

Week 1: decide

1. Day 1: Name the owner. Pick one person with authority to approve tools and enforce the rules, usually the owner, COO, or IT lead.
2. Days 1–3: Inventory current AI use. Send a short, no-blame survey asking which AI tools people use, for which tasks, and with what data. Check which AI features are already on in your email, CRM, and meeting software.
3. Day 4: Choose approved tools. Standardize on one or two business-tier assistants that fit your software, set up company accounts with single sign-on, and confirm training on your data is off.
4. Day 5: Draft the policy. Fill in the template and add examples of Confidential and Restricted data from your own business.

Week 2: launch

5. Day 6: Review. Leadership signs off, and an attorney reviews it if you're regulated.
6. Day 7: Publish. Put the policy and the approved tools register where people will find them, and move everyone off personal accounts.
7. Days 7–8: Train. Run a 60–90 minute session for each team using real tasks from their work. Our AI training and adoption services can run these sessions for you.
8. Day 9: Collect acknowledgments. Every employee signs, and the policy becomes part of onboarding.
9. Day 10: Hold office hours. Answer questions, turn them into an FAQ, and set the first quarterly review date.

How to keep your AI policy current

An AI policy goes stale quickly because tools, vendor terms, and laws change every few months. Put the upkeep on a calendar:

• Quarterly: review the approved tools register, vendors' data terms, and any new AI features in software you already use.
• On a trigger: update the policy when you adopt a new kind of AI use (such as an agent with access to customer records), when a vendor changes its terms, when a law starts to apply to you, or after an incident.
• Yearly: do a full review, refresh training, and collect new acknowledgments.

Keep a one-page change log and track the share of staff trained, open tool requests, and incidents reported. The free AI readiness assessment is a quick way to re-check your governance score each year.

When you move on to bigger AI projects, such as agents or AI features for customers, extend the policy into a fuller governance program. Our AI strategy and consulting services cover that work, and our guide to AI for small business shows where a policy fits in a broader adoption plan.