This AI usage policy template exists because your people are already using AI, with or without a policy.

Somebody in your company pasted a customer list into a free chatbot last month. They were trying to be efficient. Nobody told them not to.

I spent a year rolling generative AI into the marketing organization at a $50M manufacturer. The policy came after the first scare, not before it. Do it in the other order. Template's at the bottom of this page. Fill in the brackets, have your attorney look at it, get it signed.

Why a small business needs an AI policy right now

Three reasons, and none of them are about the technology.

Data walks out the door. Free AI accounts can use whatever you type to train their models. Customer details, pricing, contracts, payroll. Most people have no idea, and the tools don't exactly warn them.

Average work ships. AI writes clean, correct, forgettable copy at volume. Without a review rule, that copy goes out under your name and pretty soon you sound like every competitor with the same subscription.

Somebody owns the mistake. When an AI-drafted proposal quotes the wrong number, the tool doesn't get fired. A policy makes it clear that whoever pressed send owns the output. That one sentence prevents more problems than any software setting.

What the AI usage policy template covers

Thirteen sections, each short enough that people will actually read them.

Purpose and scope, including contractors and agencies, on any device. Approved tools, in a table you fill in, with the account type for each. Free personal accounts allowed only for work touching no company data.

What AI may be used for. Drafting, summarizing, research, code, analysis. The policy says yes more than it says no, on purpose.

What may never go into an AI tool. Customer and employee personal data, financials, contracts, credentials, anything under an NDA. Read that section out loud at your next team meeting.

Review and accountability. AI output is a draft. Whoever uses the tool owns the result. Customer-facing content gets human eyes before it goes out.

Then brand voice, security, disclosure, training, violations, and a signature block. Bracketed placeholders throughout so you can fill it in without a lawyer, then send it to one.

Three rules that matter more than the rest

If your team remembers nothing else, make it these.

Company accounts for company work. Biggest data risk in most businesses is a personal free account signed up with a Gmail address. Pay for the business tier of one or two tools, turn off training on your data, make that the rule.

When in doubt, leave it out. Nobody can memorize a list of restricted data types. Everybody can remember one sentence.

Read it before it leaves your hands. AI states wrong things with total confidence. A number, a name, a date, a quote. Check it against a source. Whoever sends it owns it.

How to roll it out without starting a revolt

A policy on its own reads like a list of things people can't do. Pair it with something they can. At the manufacturer, what actually changed behavior wasn't the memo. It was saved prompt libraries built for the specific job each person did, sitting where they already worked. The full story of that rollout is worth ten minutes if you're about to do the same thing.

So introduce the policy and the prompt library in the same meeting. Show one person's real task, half done by the tool, reviewed by them. Then hand out the policy. Adoption goes up and the restrictions land as common sense instead of a threat.

Want help doing that, building the tool list, the prompt library, and the AI training for employees that goes with it? That's most of what I do inside an AI advisor engagement. The policy is the easy part. Getting a skeptical team to use the tools well is the actual work.

Download the AI usage policy template

It's a Word document you can edit. Put your name and email in the form below and the download link shows up. I won't add you to a newsletter, because I don't have one. You might get a single email from me asking how the rollout went. Get the template.

  • Your team is already using AI. The policy decides whether they do it on company accounts with rules, or free accounts with none.
  • Thirteen short sections: scope, approved tools, allowed uses, restricted data, review, brand voice, security, disclosure, training, violations, and a signature block.
  • Three rules that matter most: company accounts for company work, when in doubt leave it out, and whoever sends it owns it.
  • Roll the policy out with a prompt library, not instead of one. Restrictions land as common sense when they arrive with something useful.