An AI Use Policy for Small Teams: What to Include (With a Template)

In most organisations, AI use started informally: someone tried an assistant to tidy an email, then to summarise a report, then to draft a proposal. Informal use is not a problem in itself. The risk is that nobody has agreed what can be pasted into which tool, who checks the output, and what customers are told.

A short, clear AI use policy fixes that. It does not need to be long or legalistic. For a team of five to fifty people, one or two pages is usually enough.

Principles before rules

Start with three or four principles that people can apply to situations the rules do not cover. For example:

• We use AI to help our work, not to replace our judgement.
• We never put confidential or personal information into tools that are not approved for it.
• A named person is responsible for anything we publish or send, however it was produced.
• We are honest with customers about how we use AI where it matters to them.

If you want a recognised framework to anchor these principles, the NIST AI Risk Management Framework organises AI risk into four functions (Govern, Map, Measure and Manage) and is free to use.

The seven sections to include

1. Scope

Who the policy applies to (staff, contractors) and what it covers (chat assistants, AI features inside other software, image generators, coding assistants).

2. Approved tools

List the tools people may use and, for each, what kind of data is allowed. Business or enterprise versions of many tools offer contractual commitments not to train on your data; free consumer versions may not. Keep the list short and say how to request a new tool.

3. Data rules

This is the most important section. Use simple categories:

• Never: passwords, customer personal data, health information, payment details, information under a confidentiality agreement.
• Approved tools only: internal documents, draft financials, unreleased product plans.
• Any tool: public information and your own non-sensitive drafts.

4. Human review

Require a person to check AI output before it is published, sent to a customer or used in a decision. State what checking means for different risk levels; our guide to checking AI output can be linked directly.

5. Prohibited uses

Be explicit about what is off limits, such as making final hiring or credit decisions with AI alone, generating images of real people without consent, or presenting AI output as professional advice without qualified review.

6. Disclosure

Decide when you tell people that AI was involved: for example, customer-facing chatbots must identify themselves, and published articles drafted with AI assistance carry a short note.

7. Ownership and review

Name an owner for the policy, explain how to report a problem or a mistake, and set a review date. AI tools change quickly; a policy reviewed every six months stays useful.

Legal context

Requirements depend on where you operate and what you do. Data-protection law applies to personal data whatever tool processes it. The EU's AI Act, which entered into force in 2024, introduces obligations that phase in over several years, mostly for higher-risk uses. A small business using AI for drafting and research is rarely in a high-risk category, but if you use AI in hiring, credit, health or education, take specific legal advice.

One-page template

Purpose. This policy explains how [Company] uses AI tools safely and responsibly.

Applies to. All staff and contractors using AI tools for [Company] work.

Approved tools. [Tool A: internal and public data] [Tool B: public data only]. Request new tools from [name].

Never enter. Passwords, customer personal data, payment or health information, confidential client material.

Review. A named person checks all AI-assisted work before it is published, sent externally or used for a decision.

Not allowed. Fully automated decisions about people; images or audio of real people without consent; presenting unchecked AI output as advice.

Disclosure. Customer-facing AI identifies itself. Published content drafted with AI notes this where relevant.

Problems. Report mistakes or concerns to [name] at [contact]. Reporting quickly is always the right call.

Owner and review date. [Name], reviewed every six months. Next review: [date].

A printable version of this template is available in our submissions library. Before rolling it out, check that each approved tool actually meets the rules you have written by following our guide on evaluating an AI tool.