Free template · 2026
AI Acceptable Use Policy Template for Small Businesses (Free, 2026)
A plain-English AI policy for employees that you can copy, fill in and roll out in a week, with an approved-tools table, data rules and add-ons for law firms, promo distributors, agencies and hospitality.
By Chad Westleigh · Updated
Download the AI acceptable use policy template (.docx)
Editable Word document with all 11 sections, the approved-tools table, an acknowledgment page and industry add-ons. Free, no email required.
Download the templateHow to use this AI acceptable use policy template
Copy the policy below into your own document, replace every bracketed placeholder such as [Company Name] and [Policy Owner], delete what doesn't apply, and add the industry add-on that fits your business.
The template assumes you pay for business or enterprise tiers of the AI tools you approve, because those tiers typically include admin controls and contractual data protections that consumer plans lack. Plan names and features change often, so confirm current terms with each vendor.
1. Purpose of this AI policy
[Company Name] encourages team members to use AI tools to work faster and more effectively. This AI Acceptable Use Policy sets the rules that make that safe: which tools are approved, what data may go into them, when a person must review the output, and how to report problems. The goal is confident, responsible use, not avoidance.
2. Scope: who and what this policy covers
This policy applies to all employees, contractors, interns and temporary staff of [Company Name] (“team members”) whenever they use AI for company work, on any device.
It covers AI assistants, AI features inside other software, meeting notetakers, image, audio and video generators, automation platforms that call AI models, and custom AI agents or integrations built for [Company Name], on company accounts and on personal accounts used for work. [Policy Owner] owns this policy and answers questions about it.
3. Data classification: what can and can't go into AI tools
Before using an AI tool, team members classify the information they plan to share. When in doubt, treat it as Restricted and ask [Policy Owner].
- Public: already published, such as website copy, product details and press releases. Any approved tool.
- Internal: everyday business information not meant for outsiders, such as internal processes and drafts. Company-approved tools only.
- Confidential: client and supplier business information, contract terms with personal details removed, pricing, margins and strategy. The company's business or enterprise AI workspace only, sharing the minimum needed.
- Restricted (never paste into any AI chat or prompt): personal data about clients, customers, guests or employees (contact details, addresses, dates of birth, ID numbers, health or dietary information); payment card, bank and non-public financial data; passwords, API keys and other credentials; unreleased product, pricing, fundraising or acquisition plans; legal matters and privileged communications; and anything an NDA or client contract bars from third-party tools.
Restricted data may be processed only by systems [Policy Owner] has approved in writing for that purpose, such as a reviewed order-handling integration. Removing names does not make data safe if a person or client could still be identified.
4. Approved AI tools and plan tiers
[Policy Owner] maintains this table as the company's AI tool register. Tools not listed are not approved for company data. Request additions through [request channel].
| Tool | Approved tier | Allowed data | Notes |
|---|---|---|---|
| [Primary AI assistant] | Enterprise or Business tier of a major AI assistant, on the company account | Public, Internal, Confidential | Company sign-in (SSO where available). Admin confirms the vendor does not train models on company data under this plan. |
| [Secondary AI assistant], if needed | Enterprise or Business tier only | Public, Internal, Confidential | Approved for a named use case only, such as research or image generation. |
| AI features inside approved software (CRM, email, documents, ecommerce) | The company's existing paid plan | Data already stored in that system | Turn on only features [Policy Owner] has reviewed. |
| AI meeting notetaker: [Tool name] | Company account only | Internal, Confidential | Tell participants when a meeting is recorded; follow client and local consent rules. |
| Automation platform, e.g. n8n, Make or Zapier | Company-owned account | Only what each approved workflow needs | Every workflow has a named owner and is listed here. |
| Custom AI agents, connectors and MCP servers | Approved per project by [Policy Owner] | As scoped in the written approval | See section 8. |
| Consumer or free tier of any AI tool, including personal accounts | Not approved for company data | Public only | Never use for client, customer or employee information. |
| Browser extensions and unreviewed AI apps | Not approved | None | Request a review before installing. |
5. Human review rules for AI output
AI output is a draft until a person checks it, and the team member who uses AI is responsible for the result.
- A named person reviews AI output before it reaches a client, customer or the public, or is used to make a decision.
- Check facts, figures, names, quotes, links and citations against a reliable source. AI tools can produce confident, wrong answers.
