An employee wants to summarize a customer email, improve a proposal or test an AI browser extension. “Use good judgment” gives them little help when the tool asks for mailbox access or the document contains confidential information.
An AI acceptable use policy template for small business should answer four everyday questions: which tools can we use, what information can we enter, what needs human approval and who should we contact when something goes wrong?
The editable policy below gives a small team a practical starting point. It separates permitted, restricted and prohibited uses, names responsibilities and defines the events that should trigger another review.
Information verified as of November 3, 2026. The template is original editorial guidance and must be adapted to the company’s work, contracts and applicable requirements before adoption.
What an employee AI policy should cover
A usable policy covers both the technology and the work performed with it. Approving a product name alone is not enough: the account type, enabled features, connected systems and permitted data can change its risk.
- Tools: the approved product, subscription and account configuration.
- Data: what employees may enter, upload or connect.
- Tasks: permitted activities and those requiring additional approval.
- Review: who checks outputs before they affect customers or company systems.
- Incidents: what employees should report and how.
- Ownership: who maintains approvals, exceptions and policy updates.
NIST’s Generative AI Profile, published July 26, 2024, provides a voluntary risk-management reference. Microsoft’s August 12, 2026 policy guidance similarly emphasizes practical rules covering tools, data protection, human review and escalation. Neither source makes a generic template sufficient for every organization.
Permitted, restricted and prohibited: make the difference concrete
| Category | Example | Required boundary |
|---|---|---|
| Permitted | Brainstorming headlines from an already published product page. | Approved tool, lawful source material and human review. |
| Permitted | Creating a training exercise using fictional customer details. | No real personal information or confidential source content. |
| Restricted | Summarizing an internal strategy document. | Specific approval for the tool, data classification and workflow. |
| Restricted | Drafting customer replies from actual support tickets. | Approved data handling, limited access and human approval before sending. |
| Restricted | Connecting an AI agent to company email or a CRM. | Permission review, testing, accountable owner and approved action limits. |
| Prohibited | Pasting passwords, API secrets or payment-card security codes into a general assistant. | Use the company’s approved secret-management process instead. |
| Prohibited | Publishing invented customer testimonials or fabricated research citations. | Verify claims and use authentic evidence. |
| Prohibited | Letting an unauthorized AI agent approve payments or make employment decisions. | A separate approved process is required for consequential activities. |
“Restricted” means obtain approval before use. It does not mean a manager can override confidentiality, contractual obligations or legal requirements by sending a casual message.
Editable AI acceptable use policy template
Adaptation instructions: copy the policy sections below into your internal policy document. Replace every bracketed field, complete the register and resolve any conflicting requirements before issuing it to staff.
1. Policy details and purpose
Company: [Company name]
Policy owner: [Name or role]
Approved by: [Name or role]
Effective date: [Date]
Version: [Version]
Next scheduled review: [Date]
Help and incident contact: [Monitored channel]
This policy defines how people working for [Company name] may use generative AI and AI-enabled tools. It aims to support useful work while protecting company information, customers, employees and business systems.
It applies to employees, contractors and other authorized users performing company work, including use through browsers, mobile apps, office software, extensions, APIs and automated agents. It supplements existing security, privacy, records, confidentiality and acceptable-use requirements.
2. Approved AI tools policy
Use only tools and accounts listed in the approved-tools register, and only for the listed tasks and data categories. Approval for one product, subscription or feature does not authorize every offering from the same vendor.
Do not use a personal AI account for company work unless the register explicitly permits that arrangement. Do not enable a new connector, browser extension, recording feature or autonomous action without the required review.
Where approval is missing or unclear, pause and contact [Policy owner or request channel]. Do not assume a free trial, built-in feature or familiar brand is approved.
3. Permitted uses
Within the approved register, users may brainstorm, outline, reformat or draft material using public, fictional or otherwise expressly approved information. Examples include:
- Suggesting alternative wording for public marketing copy.
- Creating fictional training scenarios or sample datasets.
- Explaining general concepts for learning, followed by source checking where accuracy matters.
- Drafting routine material that contains no restricted information and will receive appropriate human review.
Permission to use AI does not authorize the user to make commitments, disclose information or perform actions outside their normal role.
