AI Acceptable Use Policy Template for Small Business Staff

Q: What should an AI acceptable use policy include?

Its scope, a short list of approved tools with business agreements that keep data private, an explicit list of information that must never be entered such as client and patient details or credentials, a requirement that humans review and verify AI output before it goes out, disclosure rules, guidance on meeting recorders, security requirements like company accounts with multi-factor authentication, a no-blame reporting process for mistakes, and a review schedule.

Q: Can employees use free AI tools like ChatGPT at work?

Only if the policy allows the specific tool and only with non-confidential information. Consumer tiers of AI assistants may store prompts and use them for training, so client, patient, financial, and employee data should never be entered into them. Most businesses should approve business or enterprise tiers instead, where the vendor contract states that data is private and excluded from training.

Q: Do medical or legal practices need a different AI policy?

They need additional rules. Medical and dental practices may only use AI tools that touch patient information under a signed business associate agreement. Law firms must protect privilege and verify every AI-assisted citation before filing. Accounting firms must cover approved tools in their written information security plan. Government contractors must keep Controlled Unclassified Information out of any unauthorized AI environment.

An AI acceptable use policy tells employees which AI tools they may use, what information they must never enter into them, when a human has to review the output, and when AI use must be disclosed. It does not need to be long. The template below is written in plain language for a 5 to 250 person business, and the tailoring notes at the end cover the extra rules medical, legal, and financial firms need. Adopt it now, because your staff are already using these tools whether or not you have said anything.

Why every small business needs an AI acceptable use policy

Free AI assistants are one browser tab away, and they are genuinely useful for drafting emails, summarizing documents, and writing first drafts. The risk is not the tool; it is what gets pasted into it. It is common for staff in small offices to enter patient details, client contracts, and payroll spreadsheets into consumer AI services that store prompts and may use them for training. A policy gives people a clear line, protects client confidentiality, and gives you a defensible position with insurers, regulators, and clients who now ask about AI use in their security questionnaires.

AI acceptable use policy template

Copy the sections below into your employee handbook and adjust the bracketed choices. Keep the language; it is meant to be understood without a lawyer or a technician.

1. Purpose and scope

This policy governs the use of artificial intelligence tools, including chat assistants, writing and coding assistants, image and voice generators, meeting transcription services, and AI features built into software we already use. It applies to all employees, contractors, and volunteers, on company devices and on personal devices used for company work.

2. Approved tools

Employees may use only the AI tools on the approved list maintained by [the office manager or IT provider]. Approved tools are those with a business or enterprise agreement that keeps our data private and does not use it for training. Tools not on the list, including free consumer versions of approved products, may not be used for company work. Requests to add a tool go to [name].

3. Information that must never be entered into any AI tool

Regardless of the tool, employees may not enter:

Client, patient, or customer names combined with any personal, medical, financial, or legal details.
Social Security numbers, dates of birth, account numbers, card numbers, or login credentials.
Contracts, pricing, financial statements, or documents marked confidential, unless the tool is on the approved list and the manager for that information has authorized it.
Employee personal information, performance records, or payroll data.
Source code, trade secrets, or information covered by a non-disclosure agreement.

When in doubt, remove the identifying details before using the tool, or ask.

4. Human review

AI output is a draft, not an answer. Employees are responsible for everything they send or file, whether or not AI helped produce it. Any AI-assisted content that goes to a client, a court, a regulator, a patient, or the public must be reviewed by the responsible employee for accuracy, and facts, figures, citations, and legal or medical statements must be verified against a reliable source. AI tools can produce confident, plausible, incorrect information.

5. Disclosure

Employees must disclose AI use when [a client contract, a professional rule, or a regulator requires it], when asked directly, and whenever AI produced a substantial part of a deliverable. Internal use for drafting and summarizing does not require disclosure. Employees may not present AI-generated content as original work in contexts where originality is expected.

6. Meetings and recordings

AI meeting assistants may join or record meetings only with the consent of all participants and only using an approved tool. Transcripts and summaries are company records and must be stored in [the approved location], not in the tool's personal workspace.

7. Security

AI tools are accessed with company accounts protected by multi-factor authentication. Employees may not connect AI tools to company email, files, or systems without approval from [IT]. Browser extensions and plugins that read page content require approval.

8. Reporting and mistakes

If confidential information is entered into an AI tool by mistake, report it to [name] the same day so it can be deleted where possible and assessed. Reporting a mistake promptly will not result in discipline; concealing one will.

9. Review

This policy and the approved tool list are reviewed [every six months] by [name]. Questions go to [name].

What AI tools should be on the approved list?

The safest choices are the business tiers of tools you already pay for, where the vendor contract states that your prompts and data are not used to train models and are handled under your existing agreement. For many small businesses that means the AI features inside Microsoft 365, plus a business-tier assistant with an administrative console. Businesses with strict confidentiality needs sometimes go further and run a private AI model on their own infrastructure, where nothing leaves the building. Whatever you choose, the list should be short, and someone should own it.

Tailoring notes for regulated industries

Medical and dental practices

Any tool that touches protected health information needs a business associate agreement with the vendor, full stop. Without one, entering patient information is a HIPAA violation even if the tool is otherwise excellent. Clinical documentation assistants and ambient scribes are becoming common and are worth adopting, but only under a BAA and with documented patient notice where required.

Law firms

Add rules about privilege and confidentiality: client matter information goes only into tools covered by an agreement that preserves confidentiality, and any AI-assisted research or drafting filed with a court must have every citation verified by the attorney. Widely reported sanctions for fabricated citations make this a rule to state explicitly.

Accounting and financial firms

Client financial data and tax information are subject to federal safeguards requirements. Approved tools must be covered by your written information security plan, and staff should be told plainly that pasting a client's return into a consumer chatbot is a reportable event.

Government contractors

Controlled Unclassified Information may not be entered into any AI tool that is not part of your authorized environment. This is a CMMC scoping issue as much as a policy issue.

How to roll the policy out

Pick the approved tools and set them up with company accounts before announcing the policy, so people have a sanctioned option on day one.
Hold a 20-minute meeting that walks through the prohibited data list with real examples from your work.
Have everyone sign an acknowledgment and store it with other handbook acknowledgments.
Revisit in six months; the tools and the rules will have changed.

MainSail Data helps Treasure Coast businesses choose approved AI tools, configure them securely, and write governance that fits their industry through our AI governance and security services. If you would like this template adapted for your firm, call (772) 794-1194 or request a free AI consultation.