A small-business AI policy needs four things on one page: which AI tools are approved, which kinds of data may never be entered, a rule that a person checks anything a customer will see, and who to ask when unsure. You can write it in ten minutes and it prevents the most common mistakes.
You do not need to be an early adopter. Census Bureau survey data summarized by the Federal Reserve shows only a minority of US firms use AI in a business function, though staff may be using it on their own anyway. A rule helps either way.
The template
- Approved tools. We use [tool names] under our business accounts. Other AI tools need approval from [name].
- Never enter. Customer personal information, financial or health details, passwords or keys, unreleased pricing or contracts, and anything covered by a confidentiality agreement.
- Okay to enter. Public information, your own drafts with names removed, and generic questions.
- Human review. A person reads and takes responsibility for anything sent to a customer or used in a decision. AI can be confidently wrong.
- Disclose where it matters. If a customer or contract requires it, say when AI helped.
- Ask first. If unsure, ask [name] before pasting.
Choosing business-grade accounts
Free consumer accounts and business plans differ in how inputs are retained and whether they are used for training. Check each vendor's current terms for the plan you use, and turn training off where the setting exists.
Want this tailored to your business?
The AI Quick Start includes a written policy matched to your tools and data.
See AI integration