AI use policy template for a small business

AI tools usually reach a small firm one person at a time. Someone drafts a customer reply in ChatGPT, a colleague pastes a spreadsheet into another assistant to find odd figures, and a third person summarizes meeting notes on a personal account. Each of them is doing useful work, and none of them has been told which details may go in. Asked what limits their use of AI, 13.4% of businesses told Statistics Canada (opens in a new tab) it was cybersecurity or privacy concerns.

A one-page AI use policy gives everyone the same answer. It names the tools people may use, the information that never goes into them, who checks what they produce, how to ask for a new tool, and when the firm looks at the page again. The template above has those five parts, ready to fill in.

Approved tools: name each tool and its plan

The first part of the template is a short table of the AI tools people may use for work. For each tool, write the plan, who uses it and what it's for, whether that's drafting replies, research, working with numbers or answering customers.

Pick business plans where training on your data is off by contract. On a personal account, the work sits outside your firm, and you can't see or remove it when someone leaves. Move that work to the approved tool, and keep any tool that isn't on the list away from client work until it's added.

What information goes into which tool

Once people know which tools they may use, the next thing they need is what they may put into them. The template sorts information into three groups:

Fine in any AI tool, personal accounts included: public information, such as your opening hours, published prices and website text.
Only in approved tools: client names and contact details, project files and emails, and internal figures.
Never in any AI tool: passwords and access codes, bank and card details, ID documents, health information, and anything a client contract says stays private.

Add the details your firm handles to each group. The last line of this part tells people what to do when they aren't sure: leave the information out and ask the person who keeps the policy.

Who checks what the AI produces

An AI tool can write a reply or add up a column in seconds, and it can also get a name, a date or a figure wrong. Atlassian found that 42% of employees trust AI answers without checking them when they're short of time (2025 survey (opens in a new tab)).

The template sets one rule: a person reads anything an AI tool wrote or worked out before it's sent, paid or deleted. Then it names who checks each kind of work and what they look for. A client email might go to the account manager, who checks facts, names and tone. An invoice might go to the bookkeeper, who checks every figure against its source. When a mistake reaches a client, people tell the person who keeps the policy, so the person checking can change what they look for.

How to ask for a new tool

When someone finds a tool they'd like to use, they send the person who keeps the policy four things: the tool's name and plan, the task it's for, the information that would go into it, and what it costs each month. A fixed list keeps every request short and lets you compare them.

Before you say yes, check the plan's training terms, how long it keeps your data, where it stores the data and who can see it. My note on client data and AI tools has all six checks I make. An approved tool goes into the table in the first part.

When you review the policy

Tools change their plans and prices, and your team takes on new work, so the last part of the template puts a date on the page. Review it every six months, and whenever you add or drop a tool. The person who keeps the policy goes through it with each new person in their first week.

The policy filled in for a property management firm

To see how the policy reads once it is filled in, picture the property management firm in my sample AI Adoption Review report: 15 people looking after about 400 rental homes. Two people pay for personal AI subscriptions, and the firm is about to try an AI step that reads maintenance requests.

The policy filled in for a property management firm
Part	What the firm writes
Approved tools	The AI assistant, moved from two personal subscriptions to its business plan. The maintenance intake, for the two coordinators.
Information: any AI tool	Office hours, rent dates, move-out steps and other public information.
Information: approved tools only	Tenant names, addresses, phone numbers and emails. Repair descriptions and the photos tenants send.
Information: never in AI	Bank details, ID documents and credit checks. Landlord statements and payments.
Who checks	The property manager checks each answer against the leases and office rules before it becomes a reply template.
New tools	Requests go to the office manager, with the tool, the task, the information and the monthly cost.
Review	Every six months, or whenever the firm adds a tool. The office manager keeps the page and goes through it with new staff on their first day.

The firm's owner shares the page with the team before anyone uses either tool with tenant information.

Putting the policy in front of your team

With the five parts filled in, set aside one meeting to go through the page with everyone who uses AI for work. Keep it where people already look, such as your shared drive or the staff handbook, and put the review date in the calendar of the person who keeps it.

If you'd like me to check the policy against the tools and work your team already has, the AI Adoption Review covers the data and integrations for up to three workflows, and its report includes data rules like the ones above.