AI use policy template: Small business edition

1. Purpose

This is the rule for how [Business name] uses AI tools. It is short on purpose. If a customer, a bank, an insurer or a franchisor asks, this is the answer.

2. Scope

• It applies to [Owner name] and anyone who works for [Business name], on any device, with any AI tool: ChatGPT, Claude, Copilot, Gemini, or AI inside software we already use.

3. What AI may touch

• Drafts of emails, quotes, social posts, menus, listings and website text that contain no customer details.
• Help understanding a document, a form or a regulation that is already public.
• Spreadsheets and bookkeeping templates that contain no real customer or bank data.
• [Add what you actually use it for]

4. What AI may never touch

The one rule that protects our customers: these never go into an AI tool.

• Customer names together with addresses, phone numbers, emails, card numbers or account numbers.
• Bank details, tax returns, payroll and passwords.
• Anything a customer told us in confidence.
• [Add anything your franchisor, insurer or licensing body says to protect]

5. Approval of new tools

• [Owner name] signs up for every new AI tool, after reading the vendor terms checklist below. Nobody else signs up for a tool with the business email or business data.

6. Human review

• A person reads everything AI wrote before it goes to a customer, and checks every price, date and name in it. The person who sends it owns it.

7. Records

• When AI helped write something we sent to a customer, we keep a copy of what we sent and a note of which tool helped, at [Location, for example a folder named AI]. We keep it for [12] months.

8. Vendor terms: the three lines that matter

Before signing up for any tool, find these three answers in its terms. If any answer is bad or missing, do not use the tool for business data.

• Does the tool train on what we type? We need a no, or a setting that turns it off.
• How long does it keep what we type, and can we delete it?
• Who owns what the tool writes for us?
• Our approved tools and the answers for each: [List]

9. Training

• [Owner name] walks every new team member through this page on their first week, and the whole team reads it once a year.

10. Review date

• We re-read this rule on [Review date], and after anything goes wrong or any new tool arrives.

11. Sign-off

• Owner: [Owner name]
• Date: [Date]
• Next review: [Review date]