- Apply extra review to legal, financial, medical, safety, pricing and contractual content, and to code before it runs in production.
- AI may not make final decisions about hiring, firing, pay, promotion, discipline or credit for an individual.
- AI agents that take actions, such as sending email, updating records or changing a website, need human approval for each action until [Policy Owner] approves more autonomy in writing.
6. Disclosure of AI use
[Company Name] is open about how it uses AI.
- Tell clients when AI materially contributed to work delivered to them, and follow client contract terms on AI use.
- Chatbots and automated messages identify themselves as AI and offer a route to a person.
- Label AI-generated images, audio and video that could be mistaken for real people, places or events.
- Never present AI output as expert review when no expert reviewed it, and never imitate a real person's voice or likeness without written consent.
7. Intellectual property and copyright
Work that team members create with AI tools for [Company Name] is company work product, subject to employment and contractor agreements.
- Don't upload third-party content, such as licensed images or client files, unless [Company Name] has the right to use it that way.
- Don't prompt AI tools to copy a specific living artist, author or brand, or to reproduce trademarks and logos you don't have rights to.
- Check important outputs for close similarity to existing work before publishing.
- Material generated entirely by AI may not qualify for copyright protection. For logos and other key assets, keep a record of the human creative work involved and ask counsel when ownership matters.
8. Security: connectors, MCP servers and API keys
Connecting AI tools to company systems creates new access paths, so those connections get the same care as any other system access.
- Only [Policy Owner] or [IT Contact] may approve connectors, MCP servers, plug-ins or API integrations that give an AI tool access to company systems or data.
- Grant the least access needed: start read-only and add write access only for a documented need.
- Store API keys and tokens in [password manager or secrets vault], never in prompts, documents, chat threads or code repositories.
- Use company sign-in with multi-factor authentication for every AI tool.
- Install MCP servers and AI extensions only from sources [Policy Owner] has reviewed, and remove access and rotate keys when a project ends or a team member leaves.
9. Incident reporting
Report AI incidents to [contact or channel] within [24 hours]. Incidents include Restricted data entered into any AI tool, Confidential data entered into an unapproved tool, AI output sent to a client with a material error, an AI agent taking an unexpected action, and an exposed API key.
Stop using the tool for that task, note what was shared and when, and report it. [Policy Owner] assesses the impact, rotates credentials if needed, and notifies clients or authorities when contracts or law require it. Prompt self-reporting is treated as responsible behavior.
10. Training requirement
Team members complete [Company Name]'s AI training before receiving access to approved AI tools, and within [30 days] of joining. Training covers this policy, the data classification rules, how to review AI output, and hands-on practice with the approved tools on real tasks. A refresher is required [every 12 months] and whenever [Policy Owner] approves a significant new tool.
11. Policy review cadence and acknowledgment
[Policy Owner] reviews this policy [every six months], and after any incident, new tool approval, material change in a vendor's terms or new legal requirement. Each version is dated and logged, and team members are notified of changes.
Version: [1.0] · Effective date: [Effective Date] · Next review: [Review Date]
Acknowledgment: I have read and understand [Company Name]'s AI Acceptable Use Policy and agree to follow it. Name: [Name] · Role: [Role] · Signature: [Signature] · Date: [Date]
Industry add-ons for your AI acceptable use policy
Add the block that fits your business to sections 3 and 5 of the policy.
### Law firms - Client confidential information is Restricted unless [Firm Name] has confirmed the tool's confidentiality protections and, where required, obtained the client's informed consent. - Lawyers verify every citation, quotation and legal conclusion produced with AI, and supervising lawyers make sure associates, paralegals and staff follow this policy. - Fees reflect the work actually performed; check AI-related billing against your engagement letters. - Map these rules to your jurisdiction's professional conduct rules, ABA Formal Opinion 512 on generative AI tools, and your state bar's guidance. More on AI for law firms.
### Promotional products distributors - Client logos and artwork are Confidential. Never upload them to consumer image generators or tools that may reuse uploads. - Purchase orders, client pricing, supplier costs and decorator pricing are Confidential; contact details on POs are Restricted. - AI-generated mockups are labeled as concepts, never sent as production proofs. A person approves every proof against the PO. More on AI for promotional products distributors.
