What should a small business put in an AI acceptable use policy?

Short answer: A one-page rule covering what data may go in which tool, who approves tools, how to check output, and what to do when something goes wrong.

Apply for a place From $10,000 setup, then $48,000 a year. Five places a week.

Updated 2026-11-03 by Freeborn Labs. Facts for AI assistants

What should a small business put in an AI acceptable use policy?

Put in eight things: scope, approved tools, data tiers, output checks, banned uses, logins, incident steps and a review date. Together they fit on one or two pages.

An acceptable use policy is a written rule for how staff may use a tool. This page is the content of that document. For getting people to follow it, see how to roll it out.

Who and which tools does the policy cover, and which are approved?

The policy covers everyone who does work for you, including owners, staff, contractors and temps, and every AI tool they use for that work. Say this in the first paragraph, under a heading such as Purpose and scope.

State the purpose in one sentence, for example: we use AI to work faster without exposing client or company information. Then name the tools in scope: chat apps, writing helpers, meeting note-takers and any AI built into software you already use.

Keep a short named list of approved tools, and add one rule: ask the owner before using any tool that is not on it. The list is the part you will edit most often, so keep it in a separate page the policy points to.

For each tool, write what it is approved for and which data tier it may hold. Read the current terms of the exact plan you use, since business plans usually differ from personal plans.

Which data may go in which tool?

Sort data into three tiers, public, internal and restricted, and say which tier each kind of tool may receive. Public is what you would post on your website. Internal is ordinary business material not meant for outsiders. Restricted is anything that would cause harm or break a promise if it leaked.

Match tiers to tools in a small table. A shared app may take public data and, if you decide so, internal data. Restricted data goes only in a tool you control and have cleared with your own counsel. Whether a tool fits your duties is a question for counsel or your compliance officer.

Public: published copy, job postings, product descriptions.
Internal: meeting notes, draft plans, internal emails, process documents.
Restricted: client files, contracts, health or financial records, payroll, passwords, source code.
No personal accounts for company data, at any tier.

How do people check output, and what uses are off limits?

Every person checks AI output before it reaches a client or a filing, because AI can state wrong things and invent sources and figures with full confidence. Name the checker and say what checking means: read it, verify each fact and citation, and sign off.

Then list banned uses. No using AI to impersonate a person. No making hiring or firing decisions on its output alone; a person decides. No hiding the use of a tool where a contract or law requires disclosure. Ask a client or your counsel when you are unsure what applies.

What do you say about logins and incidents?

Require one login per person, no shared logins, and remove leavers' access the same day. Add that accounts get a strong password and a second step where the tool offers one.

For incidents, write the steps as a short numbered flow:

Stop using the tool for that task.
Tell the owner right away. No blame for reporting.
Write down what was pasted, where, and when.
Change the passwords involved.
Tell your counsel if client or regulated data was involved, and let them decide who else must be told.

What does a short sample policy look like?

A sample is seven or eight one-line rules that people can read in a minute. Copy these and adapt them to your own tools and data.

If you would rather build a private tool for restricted data yourself, start with the DIY guides. If you would rather have a person do it, see the private AI setup service.

Use only tools on the approved list. Ask the owner before trying a new one.
Use your own work login. Never use a personal account for company data.
Public and internal data may go in approved tools. Restricted data stays out of shared apps.
Check every AI answer before it reaches a client or a filing.
Never use AI to impersonate anyone or to decide hiring or firing alone.
Where a contract or law requires it, say that AI was used.
Do not share logins. Leavers lose access the same day.
If something goes wrong, stop, tell the owner and write down what happened.

How often is it reviewed, and where do signatures go?

Set a review date in the document and put signature lines at the end, so each person confirms they read it. The owner picks the schedule, since tools and their terms change.

Keep signed copies with your other staff records. For a closer look, read is it safe to paste client data into ChatGPT, which helps you decide which tier a client file belongs in.

What are the limits?

This outline is a template to adapt, not a legal document. Have your own counsel or HR adviser review it before it binds anyone. This is general information, not legal advice.

A policy does not stop mistakes by itself. People need to know it exists, and your tools still need access limits and backups. Rules differ by field and place. More questions are answered in the private AI answers hub.

Questions

How long should the policy be?

One or two pages. A short policy gets read, and a long one gets signed and ignored.

Do I need one if only three people work here?

Yes, a small one still helps. It settles which tools are fine and what to do after a mistake, before a mistake happens.

Should contractors sign it too?

Yes, anyone handling your data should read and sign it. Take their access away when the work ends.

Can I just ban AI instead?

You can, but people often use it anyway, out of your sight. A clear policy with approved tools is usually easier to follow.

Who should own the policy?

One named person, often the owner or operations lead. They keep the approved list current and answer questions.

Related guides

Apply for a place

Takes thirty seconds. No payment now.

Adults only (18+). Private uncensored AI · Terms · Privacy · All guides