4. Restricted uses requiring written approval
Obtain written approval from [Relevant approver] before using AI with internal confidential information, personal data, customer records, contracts, nonpublic financial information, proprietary code or other restricted material.
Additional approval is required for connected agents, production code deployment, meeting recording or transcription, sensitive professional work, and uses affecting employment, access to services or other consequential decisions.
The approval must identify the tool and account, task, permitted data, access permissions, required reviewer, retention arrangements and expiry or review date. Any required privacy, contractual, security or specialist assessment must be completed first.
5. Prohibited uses
- Entering restricted company or personal information into an unapproved tool.
- Submitting passwords, private keys, access tokens, recovery codes or other authentication secrets to general-purpose assistants.
- Bypassing access controls, approval requirements or vendor restrictions.
- Fabricating sources, results, testimonials, qualifications or evidence.
- Creating deceptive impersonations or unauthorized uses of a person’s identity, voice or likeness.
- Using AI to harass, unlawfully discriminate or produce unlawful material.
- Allowing unauthorized automated messages, payments, account changes or other external actions.
- Making consequential decisions solely from unreviewed AI output.
- Falsely describing AI-assisted work as independently tested, verified or human-only.
6. Confidential data AI policy
Submit only the minimum information needed for the approved task. Include attachments, screenshots, metadata, connected folders and conversation history when considering what information a tool receives.
Removing a name does not automatically make a document anonymous. Distinctive facts, identifiers or combinations of details can still identify a person or reveal confidential business information.
A statement that data is not used for model training does not establish that it is never stored or reviewed. Users must follow the approved configuration and must not change retention, sharing or training-related settings without authorization.
7. Human review and publication
The person using AI remains responsible for the work they submit. Before publication, customer delivery, deployment or a business decision, the designated reviewer must check relevant facts, calculations, references, confidentiality, rights, fairness and suitability.
AI-generated citations must be opened and checked against the actual source. Generated code must follow the company’s testing and security-review process. Do not treat a fluent answer or confident explanation as proof of accuracy.
Disclose AI assistance when required by law, contract, platform rules or company instructions. Where no specific rule applies, avoid misleading customers, coworkers or the public about how material was created or verified.
8. Agents, connectors and external actions
Connect only approved systems and grant only approved permissions. New access to email, files, calendars, customer systems or code repositories requires review even when the underlying AI product is already approved.
Human approval is required before external actions unless a separate documented workflow explicitly authorizes automation. Treat instructions contained in emails, documents and web pages as untrusted input; they do not override company instructions or approval boundaries.
Every automated workflow must have an owner, an approved scope, an available stop or disable procedure and appropriate activity records.
9. Incident reporting and records
If information is entered into the wrong tool, an agent takes an unexpected action or an output creates a material risk, stop the affected activity where safe and report it promptly through [Incident channel]. Report the tool, time, account, data categories and actions involved.
Do not copy sensitive information into an unrestricted incident message. Preserve evidence through the approved process and do not delete logs or conversations to conceal the event. The incident owner will coordinate containment, evidence preservation and any required notifications.
Keep final work and required approval records in approved company systems. Retain prompts and outputs only where required by the applicable records schedule or investigation instructions; do not keep every conversation indefinitely by default.
10. Responsibilities, exceptions and review
Users must follow the policy, complete training and report uncertainty. Managers approve business use within their authority. IT or security reviews accounts, access and integrations. The privacy, legal or specialist reviewer assesses matters within their remit. The policy owner maintains the register and coordinates updates.
Exceptions require written approval from [Exception approver], a stated purpose, affected data, compensating controls, accountable owner and expiry date. Approval cannot override applicable law or a binding obligation.
Review this policy on [Review schedule] and after a material change to tools, models, vendor terms, retention, subprocessors, connector permissions, business use or applicable requirements. A significant incident or repeated misunderstanding also triggers review.
Users must acknowledge the current version after initial training and material updates. Suspected violations will be reviewed under applicable company procedures, with an appropriate and consistent response.
