How to Write an AI Policy for Your Small Business (With a Free Template)
Your people started using AI long before anyone wrote down a rule about it. Here are the five things your rules need to cover, three settings to fix today, and a free one-page template.
Last updated: August 2026
Quick Answer
A small business AI policy answers five questions. Which AI tools can we use? What information can never be typed into them? What has to be checked by a person? When do we tell customers a machine was involved? And who do we ask when we’re not sure? One page covers all five. The free template below gives you the page.
Somebody on your team pasted something into ChatGPT this week. A customer email, a spreadsheet, a complaint with a real person’s name in it.
That happened whether you said yes to it or not, and almost certainly with no rules in place. This guide covers what your rules need to say and whether your paid plan is really private. You also get three settings to change today and how to walk your team through all of it. It also tells you what to do if something already went in that shouldn’t have.
Why Bother Writing Any of This Down?
A page of rules is what lets you say yes to AI instead of quietly hoping for the best.
Your team knows which tools are approved and what never gets typed in. Now you can push AI into more of your business, with a lot less second-guessing. That is the real payoff. Not caution for its own sake, but the confidence to move faster.
Most businesses have not done this yet. An IBM study from November 2025 looked at 600 companies. It found that 63% had no written AI rules at all. Spending half an afternoon on one page puts you ahead of most of your competition.
Download the free one-page AI Policy Template (no opt-in required)
We turned everything above into a fill-in-the-blanks Word document you can edit, print, and sign. It includes:
- All five rules, written in plain words
- A starter list of what never goes in, with room to add your own
- The checklist of what a person has to read first, plus what to tell customers
- A signature line and a built-in date for your next check
What Happens When Your Team Uses AI You Never Approved?
When your team uses AI tools you never approved, you carry all the risk and none of the control. Security people call this shadow AI. Most small businesses are living in it right now.
Here’s the part that hits small businesses hardest. Most people use their own personal logins for work. One security company checked this in October 2025. Roughly 7 out of 10 work uses of AI happened on a personal account, not a company one. That company sells security software, so take the exact number with a grain of salt. We see the same thing everywhere we look.
A personal account means you cannot see what your team typed in. You cannot switch off the setting that lets the AI company learn from it. There is no record of any of it. And when that person quits, you cannot shut the account down, because it was never yours. You carry the risk. You hold none of the controls.
A 2026 Bluehost study found that 87% of US small business owners already use at least one AI tool. Put those two facts together and you get the whole problem. Your people started using AI a long time before anybody wrote down a single rule about it.
What Should a Small Business AI Policy Actually Say?
Every AI policy that works answers the same five questions. Everything else is filler.
| The rule | The question it answers | Why it matters |
|---|---|---|
| Which tools we use | What am I allowed to use for work? | This is how you find out what your team is really using, and how you get work off their personal logins. |
| What never goes in | What am I not allowed to type in? | This is the rule that actually protects your customers. If your team remembers one thing, make it this one. |
| What a person checks | What has to be read by a human first? | AI makes things up. This catches a wrong price or a made-up detail before a customer sees it. |
| Telling customers | When do we say a machine was involved? | Customers forgive a helpful robot and resent a sneaky one. Some states also have rules about automated calls. |
| Who to ask | What do I do when the rules don’t cover it? | New tools show up every month. Without one person’s name here, everybody just guesses. |
Notice what is missing. No explanation of how AI works. No paragraph about being a forward-thinking company. No legal wall of text nobody reads. One page, five questions, plain words.
Why Do Most AI Policies Get Filed and Forgotten?
Most policies fail because they describe good behavior instead of telling people what to do. A line that sounds responsible but gives no instructions changes nothing on Tuesday morning.
Here is the difference, line by line. The left column shows up in most free AI policies online. The right column is what actually changes what people do.
| Weak line (sounds good, does nothing) | Strong line (someone can actually follow it) |
|---|---|
| “Employees should use AI responsibly and ethically.” | “Use Claude on the company account. Ask before using anything else for company work.” |
| “Protect confidential information at all times.” | “Never enter customer payment details, Social Security numbers, health information, or passwords.” |
| “AI output should be reviewed for accuracy.” | “Anything going to a customer, vendor, or government agency gets read by a person first.” |
| “Be transparent about the use of AI.” | “Our AI phone assistant says it’s automated on every call. If a customer asks, we answer honestly.” |
| “Consult management with questions.” | “Unsure? Ask Dana at 555-0147 before you do it, not after.” |
Three things make the right column work. It names the tool instead of the idea. It names a person instead of a department. And you can tell whether somebody followed it or not.
Test every line you write with one question. Could someone on their first day read this and know exactly what to do? If not, rewrite it until they could.
If I Pay for ChatGPT or Claude, Are My Chats Private?
Paying for a plan does not automatically keep your chats out of AI training. The line that matters is not free versus paid. It is personal plan versus business plan.
