An AI Acceptable Use Policy for a Small Business: What to Put in It
Summary: This article explains what an AI acceptable use policy is and what a small or mid-size company, or one department of a larger one, should put in one. It includes a four-level way to classify company data and a set of rules staff can follow. It is written for owners and operations leaders whose staff already use AI tools.
Your staff are already using AI. Someone pastes a customer email into a chat tool to draft a reply. Someone else uploads a spreadsheet to have it summarized. Nobody decided that was allowed, and nobody decided it was not. An acceptable use policy is the document that makes the decision.
It does not need to be long. Two pages that people follow are worth more than twenty that nobody reads.
What is an AI acceptable use policy?
An AI acceptable use policy is a written set of rules that says which AI tools staff may use, which company data may go into them, and who decides when something new comes up. It covers the tools people use in a browser as well as AI features built into software you already license.
It is a policy document. It is not a security audit and it does not test your systems.
Which company data can go into an AI tool?
The answer depends on the data, so the policy starts by sorting data into levels. We use four:
| Level | Name | Meaning | Examples |
|---|---|---|---|
| 1 | Open | Public or not sensitive. Can go into any reputable AI service. | Product descriptions, published prices, marketing copy |
| 2 | Business | Internal business data. Only into a service under business terms that exclude training on your data, and only the minimum needed. | Order history, job costs, internal reports |
| 3 | Protected | Personal, financial or contract-confidential. Only with contractual protection and with unneeded details removed, or only inside your own environment. | Customer names and contact details, employee records, pay, supplier pricing under a confidentiality agreement |
| 4 | Restricted | Regulated or forbidden by contract. Not into an AI service without legal review. | Health information, card numbers, export-controlled data, government contract data |
The work is in mapping your own data onto the levels. A job-costing report may be level 2 at one company and level 3 at another, because of what a customer contract says.
What should the policy contain?
Six sections cover it:
- Approved tools. A named list, with what each is approved for. “Approved for level 1 and 2 data” is a complete entry.
- The data levels. The table above, with your own categories filled in.
- Rules for staff. Five to eight plain sentences. See the next section.
- Who approves a new tool. One named person, and how long a decision takes.
- Review of AI output. Who checks a draft before it leaves the company.
- Review date. When the policy is next looked at, and by whom.
What rules can staff actually follow?
Rules work when they can be applied in the moment without asking anyone. Examples:
- Never paste a customer’s name, address or card number into a public chat tool.
- Anything AI drafts is reviewed by the person responsible before it leaves the company.
- Level 3 data is used only in tools the company has a data agreement with.
- If you are not sure of the level, treat it as level 3.
- A new AI tool is not used for company work until it is on the approved list.
What is the most common finding?
Staff are already using public AI tools with data that should not be there. It is the most common thing we see, and it is rarely anyone’s fault. Nobody told them the rule, because there was no rule.
Say so plainly when you introduce the policy, and do not look for someone to blame. The aim is that people ask before the next time.
What does a policy not do?
A policy does not stop a determined person, check your systems for weaknesses, or make you compliant with a regulation. Where your data is regulated, take legal advice. Where you want your systems tested, that is a security audit, which is a separate engagement.
A policy also does not decide where AI is worth using. That is a different question, and we cover one part of it in whether you need an AI chatbot or AI built into your systems.
Get the Policy Written for Your Business
A written AI adoption and data-access policy, specific to your company, is part of our Fractional CTO service at the Lead and Embedded levels. The data classification behind it is one of the five deliverables of our AI Readiness Assessment, a fixed-fee review. For what the retainer costs, see what a fractional CTO costs. To talk it through, contact us.