By Andreas Pettersson, Founder, Leaders ADAPT
Your team is already using AI. The sales lead drafts follow ups with it. The office manager rewrites policies with it. Someone in finance pasted a spreadsheet into it last week to clean up the formatting. Nobody asked, because nobody was told to ask.
The question is not whether to allow it. It is whether the rules are written down or made up by each person, alone, every day. An AI policy template fixes the second problem in one page.
I founded and scaled an AI and cloud video company, Arcules, inside the Canon group to 150+ people, so I have been on both sides of this: building AI and managing people who use it. Below is the one page policy, the data tiers it rests on, and the 30 minute team conversation that decides whether anyone follows it.
Quick answer: A usable AI policy template for a small company fits on one page. It names the approved tools and accounts, sorts company data into what may and may not go into AI tools, requires a person to review anything AI helped produce before it leaves the company, lists prohibited uses, and names one owner for questions. Launch it in a team meeting, not by email.
Why a small company needs an AI usage policy now
Microsoft and LinkedIn surveyed about 31,000 knowledge workers for the Microsoft Work Trend Index in 31 markets in early 2024. They found that 75 percent were using generative AI at work, and that 78 percent of those users were bringing their own AI tools rather than ones the company provided. 52 percent of users said they were reluctant to admit using AI for their most important tasks.
Read those three numbers together. Most people use it. Most of them use their own accounts. Half of them would rather you did not know. That is shadow AI, work done with tools the company cannot see. It is not a technology problem. It is a permission problem.
The same report found that 60 percent of leaders worried their organisation lacked a plan and vision to implement AI. In a company of a few dozen people, that plan starts as one page. Not because the risk is small. Because a policy nobody reads protects nothing.
What an AI acceptable use policy is, and is not
An AI acceptable use policy is a short set of rules that tells employees which AI tools they may use for work, what information they may put in, what must be reviewed by a person, and what is off limits. It is the employee facing document. It is not a risk register, a vendor assessment process or a board report.
Those belong to the wider AI governance framework for small business, which covers who approves tools, how risk is assessed and how incidents are handled. For reference, the NIST AI Risk Management Framework is voluntary guidance, released in January 2023, organised around four functions: Govern, Map, Measure and Manage. A generative AI profile followed in July 2024. It is worth knowing it exists. It is not what your team needs on Monday.
Your team needs the page below.
The AI policy template (copy this)
This is the generative AI policy template I would put in front of a small company. Fill the brackets. Cut nothing in section 3 or section 4. Have an employment lawyer look at it before you publish, because local rules on employee monitoring and data differ.
``` [COMPANY] AI ACCEPTABLE USE POLICY Version [1.0] Owner: [one name] Review date: [date]
-
WHY THIS EXISTS We want you to use AI tools to do better work faster. This page sets the few rules that protect our customers, our people and our company while you do.
-
APPROVED TOOLS Use only these tools, on company accounts: - [Tool, plan or account type] - [Tool, plan or account type] Personal accounts may not be used for company work. Want another tool? Ask [owner]. Answer within [5] working days.
-
WHAT YOU MAY PUT IN GREEN, allowed: public information, your own drafts, general questions, anonymised examples. AMBER, approved tools only: internal documents, project notes, non personal business data. RED, never: customer personal data, employee records, payroll, health information, passwords and keys, anything under an NDA or contract that forbids sharing, unreleased financials. Not sure which colour? Treat it as RED and ask.
-
HUMAN REVIEW A person checks and owns anything AI helped produce before it goes to a customer, a supplier, a regulator or the public. "The AI wrote it" is never an explanation for an error. Facts, figures, quotes and legal or financial statements are verified against a source before use.
-
NOT ALLOWED - Decisions about hiring, firing, pay or discipline made by AI - Impersonating a real person or creating misleading content - Uploading code, designs or data we do not own the rights to - Using AI to monitor colleagues without [owner] approval
-
DISCLOSURE Tell the recipient when content is substantially AI generated if [customer contract / industry rule / our standard] requires it.
-
MISTAKES AND QUESTIONS Pasted something RED? Tell [owner] the same day. Reporting a mistake quickly is never a disciplinary matter. Hiding one is.
I have read this policy and will follow it. Name: __________ Date: __________ ```
That is the whole AI acceptable use policy template. It fits on one page in a normal font. If yours runs to three, people will sign it without reading it.
The data tiers are the policy
Every other section is supporting text. Section 3 is the part that prevents real damage. It is data classification in its simplest form, and it only works if people can sort data in two seconds.
| Tier | Examples from a typical small company | Rule |
|---|---|---|
| Green | A blog draft, a public price list, a standard email template, a question about a spreadsheet formula | Any approved tool |
| Amber | Meeting notes, an internal process document, a project plan, a sales pitch without customer names | Approved company accounts only |
| Red | A customer list, payroll, an employee's performance notes, a contract under NDA, login details | Never, in any tool |
Make the tiers concrete with your own examples before the launch. Ask each manager for three items from their team's real week and place them in a tier together. The arguments you have about the borderline cases are the most useful hour of the whole exercise, because the borderline cases are where the leaks happen.
