An AI policy for small business is one page of plain rules: which AI tools your team may use, what never goes into them, and who checks AI work before a customer sees it. One page beats none, because without it each person makes up their own rules. Below is a sample you can copy, adapt and hand out.
This post is for owners and office managers without a legal or IT department. It covers why a short policy works, a sample, and how to roll it out. It is not legal advice, so have an attorney review your final version. For the data side, see whether AI is safe for your business data.
Why does a small business need an AI policy?
Because your team may already use AI, and without rules each person decides alone what to put in and what to send out. A short policy turns those private guesses into shared rules that protect your customers, your team and you.
Without one, three problems tend to show up:
- Accounts you cannot see. Work goes into personal AI accounts the company cannot check or close when someone leaves.
- Drafts nobody checked. An AI-written reply reaches a customer with a wrong date or a promise nobody approved.
- Mistakes kept quiet. Someone pastes in the wrong thing and says nothing, worried about blame.
Our post on general-purpose AI chat tools for business lists what to keep out of personal accounts. A policy goes further. It says who decides, who checks, and what happens when something goes wrong.
What should an AI acceptable use policy cover?
An AI acceptable use policy should cover eight things: approved tools, private information, human review, honesty with customers, decisions AI may not make, reporting mistakes, an owner and a review date. Keep each rule to a sentence or two, because a policy nobody reads protects nobody.
Our AI readiness checklist asks whether your rules are written down. NIST's AI Risk Management Framework (opens in a new tab) is a voluntary guide that helps organizations build trustworthiness into how they design, use and check AI systems. The sample below gives you a page to start from.
A sample AI policy for small business
This sample AI policy for small business fits on one page and covers the eight rules above. Copy it, fill in the words in capitals and add a line for your trade, such as codes your crews must never paste into a tool. Have an attorney review the final version before anyone signs.
AI policy for COMPANY NAME
- Use approved tools only. Use AI only through accounts the company sets up for work, never a personal account. Your AI access ends when you leave, along with your other accounts.
- Keep private information out. Never put passwords, card numbers or Social Security numbers into any AI tool. Health, legal and money records, and anything a customer shared in confidence, stay out too, unless the owner has set up a tool for that job with the right controls in place first. The FTC's guide to protecting personal information (opens in a new tab) advises keeping only the information you need and limiting access to the people who need it.
- Check before it goes out. A person reads and fixes anything AI drafted before it reaches a customer, a vendor or the public. You own what you send, whoever wrote the first draft.
- Be open about AI. When a customer talks or texts with an AI, it says so in a short, friendly line and offers a person. Only text people who contacted the company or gave permission, and make opting out easy.
- People make the decisions. AI never decides hiring, pay or discipline. Prices, refunds, promises, complaints, and anything legal, medical or about safety stay with a person too.
- Report mistakes right away. If AI gets something wrong, or private information goes where it should not, tell POLICY OWNER at once. An honest, prompt report is not held against you.
- One owner. POLICY OWNER keeps the list of approved tools, answers questions, and approves any new AI tool or feature before anyone uses it. When in doubt, ask before you paste.
- Review it every few months. POLICY OWNER reviews this page every few months and whenever the company adds an AI tool. Everyone signs each new version.
Add a line at the bottom for each person to sign and date.
How do you roll out an AI policy to your team?
Hold one short meeting, walk through each rule with an example from your own work, and have everyone sign. Then post the page where people work and name who answers questions. New hires sign it with their onboarding papers, and the owner books the next review date.
- Fill in the blanks. Name the policy owner, list the approved tools and set the first review date.
- Get it reviewed. An attorney reads the final version before anyone signs.
- Meet once. Read each rule out loud and give one real example from your business, such as a customer's gate code sitting in a text thread.
- Sign it. Everyone signs and dates the page. New hires sign it with their other onboarding papers.
- Post it. Put it in the shared drive, the onboarding packet and the break room.
- Book the review. Put the next review date on the owner's calendar today.
New to AI? Pair the policy with one small first workflow, as our guide on how to start using AI in your business explains. Our guide to AI for small business helps you choose that workflow.