That catches almost everyone off guard. The $20 plans most owners buy are still personal accounts.
| What you are paying for | Do they use your chats to train the AI? |
|---|---|
| ChatGPT Free or Plus (the $20 plan) | Yes, unless you turn it off. OpenAI says ChatGPT “improves by further training on the conversations people have with it, unless you opt out.” |
| ChatGPT Business, Team, or Enterprise | No. OpenAI says it does not train on business accounts by default. |
| Claude Free, Pro, or Max | Depends on what you picked. Anthropic asked personal users to choose. Saying yes also lets them keep your chats for five years instead of 30 days. |
| Claude Team or Enterprise | No. Anthropic leaves work accounts out of training. |
| Gemini on a personal Google account | Yes, while the Keep Activity setting is on. Google also says people read some chats to help improve the service. |
| Gemini inside Google Workspace | No. Google says it does not use Workspace customer data to train the models behind Gemini. |
If you cannot remember making a choice about this, you probably have the default. Go look.
One thing to put your mind at ease. Turning the training switch off does not delete your chat history or break anything. It will not make the tool worse at answering you. It only changes what the company does with your chats on their end.
The two-minute fix
If it is just you, open your settings and turn the training switch off. In ChatGPT it lives under Data Controls. In Claude, look under Privacy. In Gemini, check the activity settings on your Google account.
If you have a team, move everyone to a business plan. Training is off by default there. You also get one place to see who has access, and you can shut an account down when someone leaves. For most small businesses that is the whole answer.
One thing to be straight about
Turning training off does not mean nobody can ever see a chat. These companies still keep conversations for a while, often around 30 days. Staff can look at them when they are chasing abuse or answering a legal request. Google says it plainly in its own help pages. “Please don’t enter confidential information that you wouldn’t want a reviewer to see.”
That is exactly why your never-type-this list matters more than any switch. Settings lower your risk. The list is what keeps the truly private things out of the machine in the first place.
Fix These Three Settings Today (About 10 Minutes)
Rules tell your people what to do. Settings decide what happens to your information no matter what anyone does. Fix these three, and you have done the fastest risk reduction available to you. It costs nothing.
Check these three things in every AI tool your business uses:
- Stop the AI company from learning off your chats. Every big AI tool has a privacy setting that decides whether your conversations get used to train it. On free and personal accounts, that switch is often already on. Business plans usually leave your information out of it, which is a good reason to put your company on one.
- Move work off personal logins and onto a company account. This is the most valuable change on the list. A company account lets you set the privacy switch above, see who has access, and shut the account down when someone leaves.
- See what the AI remembers and what it is plugged into. Some AI tools remember your old chats. Some can reach into your email and files. Both can go further than you expect. Check what is turned on. Our guide to ChatGPT memory for small business covers the settings that matter.
Where to look: in ChatGPT, open Settings and find Data Controls. In Claude, look under Privacy. In Gemini, check the activity settings on your Google account. These menus move around a lot. Trust what you see on your own screen over any blog post, including this one.
Do this before you hold the team meeting. Walking in with the settings already fixed makes the whole thing feel like a plan instead of a lecture.
Your policy says what not to do. What should you build first?
Rules are step one. The money comes from one system doing real work close to your sales. We find where your time and your leads are leaking, build the fix, and train your team on it.
How Do You Adapt a Policy to Your Industry?
All five rules stay the same in every business. The list of what never goes in is where your trade gets specific.
| Business type | Add to your never-enter list | Extra rule worth adding |
|---|---|---|
| Medical, dental, therapy | Any patient detail, including initials, appointment reasons, and photos | Only use a tool that has signed a patient-privacy agreement with you, the kind HIPAA requires |
| Legal and accounting | Client matters, case facts, tax IDs, financial statements | Check what your bar or licensing board says before AI touches client work |
| Home services and trades | Customer addresses paired with schedules, gate and alarm codes, key locations | Photos of a customer’s home stay out of AI tools unless the customer approved it |
| Retail and restaurants | Card data, loyalty program records, employee schedules with personal details | AI-written review responses get read by a manager before posting |
| Any business with a client contract | Anything covered by a confidentiality agreement you signed with a client or supplier | Re-read your client contracts. Some now limit how AI can be used on their work. |
That last row catches people off guard. If you work for bigger companies, more of their contracts now say something about AI. When you sign, their rules quietly become your rules.
How Do You Roll It Out Without Scaring Your Team?
Present the rules as permission with limits, not a crackdown. The second it sounds like you are spying on them, people stop telling you what they use. The hidden stuff gets worse instead of better.
Here’s a 30-minute team meeting that works:
- Minutes 0 to 5: say the quiet part. “I know some of you already use AI. Good. I want more of it, done safely. Nobody’s in trouble.”
- Minutes 5 to 10: read the never-type-this list out loud. That list is what actually protects the business. Spend your time here.
- Minutes 10 to 20: two yes examples, two no examples. From your business, not a textbook. “Yes to drafting the appointment reminder. No to pasting the patient schedule.”
- Minutes 20 to 25: practice taking the names out. Grab a real task, delete the names and account numbers, and run it together as a group. This one habit prevents most of the trouble.
