The first AI policy most small businesses have is the one their staff invented: paste it into a chatbot and see what comes back. An AI acceptable use policy replaces that habit with a few written rules. To write one, list the AI tools the business approves, spell out which data may and may not go into them, require a human to check anything AI produces before it reaches a customer, name one person who owns the policy, and flag the legal hot spots for your market, such as hiring tools and advertising claims. For a business under 50 people, the finished document can fit on two pages. This guide is written for small businesses in the United States, and the legal examples are American.
Six Parts of a Workable Policy and a Three-Colour Data Rule
- A workable policy covers six things: approved tools, data rules, human review, disclosure, legal limits and a named owner.
- A three-colour data table (green, amber, red) does more to prevent leaks than pages of principles.
- The NIST AI Risk Management Framework is voluntary and written for organisations of any size, which makes it a sensible backbone.
- Hiring tools, marketing claims and copyright are where US small businesses are most exposed.
- Review the policy on a fixed schedule, because the tools your team uses will change faster than the document.
What an AI Acceptable Use Policy Covers
An AI acceptable use policy is an internal rulebook for how employees and contractors may use generative AI and other AI tools at work. It is narrower than a full AI governance programme. A five-person agency does not need a model inventory or an ethics board. It needs answers to the questions staff actually face on a Tuesday afternoon: can I use this tool, can I paste this file into it, and do I have to tell the client?
The policy should apply to freelancers as well as employees. Many small firms rely on 1099 contractors, a group our guide to QuickBooks Solopreneur alternatives for 1099 contractors covers from the bookkeeping side, and their AI habits carry the same risks to your client data.
Start From a Framework, Not a Blank Page
The US National Institute of Standards and Technology released its AI Risk Management Framework (AI RMF 1.0) on 26 January 2023. NIST describes it as guidance for voluntary use and says it can help organisations in any sector and of any size. Its core is four functions: govern, map, measure and manage.
Small businesses can borrow the structure without the jargon. “Govern” becomes naming an owner and writing the rules. “Map” means listing where AI is used. “Measure” is checking outputs for errors. “Manage” is deciding what to stop, restrict or allow.
How to Write the Policy in Seven Steps
- Survey current use: ask every team member which AI tools they already use and for what. Make it amnesty-style, or people will under-report.
- Pick approved tools: list the specific products and plans staff may use for work, and note which account type (business or personal) is allowed. Check each vendor’s terms for whether your inputs are used to train its models.
- Classify your data: sort information into green, amber and red categories using the traffic-light system that follows.
- Set review rules: require human review of any AI output that goes to a customer, is published, or feeds a decision about a person.
- Decide on disclosure: state when clients or customers must be told that AI was used, and who decides in grey areas.
- List prohibited uses: name the tasks that are off-limits, such as automated hiring decisions without legal review.
- Name an owner and a review date: one person approves new tools, answers questions and updates the document.
The Data Traffic Light
Most AI incidents at small firms start with someone pasting the wrong thing into the wrong box. A simple classification makes the rule easy to remember.
| Colour | Examples | Rule |
|---|---|---|
| Green | Public website copy, published blog posts, generic how-to questions | Any approved tool |
| Amber | Internal process docs, draft proposals, anonymised sales figures | Approved business-tier tools only, with training on your data switched off where the vendor allows |
| Red | Customer personal data, health or financial records, passwords and API keys, unreleased financials, anything under an NDA | Never, unless the owner approves a specific tool and contract in writing |
If your team wants AI to answer questions from internal documents, a setup that keeps those files in your own controlled store is safer than pasting them into a chat window. Our explainer on retrieval-augmented generation covers how that works.
Three Legal Hot Spots for US Small Businesses
AI in Hiring
New York City’s Local Law 144 shows how quickly a cheap screening tool can create obligations. According to a Perkins Coie summary of the final rules, enforcement began on 5 July 2023. Employers using an automated employment decision tool for hiring or promotion must have an independent bias audit done within one year before use, post a summary of the results on their website, and give candidates at least 10 days’ notice. Fines run up to $500 for a first violation and $500 to $1,500 for each one after. Other states and cities have their own rules, so the safe policy line is that no AI tool screens, ranks or rejects candidates without the owner’s sign-off.
