Free AI Tools And Guides
Small Business AI Policy: What Employees Can and Cannot Share
Your staff are already using AI. A policy is not about stopping them — it is about making the safe path the obvious one. One page beats twenty. This is general guidance, not legal advice; check your own obligations before publishing a policy.
Last reviewed: September 2026
Five things a one-page policy needs
- 01Approved tools — the named tools staff may use for work, and the accounts they must use.
- 02Restricted data — what must never be pasted into a tool that is not on the approved list.
- 03Human review — which outputs need a person's sign-off before they leave the building.
- 04Accountability — the person who published it owns it, regardless of what drafted it.
- 05Escalation — who to tell, immediately and without blame, when something goes wrong.
Draw the line on data
| Class | Examples | Rule |
|---|---|---|
| Public | Marketing copy, published prices, job ads | Free to use |
| Internal | Draft plans, internal process notes | Approved business accounts only |
| Confidential | Customer records, contracts, pricing models | Approved accounts, named staff, no consumer tools |
| Regulated / sensitive | Health, financial, HR, children's data, credentials | Not without a documented decision |
Where a human must sign off
- Anything published under the business name.
- Anything sent to a customer, supplier, or regulator.
- Anything used to make a decision about a person — hiring, pay, or performance.
- Any figure that ends up in a quote, invoice, or report.
Rolling it out without a lecture
- 01Write the page. Keep it to one side of A4.
- 02Walk the team through it once, in ten minutes.
- 03Name the approved tools and actually pay for the business accounts.
- 04Ask people to flag near-misses; thank them when they do.
- 05Review it every six months, or whenever you add a tool.
Common questions
- Do we need an AI policy if we only have three staff?
- Yes, and it is easier at three than at thirty. One page and a ten-minute conversation is enough.
- Should we ban AI tools instead?
- Bans usually move the usage somewhere you cannot see. Naming approved tools and paying for business accounts gives you visibility.