- Minutes 25 to 30: sign it, save it, and set the next date. Everyone signs the bottom, you put it where they can find it, and you say the next review date out loud.
What If Something Sensitive Already Went In?
Assume it already did. Most owners writing these rules are writing them about things that have been happening for a year. Panic helps nothing. These four steps cover most situations.
- Find out what went in and where. Ask your team what they have typed in and which accounts they used. Do not blame anybody. You get one shot at honest answers, and only if nobody gets punished for the first one.
- Delete what you can and flip the privacy switch. Delete those conversations, clear anything the tool has saved, and turn off the setting that lets the company learn from your chats. Every tool handles deleting differently, so this lowers your risk rather than wiping the slate clean.
- Change anything that works like a key. Any password, door code, alarm code, or account number that got typed into a chat needs to be changed now. People skip this step. It is the one that actually locks the door.
- Find out if you have to tell anyone. If customer information, health records, or payment details got out, some states and industries require you to notify people. Ask your attorney about that one. It is not a question a blog post can answer for you.
Then write the rules down, so the next twelve months look different from the last twelve.
What to Check Every Three Months
Put 20 minutes on the calendar every three months and check four things. That is all the upkeep this takes.
- New tools. What is your team using that was not on the list three months ago? Say yes to it or swap it for something else, but do not ignore it.
- New features in the old tools. The tools you already use keep adding things: memory, email access, tools that act on their own. Each one can reach further than it used to.
- New people. Anyone you hired since the last check needs the same walkthrough and the same signature.
- Close calls. Ask the room if anything almost went wrong. Those answers are how your rules get better.
One note before you use it. We are business advisors, not lawyers. This template is general information and a starting point, not legal advice, and we provide it as-is. It does not promise that you follow any particular law. The rules change from state to state and trade to trade. If your business is regulated, or you handle health, legal, or money records, have your own attorney read it first.
This is the policy our clients will be using going forward, and it’s one page on purpose. I’ve spent 30 years around small businesses. I know what happens to a 12-page document. It gets filed, and nobody opens it twice.
A page you can read out loud in a staff meeting changes what people do on Monday. Write the page. Read it out loud. That’s the whole exercise.
Frequently Asked Questions About Small Business AI Policies
Do I need a lawyer to write an AI policy?
Most small businesses can start with a one-page policy like the template above. It gives your team clear limits where they had none. Handling health records, legal matters, or money records? Have a lawyer read it first. We are business advisors, not lawyers. Treat this as general information and a starting point. It is not legal advice, and not a promise that you follow any particular law.
Does paying for ChatGPT or Claude keep my chats private?
Not on its own. The $20 personal plans can still be used to train the AI unless you turn that setting off. Business and team plans do not train on your chats by default. That is the real reason to move a company onto one. Either way, keep your most sensitive information out. Turning training off is not the same as nobody ever seeing it.
Should I just ban free AI tools?
Banning tools outright just pushes people to use them in secret on their own logins. That is worse than what you started with. Instead, set up a company account for one or two tools and make that the easy path. People take the easy path.
What information should never go into AI tools?
Keep out customer card and bank details, Social Security numbers, and health information. Also keep out passwords, what your employees get paid, and anything covered by a confidentiality agreement. Past that list, take out names and account numbers when you can. The habit costs nothing and stops most of the trouble.
How do I know if my team is actually following the policy?
Ask them, instead of watching them in secret. Make the three-month check a conversation. People say what they are using and what almost went wrong, and nobody gets in trouble for it. A team that can admit a close call gives you the real picture. A team that is scared of the rules tells you nothing.
Do we have to tell customers when we use AI?
Your automated phone and text systems should say they are automated. It builds trust, and some states have rules about it. For a letter or email that AI helped write and a person approved, nobody expects you to announce it. Here is our line. Never let someone think they are talking live with a person when they are not.
Fix the Settings Today, Hold the Meeting This Week
Start with the three settings, because they lower real risk before anybody signs anything. Then download the template and spend 20 minutes filling in your tools and your own never-type-this list. Put the team meeting on next week’s calendar.
That is the whole job, start to finish, in about half an afternoon. Once the limits are set, the next thing to work on is getting your people good at the tools. We cover that in our guide on the small business AI adoption gap.
Want a second set of eyes on your rules or your team meeting? Book a free 20-minute discovery call. We will walk through it with you, whether you work with us or not. No script, no sales tactics.
Sources:
1. IBM: Cost of a Data Breach Report 2025 (Ponemon Institute, published November 2025)
2. OpenAI: How Your Data Is Used to Improve Model Performance
3. Anthropic: Updates to Consumer Terms and Privacy Policy
4. Google: Gemini Apps Privacy Hub
5. Google Workspace: Generative AI Security, Compliance and Privacy
6. eSecurity Planet, reporting on the LayerX Enterprise AI and SaaS Data Security Report (October 2025)
7. Bluehost: State of Small Business AI Confidence Study (2026)
