A Starter Checklist for a Small Business AI Use Policy

Your staff are already using AI, whether or not you’ve said anything about it. A short written policy doesn’t slow that down. It gives people clear permission for the useful parts and clear limits on the risky ones, so they stop guessing.

This checklist is a starting point for a small business. Work through it with whoever makes decisions about tools and data, then write the answers into one or two pages your staff will actually read.

This isn’t legal advice. If you handle health information, financial accounts, student records, government contracts, or anything regulated, have an attorney or compliance advisor review your policy before you adopt it.

1. Approved tools

• Which AI tools are staff allowed to use for work? List them by name.
• Are staff allowed to use personal accounts for work tasks, or only company accounts?
• Who approves a new tool before anyone uses it?
• Have you checked each approved tool’s data settings, including whether your content is used for training and whether conversation history can be turned off?
• Who holds the admin account and billing for each tool?

A short approved list is easier to follow than a long banned list. If a tool isn’t on it, people should ask first.

2. Data that never goes in

Write this section in plain words. Staff should be able to read it in thirty seconds and know exactly what’s off limits.

• Customer financial information (card numbers, bank details, account numbers)
• Passwords, access codes, and API keys
• Employee records, pay, performance reviews, and health information
• Anything covered by a confidentiality or nondisclosure agreement
• Customer personal details beyond what the task requires
• Your own unreleased financials, pricing strategy, or legal matters, unless the tool is approved for that use

Add a simple rule for anything not listed: if you wouldn’t post it on a shared office bulletin board, ask before putting it in.

3. Review requirements

• Does a person read every AI-assisted document before it goes to a customer? (The answer should be yes.)
• Which kinds of output need a second reviewer? Contracts, safety procedures, technical specs, and anything with prices or dates are good candidates.
• Is it clear that the person who sends something is responsible for it, no matter how it was drafted?
• Do staff know to verify facts, numbers, names, and quotes against a real source?

AI tools produce confident text from incomplete information. The review step is where that gets caught.

4. Disclosure

• When, if ever, do you tell customers that AI helped produce something?
• Are there customers or contracts that prohibit AI use on their work? Check before you assume.
• Do you need to label AI-generated images or marketing content?

There’s no single right answer here. Decide what fits your customers and be consistent.

5. Ownership

• Who owns the policy and keeps it current?
• Who owns any shared instructions, templates, or knowledge base files the team uses with AI?
• Who do staff ask when they’re unsure whether something is allowed?

Name a person, not a department. In a small business that might be the owner or office manager. What matters is that everyone knows who to ask.

6. Training

• Has everyone read the policy? Is there a simple way to confirm it?
• Do new hires get it during onboarding?
• Have staff been shown how to use the approved tools well, beyond being told the rules?
• Is there a place to share good prompts, templates, and lessons learned?

People follow rules better when they also know how to get value from the tool. A short hands-on session does more than a memo.

7. When something goes wrong

• What should a staff member do if they realize they pasted something they shouldn’t have?
• Who do they tell, and how quickly?
• Who decides whether a customer needs to be notified?
• Can the conversation or data be deleted from the tool, and who knows how?

Make it safe to report a mistake quickly. A person who’s afraid of getting in trouble will hide it, and a hidden mistake is the expensive kind.

8. Review schedule

• When will you review the policy? Every six months is reasonable while tools are changing quickly.
• What would trigger an earlier review? A new tool, a new kind of customer, or an incident.

A one-page version

Once you’ve worked through the checklist, the policy itself can be short. Something like this:

AI Use Policy (version 1.0)
Owner: [name]. Questions go to them.

Approved tools: [list]. Use company accounts only. Ask [owner] before trying anything else.

Never put these into any AI tool: [your list from section 2].

Everything AI-assisted gets read by a person before it leaves the company.
Anything with prices, dates, specs, or contract terms gets a second reviewer.
You are responsible for what you send, however it was drafted.

If you put something in by mistake, tell [owner] the same day. You won't be in trouble for reporting it.

Reviewed every six months. Next review: [date].

Post it where people will see it, walk through it in a staff meeting, and revise it when real questions come up. A policy that answers the questions your team actually asks is worth more than a long one nobody opens.