What belongs in an AI acceptable use policy
A practical checklist for small and midsize businesses. If your team already uses AI tools, you already have AI in your business, just without rules.
A practical checklist · free starter policy · general information, not legal advice
Why it matters
You probably already have AI in your business
In most small businesses, AI arrived without a decision. Someone started using a chatbot to draft emails, someone else pasted a document in to summarize it, and nobody wrote anything down. That is not a scandal, it is just unmanaged.
A policy is the cheapest control available. It costs nothing to write, it reduces the chance of the worst outcome, and it is increasingly what customers, insurers, and partners ask about.
The checklist
Six things a usable policy covers
Keep it to one or two pages. A policy nobody finishes reading protects nobody.
- Approved tools. Name which AI tools are allowed, and say plainly that anything not on the list needs approval first.
- Prohibited data. Name the categories that must never be entered: customer personal information, employee records, anything under NDA, pricing and financials, proprietary drawings or process documentation, credentials, health information. Use your own real examples.
- Human review. Say where a person must check the output before it goes anywhere: anything customer-facing, anything contractual, anything involving money, safety, or a legal commitment.
- Disclosure. Decide when AI involvement should be disclosed, internally and to customers, and write the decision down.
- Ownership. Name the person who approves new tools and answers questions. A policy with no owner decays immediately.
- Reporting. Give people a no-blame way to say that something went wrong. You want to hear about the bad output early, not after a customer does.
Common mistakes
What makes a policy useless
The two failure modes are opposite and equally common: a policy so long nobody reads it, and a blanket ban that everyone quietly ignores.
A ban that does not match how people actually work does not stop AI use. It just moves it somewhere you cannot see, which is strictly worse than an approved tool with rules. Write something your team can follow on a normal Tuesday.
- Copying a large company's policy that does not fit how you work
- Banning everything, which drives usage underground instead of stopping it
- Listing tools but never naming what data is off-limits
- No named owner, so nobody maintains it as tools change
- Writing it once and never revisiting it as the tools change
Get a starter
A free first draft you can adapt
Our free AI Exposure Check takes about five minutes, shows what AI is touching your business, and generates a starter acceptable-use policy alongside your results.
One important note: this page and that starter policy are general information, not legal advice. Your obligations depend on your industry, your contracts, and your insurance. For anything binding, talk to a qualified professional.
Common questions
What is an AI acceptable use policy?
A short internal document that tells your team which AI tools are approved, what information may and may not be put into them, when a human must review the output, and who to ask when something is unclear. For most small businesses it is one or two pages, not a legal treatise.
Does a small business really need one?
If anyone on your team uses AI tools, you already have AI in your business, just without rules. A policy is what turns that from unmanaged into managed. It also matters increasingly when customers, insurers, or partners ask how you govern AI.
What should an AI policy include?
At minimum: which tools are approved, what data is prohibited from being entered, when human review is required, disclosure expectations, who owns the decision, and how someone reports a problem. Keep it short enough that people actually read it.
What information should never go into a public AI tool?
As a default: customer personal information, employee records, anything under NDA, pricing and financial records, proprietary drawings or process documentation, credentials, and health information. The specific list depends on your business and your contracts, which is why the policy should name your own examples.
Where can I get a starter AI policy?
Our free AI Exposure Check generates a starter acceptable-use policy along with your results. It is a practical first draft to adapt, not a substitute for professional advice on your specific obligations.
Want a second pair of eyes on your AI controls?
If something already happened, or a customer or insurer is asking how you govern AI, our AI Security Review is a scoped, read-only look at where you are exposed. It is not a penetration test or a certification, and we will tell you plainly if you do not need it.