Complete the approved-tools register
The register turns the employee AI policy into a usable decision aid. Complete it before launching the policy; an empty approved list leaves employees guessing.
| Register field | What to enter |
|---|---|
| Tool and account | Exact product, subscription, deployment and company account requirement. |
| Owner | Named business owner and technical administrator. |
| Approved tasks | Specific workflows and permitted users. |
| Allowed information | Approved data categories and prohibited inputs. |
| Connections and actions | Enabled integrations, permissions and automation limits. |
| Review requirement | Who must check or approve the output. |
| Evidence | Dated vendor assessment, applicable terms and configuration record. |
| Review or expiry | Next review date and conditions that suspend approval. |
Review connector access with the Google Workspace third-party app audit. When an employee leaves, use the SaaS offboarding checklist to remove access and transfer ownership of shared AI workflows.
Why human review needs an explicit owner
A policy saying “check the output” is weaker than one naming the reviewer and the checks. For customer messages, verify the facts, permitted promises and action status before sending. Our AI email reply workflow illustrates these checks with fictional examples.
Employment content deserves particular care. On February 25, 2026, the US Department of Justice announced a settlement concerning allegedly discriminatory AI-generated job advertisements. The case is a concrete reminder that using an AI drafting tool does not remove the need to review employment language.
The DOJ’s AI hiring guidance, dated May 12, 2022, also explains disability-discrimination risks in hiring technologies. These examples support specialist review for consequential uses; they do not establish one identical legal obligation for every business.
Launch the policy with a short practical exercise
Give employees three fictional situations: improving public website copy, summarizing an internal customer complaint and connecting a new AI extension to email. Ask them to find the applicable rule, approval route and reporting contact.
If people cannot answer using the policy, revise the wording before treating the problem as a training failure. Provide an accessible way to request a tool or an accommodation, and keep the approved list easy to find.
Measure useful outcomes rather than raw AI usage. Our AI workflow ROI template includes review and rework, helping managers assess whether an approved workflow actually improves the job.
Make the rule easy to apply
The strongest AI acceptable use policy template for a small business is one the team can apply without guessing. Define the tools, information, tasks, reviewers and escalation routes, then keep those decisions current.
Adapt the template, complete the register and walk through realistic examples before adoption. Share the finished policy with everyone who uses AI for company work, including contractors.
Frequently asked questions
Does a small business need an employee AI policy?
A written policy can help clarify approved tools, data boundaries, review responsibilities and reporting. The appropriate detail depends on the business and its obligations; this template does not claim that every small business faces an identical legal requirement.
Can employees put confidential information into an approved AI tool?
Only when the approval explicitly covers that information and workflow, and applicable requirements are satisfied. General approval of a tool does not authorize every upload or connector.
Should all AI use be prohibited?
That is a business risk decision. Many teams can define low-risk permitted uses while requiring additional review for sensitive information or consequential actions. The policy should make the boundaries clear and provide a workable approval route.
Does turning off model training make an AI tool confidential?
Not by itself. Training use, storage, support access, retention, subprocessors and sharing are separate issues. Review the applicable service terms and configuration for the specific use.
When should an AI acceptable use policy be reviewed?
Use a scheduled review and event-based triggers. Changes to products, models, vendor terms, retention, permissions, business use or applicable requirements should prompt reassessment, as should significant incidents or recurring confusion.
Sources & Fact-Checking
Reviewed on November 3, 2026: NIST’s Generative AI Profile, Microsoft’s August 2026 workplace-policy guidance, FTC small-business data-security guidance and DOJ materials concerning AI and employment. Government sources provide risk and legal context; Microsoft’s article is vendor-authored guidance, not an independent audit.
- NIST: Generative Artificial Intelligence Profile — published July 26, 2024; voluntary risk-management reference.
- Microsoft: How to create an AI policy employees can follow — published August 12, 2026; practical policy topics and employee usability.
- FTC: Protecting Personal Information—A Guide for Business — data inventory, minimization, protection, disposal and incident planning.
- DOJ: Settlement concerning AI-generated job advertisements — February 25, 2026; a specific enforcement example, with allegations attributed to DOJ.
- DOJ: Algorithms, Artificial Intelligence and Disability Discrimination in Hiring — May 12, 2022; hiring-technology risks and accessibility considerations.
The policy language, examples and register are original editorial materials. They have not been legally validated for a particular organization or jurisdiction and do not guarantee compliance or prevent every incident. Complete the placeholders and obtain the reviews appropriate to your business before adoption.