### Marketing agencies - Keep each client in a separate project or workspace, so one client's materials never inform another's work. - Follow each client contract's AI clauses. If a contract is silent, ask the account lead first. - Client brand assets, unreleased campaigns and performance data are Confidential; client customer lists are Restricted. More on AI for marketing agencies.
### Hospitality and restaurants - Guest contact details, booking or stay details, payment data, and dietary, allergy or accessibility information are Restricted. - Staff confirm allergy and dietary information through a person and approved systems, never from AI output alone. - A manager approves AI-drafted review responses before posting, and guest-facing chat assistants identify as AI and hand off to staff for complaints and safety issues. More on AI for restaurants and hospitality groups.
How to roll out your AI acceptable use policy in a week
A policy only works if people know it and have approved tools to use. This five-day plan fits a small business with one owner driving it.
Day 1: Name an owner and take inventory
Appoint [Policy Owner]. Ask every team member which AI tools they use for work today, including personal accounts and browser extensions.
Day 2: Choose approved tools and tiers
Fill in the approved-tools table, move work use onto business or enterprise tiers, and set admin controls, including turning off training on company data where the plan allows.
Day 3: Fill in the template and review it
Replace the placeholders, add your industry add-on, and have leadership and, ideally, counsel review the draft.
Day 4: Publish and walk the team through it
Share the policy at a short all-hands, with real examples of what's allowed and what isn't for each role.
Day 5: Train, collect acknowledgments, set the review date
Run hands-on training on the approved tools, collect signed acknowledgments, and put the six-month review in the calendar.
This AI policy template is not legal advice
Operator Intelligence is an AI enablement consultancy, not a law firm, and this template is general information, not legal advice. Laws, professional rules and vendor terms vary by industry and location, and they change. Have qualified counsel review your policy before you adopt it, especially in a regulated industry, when you handle sensitive personal data, or if you have staff or customers in the EU, where the EU AI Act's AI literacy requirement (Article 4) has applied since February 2, 2025.
The AI training behind the policy
A policy tells people what not to do; training shows them what to do instead. Operator Intelligence AI training for teams covers data rules and output review, and every program ends with configured AI instances, such as Claude Projects or reusable skills for ChatGPT, Claude and Gemini, running in your team's own approved accounts. AI workspace setup configures the approved tools and admin settings, and the Team AI Bootcamp gives each participant hands-on practice on real tasks.
Frequently asked questions
What is an AI acceptable use policy?
An AI acceptable use policy is a short internal document that sets the rules for how employees use AI at work: approved tools and plan tiers, what data can go into them, when a person must review output, and how to report problems. It gives teams permission to use AI inside clear guardrails.
Does a small business need an AI policy?
Yes, if anyone on your team uses AI for work, including on personal accounts. Without a policy, client data can end up in consumer tools your company doesn't control. A short policy plus approved business-tier tools is usually enough to start.
Should we ban ChatGPT and other consumer AI tools?
Bans are hard to enforce and can push AI use onto personal accounts you can't see. A more workable approach is to approve business or enterprise tiers for company data and limit consumer tiers to public information, as this template's approved-tools table does.
How often should we update our AI policy?
Review it at least every six months, and after an incident, a new tool approval or a change in a vendor's terms. The approved-tools table usually needs the most frequent updates, because AI tools add connectors and agent features quickly.
Is this AI policy template free to use?
Yes. Copy it, edit it and use it inside your company. No sign-up is required.
Can Operator Intelligence help us roll out the policy?
Yes. We help teams fill in the approved-tools table, configure business-tier AI workspaces and train staff on the rules. We don't provide legal advice, so have counsel review the final policy. Contact us to talk it through.
Put your AI policy to work
Operator Intelligence trains teams on the rules and configures approved AI tools for their real work, so the policy and daily practice match.
Book a scoping callGet the Operator Intelligence briefing
A short, practical note every two weeks on what is working with AI in real businesses. No spam; unsubscribe anytime.
Related
AI training for teams
Hands-on training that ends with configured AI in your own accounts.
AI workspace setup
Claude Projects, ChatGPT plugins and Gemini skills built for your team.
AI for franchise systems
Rolling out AI policy and training across every unit.
Free AI readiness assessment
Score your business across six dimensions in about 5 minutes.
AI governance consulting
Right-sized governance for lean companies.
What is shadow AI?
Unapproved AI use, and how to manage it.