How our agents follow these rules by design
Our agents follow these rules by design, so the policy is built into how they work rather than left to memory. They run on private models, get only the access each job needs, say they are AI in the first line and log every action. Prices, promises and complaints still wait for a person.
In practice:
- Approved models only. Our agents run on private and on-premise models, not public AI tools. Nothing you give us is used to train AI models.
- Only the access each job needs. Each agent gets its own login, so records it has no use for stay out of reach. The SBA's cybersecurity advice (opens in a new tab) also says to give admin access only to trusted staff and check who has access regularly.
- A person checks what matters. Prices, promises, refunds and anything unusual wait for a person before they go out.
- Open about being AI. We can set up the Customer Agent to answer calls, texts and website chat, say it is the business's AI assistant in its first line, and send a page to your team and set up a quick callback for anyone who asks for a person.
- People decide. Hiring, pay, complaints, and legal, medical or tax questions go to a person with the full context.
- Easy to trace. Each agent is built so its actions are logged in a record that shows any later edit, so a mistake can be found and fixed fast.
To choose where the model itself runs, see our guide to private AI for small business. Our Security page explains how each build is planned, tested and recorded.
What stays with your people
Owning the policy, approving each AI tool, looking into reported mistakes and every decision about hiring, pay and discipline stay with your people. A policy only works when a person owns it. The attorney's review and the owner's signature stay human too.
These stay with people every time:
- Owning the policy and approving each AI tool.
- Looking into a reported mistake and fixing the process, not blaming the person.
- Every decision about hiring, pay and discipline.
- The attorney's review and the owner's signature.
Same team. Same jobs. More capacity. The rules let AI absorb repeat work while your people stay in charge.
An example: a plumbing office adapts the sample
This is an illustration, not a customer story.
In a family-run plumbing office, the dispatcher and the office manager use AI to draft customer emails, each on a personal account. The owner adapts the sample in three ways:
- Rule 1: the company sets up an AI tool the business controls, set so its data is not used for training, and personal accounts stop.
- Rule 2: a line for the trade: never put a customer's gate code, lockbox code or alarm code into any AI tool.
- Rule 5: AI drafts never state a price or an arrival window. The dispatcher sets both.
An attorney reviews the page, the office manager runs a short meeting, and everyone signs. A few weeks later, a reply goes out with the wrong appointment day. The dispatcher spots it and reports it at once. A person calls the customer to set it right, and the owner adds one line to rule 3: check every date in an AI draft against the schedule. Nobody is blamed, so the next mistake gets reported too.
Frequently asked questions
Should a small business ban AI tools instead?
A ban tends to push AI use out of sight, onto personal phones and accounts. Approved tools with clear rules let you see what is used and keep customer information where it belongs.
Does the policy cover AI features inside tools we already use?
Yes. Many everyday tools now include AI features, from your email to your CRM to your accounting software. Treat each one like any other AI tool: the owner decides whether it is on, and the same rules apply.
Does an AI policy need a lawyer?
You can draft it yourself from a sample like this one. Have an attorney review the final version, because privacy and employment rules differ by state and by industry. Nothing in this post is legal advice. Law firms have extra duties around client confidences; see our AI policy for law firms.
What should an AI policy include?
Which AI tools are approved, what information never goes into them, who checks AI work before it reaches a customer, and who to ask when unsure. Add how customers are told they are talking to AI, and a date to review the policy.
Should my business have an AI policy?
Yes. If anyone on your team uses AI tools, even on their own, a one-page policy keeps customer information safe and sets who checks the work. It takes an afternoon to write from a sample.
Next step
Want help fitting the sample to how your team really works? Book a free workflow consult. We are based in the Kansas City metro and meet owners in person or by video. We look at which AI tools your team already uses, what records they touch and where a person should check the work, so the policy your attorney reviews matches your real day.
About the ScaleAlphaAi team
We are a Kansas City company that designs and builds AI agents and custom software for small businesses, trades and growing firms. We write these guides from our work with owners and office teams: what AI handles well, what stays with your people, and how to start with one workflow.
Meet the team
