How to Create an AI Policy for Your Business

An AI policy is a short document that tells your team which AI tools they may use, what data they may put into them, and when a human must review the output. You do not need a legal department to write one — you need to answer a handful of practical questions. Below is a template you can adapt in an afternoon.

Why even a small business needs one

Your team is almost certainly already using AI, whether or not anyone decided they should. Without a policy, that means employees may be uploading confidential information to public tools, relying on inaccurate outputs, or using AI to support decisions that really need human judgment. An AI policy does not slow that down — it turns unmanaged risk into a known, agreed process. It is one of the cheapest risk-reduction steps a business can take.

The template: seven sections

A workable AI policy for a small or mid-sized business is short — one to two pages. These are the sections, and what to write in each:

1. Purpose and scope. One paragraph: why the policy exists, and who it applies to (usually everyone who uses AI for work, including contractors).
2. Approved tools. List the AI tools the business permits, and at which tier. Being specific here is what prevents shadow use — "the approved tools are X business tier and Y" is far more useful than "use good judgment."
3. What data may and may not go in. The most important section. Name clearly what must never be entered into a public AI tool — customer and personal data, contracts, financials, credentials, anything regulated — and what is fine.
4. Human review. State what always requires a person before it goes out or takes effect: anything sent to a customer, anything published, any financial action, any decision about an individual. AI outputs are drafts until a human approves them.
5. Accuracy and accountability for output. Make clear that AI can be confidently wrong, so the employee using it remains responsible for checking the result. AI is a tool, not an authority.
6. Ownership and questions. Name who owns AI use in the business and who to ask when something is unclear. A policy with no owner is a document nobody follows.
7. Review date. AI tools change fast. State when the policy will be reviewed — quarterly is sensible — so it does not quietly go out of date.

The three rules that matter most

If you do nothing else, put these three in writing and make sure everyone knows them:

• Never paste confidential data into a public AI tool. This single rule prevents the most common and most damaging kind of AI data leak.
• A human approves anything with consequences. Sending, publishing, paying, or any decision about a person goes through a human before it is final.
• Someone owns it. One named person is responsible for AI use — for keeping the approved-tools list current and answering questions.

Turning a policy into practice

A policy tells people what to do; a well-built system makes the safe path the easy one. When AI is deployed into your operations with least-privilege access, business-tier tools, human approval steps and logging built in, most of the policy is enforced by the system itself rather than relying on everyone remembering the rules. That is the difference between a policy on paper and safety in practice.

This template is a starting point, not legal advice — adapt it to your own obligations and, where a sector rule applies, take proper guidance. If you want help turning an AI policy into systems that actually enforce it, that is part of what we do; a free AI Opportunity Scan is the place to start. You may also find our guide on whether business data is safe with AI useful alongside this.