An AI acceptable use policy is a short document that says how your people may use AI at work. A small business needs that shared answer so each employee can choose the right tool, protect company information and know who approves the result.
For a team of 10 to 50 people, I would start with a page everyone can find. Someone drafting a customer email should be able to check it while they work.
Use the example below as a starting point for your own rules. Ask a qualified adviser for legal advice and help adapting it to your contracts and obligations.
An example AI acceptable use policy you can copy
Fill in the brackets before sharing this with your team. Keep the approved-tools list beside it.
Company: [name]. Policy owner: [name and contact]. Applies from: [date]. Review on: [date].
- Use the tools and company accounts on our approved list for work. The list names the permitted tasks and data for each tool. Ask [policy owner] before trying another tool or feature.
- Keep passwords, access keys, customer or staff personal information, confidential client files and unreleased company plans out of public AI tools. Use public material or a made-up example instead. Ask [policy owner] where sensitive work belongs.
- Share only the information needed for the task. Remove identifying details and check attachments, email threads and screenshots before uploading them. If a person or company could still be identified, ask first.
- Treat AI output as a draft. A named person checks facts against the source, checks calculations and approves every result before it goes to a customer or is published.
- Keep people responsible for decisions about staff, customers and payments. Ask the responsible manager to review any proposed use of AI in those decisions before starting.
- Get written approval before connecting AI to company files or allowing it to send messages, change records or spend money. Agree the actions it may take and the person who approves them.
- Use material you have permission to share. Check the source of quotations, images and code before reusing them, and follow our existing rules for telling customers how work was produced.
- Report a mistaken upload or an incorrect result to [contact] promptly. Pause the affected work, keep a record of what happened in our approved reporting channel and follow that person's instructions.
- Complete the team's introduction before using AI for work. Ask [policy owner] about uncertain cases. Any exception needs written approval stating its scope and expiry date.
Make the approved list useful
For each tool, write the product, the plan and the company account people should use. Add the tasks it is approved for, the information it may receive and who reviewed its terms. "Chat tool for drafting from public text" tells staff more than a green tick beside a brand name.
I check AI results before they reach anyone. I would put that same responsibility into a team's policy by naming the reviewer for each kind of work. A person preparing a sales reply and a person checking a spreadsheet may need different reviewers.
Before approving a tool for company documents, read its terms and check its settings. Keep that decision with the list. For the account and data questions behind it, read is it safe to put company data in ChatGPT?.
What unacceptable AI use looks like
Under this example policy, pasting a customer complaint with their address into a personal chatbot account is outside the rules. So is sending an AI-written quotation before checking the amounts. Connecting an assistant to a shared folder without approval crosses a different boundary: it gives the tool access to material beyond the text someone intended to use.
Make these examples specific to your business when you introduce the page. Show an ordinary email thread, point out the details to remove, then work with a fictional version. Ask the team where the rule would be awkward to follow. That is how you find the missing tool or unclear instruction.
The CNIL's guidance on deploying generative AI recommends defining permitted and prohibited uses and training the people using the tools. The nine rules above are my suggested working version, rather than an official template.
Introduce it over a working week
On Monday, ask staff which AI tools and built-in features they use. Collect names and uses, keeping confidential prompts out of the discussion.
On Tuesday, choose the approved tools and fill in the policy's names and dates. On Wednesday, walk through the email example together and let people ask questions.
Use Thursday to try the rules on real work with the right reviewer present. On Friday, fix anything unclear and put the current version somewhere the whole team can reach. This is my suggested rollout. Your company's legal questions may take longer to settle.
If your team needs an assistant built around those rules, the services page explains what I build and hand over. To talk through your tools and the documents your people work with, Book a free call.
Frequently asked questions
Should contractors follow the same AI policy?
Give contractors the rules that apply to the work and documents you share with them. Agree who approves their tools and who checks their output before work starts. Have your adviser put any contractual requirements in writing.
Does this cover AI built into existing software?
Include AI features in software your team already uses, such as meeting assistants and email drafting. Record the feature and the account settings in your approved-tools list, alongside standalone chat tools.
When should I review the policy?
Set a review date when you adopt it. Bring that review forward when a provider changes its terms, you add a tool, the work changes or someone reports a mistake the rules failed to address.