Marketing Claims About AI
If you sell a product or service, be careful about saying it is “AI-powered”. In a February 2023 business blog post, reported by law firm Kelley Drye, the Federal Trade Commission told advertisers to ask whether they were exaggerating what their AI can do, whether they could prove claims that it beats non-AI products, whether they had considered foreseeable risks, and whether the product uses AI at all. Your policy should send any public AI claim through the owner before it goes live.
Who Owns AI-Generated Work
The US Copyright Office’s report on copyrightability, issued on 29 January 2025 and summarised by Jenner & Block, concluded that prompts alone do not give a user enough control to be the author of the output. Human contributions, such as original edits, selection and arrangement, can still be protected. For a small business, that means a logo or a product description generated entirely by AI may be hard to protect, and client contracts that promise exclusive ownership of deliverables need a second look.
Worked Example: Scoring AI Uses by Risk
A quick way to decide what to allow is to score each use from 1 to 5 for how likely something goes wrong and 1 to 5 for how bad it would be, then multiply. The scores below are our illustration for a hypothetical 12-person US marketing agency, not industry data.
| Use | Likelihood | Impact | Score | Policy decision |
|---|---|---|---|---|
| Drafting social media captions | 3 | 2 | 6 | Allowed, human edits before posting |
| Code autocomplete on the agency website | 3 | 3 | 9 | Allowed in approved tools, code review required |
| Screening job applicants | 3 | 5 | 15 | Owner sign-off and legal check required |
| Summarising client emails with personal data in a free consumer chatbot | 4 | 5 | 20 | Prohibited |
We used three bands: 1 to 6 allowed with normal review, 7 to 12 allowed with extra checks, 13 and above needing written approval or banned outright. The exact numbers matter less than doing the exercise as a team, because it surfaces uses the owner did not know about.
Sample Clauses You Can Adapt
- Scope: “This policy applies to all employees, contractors and interns who use AI tools for company work, on company or personal devices.”
- Approved tools: “Only the tools listed in Appendix A may be used for company work. Requests for new tools go to [owner].”
- Data: “Red-category information must never be entered into an AI tool unless [owner] has approved that tool for that data in writing.”
- Accuracy: “The person who sends, publishes or acts on AI output is responsible for checking it. AI output is a draft.”
- People decisions: “AI tools may not be used to make or recommend hiring, firing, pay or promotion decisions without approval from [owner].”
- Reporting: “If you think confidential data was entered into an unapproved tool, tell [owner] the same day. Prompt reporting will not lead to discipline.”
Have a lawyer read the final version if you operate in a regulated field such as healthcare, finance or law, or if you hire in a city or state with AI-specific rules.
Rolling It Out Without Killing Adoption
A policy that bans everything gets ignored. The better aim is to make the approved route the easy one: pay for business accounts of the tools people already like, and publish a short list of good uses alongside the rules. Industry guides such as our list of AI tools for real estate agents show how quickly a team’s toolset can grow, which is why the approved-tools appendix should be a living list rather than part of the signed policy.
Run a 30-minute walkthrough when the policy launches, ask everyone to acknowledge it, and set a calendar reminder to review it every six months. More guides on putting AI to work sit in our AI section.
Can Staff Paste Customer Data Into ChatGPT?
Does a Small Business Need an AI Policy?
If staff or contractors use AI tools for work, yes. A short written policy sets data rules and review steps before a mistake forces the issue.
What Should an AI Acceptable Use Policy Include?
Approved tools, data classification rules, human review requirements, disclosure rules, prohibited uses, a named owner, a reporting process and a review date.
Is There a Free AI Policy Framework for Businesses?
NIST’s AI Risk Management Framework is free, voluntary and designed for organisations of any size. Its govern, map, measure and manage functions translate well into a small-business policy.
Can Employees Use ChatGPT With Customer Data?
Treat customer personal data as off-limits by default. Allow it only in a business-tier tool whose contract and data settings the owner has checked and approved in writing.
How Often Should an AI Policy Be Updated?
Every six months is a reasonable rhythm, plus whenever you adopt a major new tool or a law that affects your business changes.
NIST’s AI RMF and Law Firm Notes on Hiring, Ads and Copyright
- NIST: AI Risk Management Framework release, 26 January 2023
- Perkins Coie: New York City adopts final rules for law governing automated employment decision tools
- Kelley Drye: FTC reminds advertisers to keep AI claims in check
- Jenner & Block: US Copyright Office issues report on copyrightability of works incorporating AI-generated material
