How to write an AI use policy for a small business

Your staff are already using AI. A one-page policy that names an approved tool and says plainly what never goes into it does more good than a long document nobody reads, or a ban nobody follows.

By Brevin Buster, cloud security engineer · Published October 28, 2026

Why one page

People follow rules they can remember. A policy that fits on one page, uses plain words, and arrives together with a tool people are allowed to use gets followed. A ban without an alternative just moves AI use onto personal phones, where you can see none of it.

What it should cover

Approved tools. Which AI tools staff may use for work, on business accounts the company controls
What never goes in. The kinds of information that must not be entered into any AI tool that is not approved for it
Checking the output. AI drafts can be wrong in confident ways; the person who sends it owns it
Telling people. When clients or colleagues should be told AI was used
Who to ask. One named person for questions and new tools
A review date. The tools change fast; the policy should be looked at every six to twelve months

A one-page template

Adapt this to your business. It is a starting point, not legal advice: if you work in a regulated field, check it against your own obligations.

[Company] AI use policy

You may use [approved tools] for work, signed in with your company account. Do not use personal AI accounts for company work.
Never enter into any AI tool: client or patient personal information, passwords or access keys, payroll or HR details, or anything marked confidential, unless [named person] has approved that tool for it.
You are responsible for anything you send, publish or file, including AI drafts. Read it and check the facts first.
Tell the client when AI produced a substantial part of work delivered to them, if they would reasonably expect to know.
Ask [named person] before trying a new AI tool or connecting one to company systems.
This policy is reviewed every [six] months. Last reviewed: [date].

Rolling it out

Set up the approved tool on business accounts first, so the policy arrives with something people can use
Walk through it in a staff meeting rather than sending it by email
Show two or three examples from your own work of good and bad use
Make asking easy: the named person should answer questions quickly and without judgement

Before connecting AI to your files, read the Copilot readiness checklist.

Next step

If you want the policy, the approved tool and the permissions set up together, that is the groundwork stage of every AI project I run.

brevin@bbclouddevelopments.com