Section 4, human review, is the other load bearing wall. An AI usage policy that allows drafting but says nothing about review has moved the risk, not removed it.
The team conversation that launches it
Here is where most policies die. They are emailed as a PDF, signed in a portal and never mentioned again. Six months later someone pastes a customer list into a free tool, and the policy is cited in a disciplinary meeting for the first time.
A policy is a delegation. You are handing every employee a decision they will make dozens of times a week without you. So launch it the way you would hand over any important outcome: in a conversation, with commitment at the end.
The framework I use for that comes from my own manager system, the 5-Minute Leader. It describes a ladder every handover must climb: said, heard, understood, accepted or rejected, committed. An email gets you to said. A signature gets you, at best, to heard. Neither gets you to understood, which is the only step that changes behaviour.
Run it in 30 minutes, in the regular team meeting.
- Why (5 minutes). Use the numbers above. Most people already use AI. We want you to keep going, safely.
- The tiers (10 minutes). Put up the table. Ask the team to place five real items from their own work. Disagree out loud.
- The review rule (5 minutes). One example of an AI draft with a confident, wrong figure in it. Who would have caught it?
- Objections (5 minutes). Ask directly: what in this will slow you down? Write the answers down. Some of them will change the policy.
- Commitment (5 minutes). Each person says, in their own words, the one rule that most affects their job.
People can disagree and still commit, or disagree and say so in the room. What they cannot do is disagree and quietly ignore the policy. The meeting is where that gets settled. The AI training for employees page covers what to teach once the rules are in place.
What building an AI company taught me about rules for AI
Arcules was an AI and cloud video company. Building AI teaches you one thing early: a system does exactly what the data you feed it allows, no more and no less. Nobody inside the product team needed a poster to remember that.
The rest of a company should not need that instinct either. That is the job of the policy: to give a salesperson, an office manager and a finance assistant the same caution in one page, without asking them to understand how a model works.
My prediction on AI at work has not changed. AI will deliver more of the information and the data. People will lean on it heavily, drift away from some of the human support around them, then come back to it, because AI cannot replace human connection and the support to actually execute. A good AI policy assumes both halves. Use the tool hard. Keep a person accountable for what leaves the building.
Ship this policy in week one, with eight other systems behind it
Most owners I work with know they need an AI policy and keep postponing the meeting that launches it. In the Executive AI Program, a cohort of CEOs and owners of non tech companies, the one page policy is the first artifact everyone ships, in week one, with the approved tool list and the data tiers filled in for their own company. Eight more systems follow over the eight weeks. I scaled an AI company to 150 people and exited to Canon, and I have managed teams building and using AI at the same time.
It is not legal advice and it does not replace your lawyer. It is for the owner who wants the policy used, not just signed. If you want someone to own the whole AI function inside your company instead, that is the Fractional AI Executive.
AI policy template FAQ
What should an AI policy template include?
An AI policy template should include the purpose and scope, the approved tools and accounts, the data that may and may not be entered, the uses that need human review before anything leaves the company, the uses that are not allowed, disclosure rules, who owns the policy and how to ask a question or report a mistake. One page is enough for most small companies.
What is an AI acceptable use policy?
An AI acceptable use policy is a written set of rules telling employees which AI tools they may use for work, what information they may put into them, which outputs must be checked by a person, and what is prohibited. It protects confidential and personal data, keeps a human accountable for anything sent out, and gives staff permission to use the tools within clear limits.
Does a small business need an AI usage policy?
Yes, if anyone on the team uses AI tools for work, which is likely. Microsoft and LinkedIn reported in 2024 that 75 percent of knowledge workers used generative AI at work and 78 percent of those brought their own tools. Without a policy, those choices about data and review are made individually, out of sight, every day.
What is the difference between an AI policy and an AI governance framework?
An AI policy is the short set of rules employees follow day to day. An AI governance framework is the wider management system around it: who decides which tools are approved, how risks are assessed, how incidents are handled and how the policy is reviewed. A small company needs the policy first and can grow the framework as its AI use grows.
How do you roll out an AI acceptable use policy to employees?
Introduce it in a team meeting rather than by email. Explain why it exists, walk through the data rules with real examples from the team's own work, invite questions and objections, then ask each person to confirm they understand and will follow it. Review it again after a quarter, because tools and habits change quickly.
Should an AI policy ban tools like ChatGPT?
Usually not. Outright bans tend to push use out of sight, onto personal accounts the company cannot see. A better approach is to approve specific tools and account types, set clear rules on what data may be entered, require human review of anything sent outside, and name the uses that are prohibited. The goal is safe use, not no use.
Publish one page this month
Copy the AI policy template. Fill the approved tools and the owner. Ask three managers for real examples and sort them into the tiers. Book 30 minutes in the next team meeting and launch it in the room. Then put a review date three months out, because the tools will have changed by then. The ChatGPT for small business page covers the uses worth approving first.
What did someone on your team paste into an AI tool last week that you would want to know about?
