Somebody on your team pasted a customer’s details into a free AI account last week. You don’t know who. They don’t think it was a big deal.
That’s not a character problem. It’s a missing-rules problem. Nobody told them where the line was.
An AI policy for employees fixes that. It doesn’t need to be a legal tome. The best ones are short enough that people remember them, and clear enough that nobody has to guess.
Why your business needs an AI acceptable use policy now
Here’s what usually happens without one:
- People use whatever tool they like, on personal accounts, with no settings checked.
- Client and employee data ends up in places you can’t track.
- AI-written messages go to customers with nobody reading them first.
- Someone uses AI in a hiring decision without realizing the risk.
- When something goes wrong, nobody knows whether to report it.
None of that requires bad intent. It just requires silence. A policy replaces guessing with a shared line everybody can see.
A quick note before the outline: I’m not an attorney, and this isn’t legal advice. Laws on AI, privacy and employment vary by state and keep changing. Use this as a starting draft, then have an attorney review it before you roll it out.
The AI policy outline (company AI policy template, in plain language)
Each section below is something your policy should cover. Keep each one to a few sentences in your own document.
1. Purpose
Why the policy exists: to help the team use AI to do better work while protecting customers, coworkers and the business. Say plainly that you want people using AI well. A policy that reads like a ban gets ignored.
2. Approved tools
List the AI tools the business has approved for work, and the account type people should use (business accounts, not personal ones). Say who approves new tools and how someone requests one. Anything not on the list isn’t approved for company or client data.
3. Data rules
The heart of the policy. Spell out:
- Never goes in: passwords, financial account details, government ID numbers, health information, and anything a client gave you in confidence — unless a tool is specifically approved for it.
- Allowed with care: customer names and project details, only in approved tools with the right settings, and only what the job needs.
- Fine anytime: public information, your own drafts, general questions.
4. Human review
AI drafts. People decide. Anything that goes to a customer, gets published, gets filed or moves money is reviewed by a person first. The person who sends it owns it, no matter who or what wrote the first draft.
5. Accuracy and verification
AI tools make confident mistakes. Facts, figures, quotes, legal points and anything that sounds too specific get checked against a primary source before anyone relies on them.
6. Disclosure
Tell people when they’re talking to AI where they’d expect to know, like a chat window or a voice agent. Don’t present AI-generated content as a personal message written by a specific person if it wasn’t.
7. Intellectual property and client work
Clarify who owns work created with AI help, how to handle client materials, and that people shouldn’t use AI to copy someone else’s protected work. This section especially needs your attorney.
8. High-risk uses
Name the areas where AI needs extra care or approval: hiring and firing, lending, housing, pricing that affects individuals, and anything legal or medical. Using AI in hiring, lending or housing decisions carries discrimination risk, so a human stays accountable for those decisions.
9. Outreach and marketing
Automated calling and texting are regulated. Since a February 2024 FCC ruling, a synthetic AI voice on a phone call is treated as an “artificial” voice under the TCPA, which means robocall consent rules apply. The policy should also cover texting consent and A2P 10DLC registration, Do Not Call lists, state-by-state rules on recording calls, and CAN-SPAM requirements for commercial email. No automated outreach launches without approval and counsel.
10. Connected tools and agents
When AI is connected to email, calendars, files or a CRM, it only gets the access the job needs. Agents that can take actions need a named human owner, a log of what they did, and a way to switch them off.
11. Reporting mistakes
If someone pastes the wrong thing or an AI sends something it shouldn’t, they report it right away to a named person, without fear of punishment for reporting. Fast reporting matters more than blame.
12. Training and updates
Everyone gets a short walkthrough when they join and when the policy changes. Review the policy on a regular schedule, because the tools and the rules both move.
How to roll out your AI policy in a week
- Ask the team which AI tools they use and what they put into them. No blame.
- Draft the policy from the outline above in your own words. Aim for two pages or less.
- Have an attorney review it.
- Walk the team through it in one short meeting and answer questions.
- Pin it where people work, next to the approved tool list.
- Put a review date on the calendar.
The policy is one piece of a bigger rollout. My AI implementation plan shows where it fits, in the standardize phase. For the broader thinking on privacy, accuracy, bias and accountability, read responsible AI for business. And if you’re bringing a team along, leading an AI-first team covers the people side.
How I think about this in my own business
My agents have access to real systems: email, calendars, spreadsheets, the CRM. So the rules aren’t theoretical for me. Every agent gets only the access its job needs, a human owns its work, and anything that reaches a customer or moves money gets a person’s eyes. If you work in real estate, the extra lines around seller outreach are covered in AI for real estate investors.
I’d rather move a little slower and keep people’s trust. That trust took years to build. One careless paste can cost it in an afternoon.
Your next step
Draft your first version this week from the outline. Then put it in front of your attorney. If you’d like to talk through what to include for your team, or have me speak to your people about using AI well, contact me about AI. For the full picture, start with how to use AI in your business. And if you want the policy built into a full AI-first operation, my AI company ClientPro builds both together.
Questions people ask
Does a small business need an AI policy?
If anyone on your team uses AI for work, yes. It doesn’t need to be long. A page or two that covers approved tools, what data never goes in, who reviews customer-facing work and when to disclose AI prevents most of the problems I see. Have an attorney review it before you roll it out.
What should an AI acceptable use policy include?
Purpose, approved tools, data rules, human review, disclosure, intellectual property, high-risk uses like hiring and lending decisions, security for connected tools and agents, reporting mistakes, and training. The outline on this page walks through each one in plain language.
Can employees put customer data into AI tools?
Only into tools the business has approved and configured for that purpose, and only the data the job needs. Many problems start with someone pasting a customer list or contract into a personal account. Your policy should say clearly what is and isn’t allowed.