How to Write an AI Acceptable Use Policy
An AI acceptable use policy tells employees which AI tools they may use, what data they may put into them, which uses are off limits, and when a person must review AI output before it goes out. A workable small-business policy fits on two or three pages: an approved tool list, a data classification table, prohibited uses, human review and disclosure rules, a note on copyright, how to report problems, and who owns the policy. Write it with the people who use AI daily, train on it, and review it every six months.
- Staff are already using AI; a policy that bans everything just pushes use onto personal accounts you cannot see.
- The data rules matter most: be explicit about what never goes into a consumer AI tool.
- Business or enterprise plans with data-use terms you have read should be the approved default.
- Every external output, from emails to code, needs a named human who is accountable for it.
- Under current U.S. Copyright Office guidance, purely AI-generated material is not protected by copyright.
The Steps
- Find out how AI is used todayRun a short anonymous survey or team conversation about which AI tools people use, for what tasks and with what data. You will find uses you did not expect, and the policy has to cover them.
- Choose and approve specific toolsPick the tools the business will pay for and support, on business or enterprise plans whose data-use terms you have reviewed. List them by name, with the approved account type for each.
- Classify your dataDefine three or four categories, such as public, internal, confidential and regulated, with examples from your business. State which categories may go into which approved tools.
- Write prohibited usesSpell out what AI may not be used for, such as making hiring or credit decisions alone, generating fake reviews, impersonating people, or giving legal, medical or financial advice to clients.
- Set review and disclosure rulesRequire a human to check facts, numbers, names and tone before AI-assisted work leaves the company. Decide when customers must be told AI was involved, such as chat assistants or AI phone agents.
- Add reporting and ownershipTell staff how to report a data slip, a harmful output or a suspicious tool, with no penalty for prompt reporting. Name the policy owner and a review date.
- Train and get acknowledgmentWalk the team through the policy with real examples from your work, collect a signed acknowledgment, and include it in onboarding for new hires and contractors.
Why a Small Business Needs an AI Policy
An AI policy is not paperwork for its own sake. Without one, three things tend to happen: someone pastes a client list or a patient note into a free consumer chatbot, someone sends a customer a confident AI answer that is wrong, and someone publishes AI-written marketing claims nobody checked. Each is avoidable with a few clear rules people actually remember.
The NIST AI Risk Management Framework, and its Generative AI Profile (NIST AI 600-1), are useful references even for a ten-person company. The framework organizes risk work into four functions: Govern, Map, Measure and Manage. An acceptable use policy is the core of the Govern piece for most small businesses. The Generative AI Profile lists risks worth naming in your policy, including confabulation (confident wrong answers), data privacy, information security and intellectual property.
What to Include
Approved tools and accounts
Name the tools. "Use approved AI tools" means nothing unless the list exists. For each, say which plan is approved and that work must happen in the company account, not a personal one. Business and enterprise tiers from the major vendors generally offer contractual commitments about not training on your data, admin controls and retention settings. Read the actual terms for the plan you buy; our explainer on whether ChatGPT is safe for business data explains what to look for.
Data rules
This section does the most work. A simple table in plain language beats a long paragraph:
- Public (published website copy, public prices): any approved tool.
- Internal (process docs, draft marketing): approved business accounts only.
- Confidential (client lists, contracts, financials, source code): only tools explicitly approved for confidential data.
- Regulated (health information, card numbers, Social Security numbers): never, unless a specific tool is approved in writing with the right agreements in place, such as a HIPAA business associate agreement.
Prohibited uses
Keep the list concrete. Typical entries: making hiring, firing, lending or pricing decisions about individuals without human review; writing fake reviews or testimonials; creating content that impersonates a real person or company; generating legal, medical or tax advice for clients; and connecting AI tools to company systems without approval. OWASP's Top 10 for LLM Applications is a good reference when you write the section on connecting AI to internal data, since it covers risks such as prompt injection and sensitive information disclosure.
Human review and disclosure
State that the person who sends, publishes or ships AI-assisted work is accountable for it. Define what review means: verifying facts, figures, citations, names and claims, not skimming. Decide when you disclose AI use. Most businesses disclose when a customer is talking to an AI system, and leave internal drafting assistance undisclosed.
Copyright and ownership
The U.S. Copyright Office has concluded that material generated purely by AI, without sufficient human creative control, is not protected by copyright. If you need to own a logo, a book or a jingle, a person must contribute meaningful creative work. Also tell staff not to prompt tools to imitate a named living artist or a competitor's branded material.
Making the Policy Usable
A policy that nobody reads protects nobody. Keep it short, use examples from your own work, and say yes clearly where yes is the answer. A good structure is one page of rules plus a one-page quick reference that answers the questions people actually ask: "Can I paste this email thread in?" "Can I use AI to write a proposal?" "Can I upload a client spreadsheet?"
Write it with two or three heavy AI users on the team. They know the real workflows, and their buy-in makes the rest of the staff take it seriously. If you have contractors or agencies touching company data, extend the policy to them in their agreements.
Enforcement, Incidents and Updates
Make reporting safe. If someone realizes they pasted confidential data into the wrong tool, you want to hear within the hour, not discover it months later. A no-penalty rule for prompt self-reporting gets you there. Pair it with clear steps: delete the conversation where possible, notify the policy owner, and assess whether any notification obligation applies with help from counsel.
Review the policy every six months and whenever you add a tool or a new AI-powered customer channel. AI products change their features and terms often, so the approved list goes stale quickly. If you serve customers in the European Union, note that the EU AI Act includes an AI literacy obligation for organizations that deploy AI systems, which a policy plus training helps address. For businesses moving from policy to actual automation projects, our AI automation work starts with the same data and review rules.
Sources and Further Reading
We link to the primary documentation so you can verify the details yourself.
- AI Risk Management Framework, NIST
- AI RMF: Generative Artificial Intelligence Profile (NIST AI 600-1), NIST
- OWASP Top 10 for LLM Applications, OWASP Gen AI Security Project
- Copyright and Artificial Intelligence, U.S. Copyright Office
- AI Data Security: Best Practices for Securing Data Used to Train and Operate AI Systems, CISA
Related Questions
Is an AI acceptable use policy legally required?
For most U.S. small businesses there is no general law requiring one. Regulated industries, client contracts, cyber insurance questionnaires and laws in places like the EU increasingly expect documented AI governance. A policy is also your best evidence of reasonable care if something goes wrong. Ask counsel about your specific obligations.
Should we just ban AI tools?
Bans tend to fail quietly. People keep using AI on personal phones and accounts, where you have no visibility or data protections. Approving a small set of business-grade tools with clear data rules gives you more control than a ban.
How long should the policy be?
Two to three pages is a good target for a small or mid-sized business, plus a one-page quick reference. Longer policies are rarely read. Put detailed procedures, such as how to request a new tool, in a separate document.
Does the policy need to cover AI features inside tools we already use?
Yes. Many email, CRM, document and design products now include AI features that send data to a model. List which built-in AI features are approved and check each vendor's terms for how your data is handled.