AI Acceptable Use Policy: A One-Page Template for Small Business

For a company of 5 to 200 people, an AI acceptable use policy should make everyday decisions clear: which accounts staff may use, what data stays out, and who reviews the result. Start with a one-page policy, approved business access and a named person who answers questions. Keep AI-assisted work as a draft until a responsible human checks it.

AI Acceptable Use Policy Template

Copy the policy below into your company handbook or a shared document. Replace the bracketed fields, list only accounts you have approved, and give everyone access before the policy takes effect. The template is designed for one page; check the layout after adding your details.

Have counsel review the policy against your contracts and obligations before adoption.

AI use at [Company]

Effective: [date]. Owner: [name and role]. Questions or incidents: [contact]. Next review: [date]. Approved accounts and permitted data: [link to our current list].

1. Who this covers. Everyone doing work for us, including employees, managers and contractors, must follow these rules. They cover AI chat, writing, coding, image, meeting and search tools, including AI features inside other software.

2. Use approved accounts. Use only tools, plans and company workspaces on our approved list. A personal subscription or work email address alone is not approval. Do not add connections to other apps, browser extensions, meeting recording, automated actions or data-sharing options without the owner's approval. Never share logins.

3. Work you may do. In approved accounts, use public information and permitted internal material to brainstorm, draft, summarize or prepare work. Only use material you are authorized to share. Keep a person responsible for each task. Do not use AI for deception, harassment, discrimination, or to bypass access controls.

4. What never goes in. Never put passwords, access tokens, private keys, full payment-card details, government ID numbers, medical records or confidential employee records into these tools under this policy. Do not upload trade secrets, unreleased financials or private source code unless the approved list specifically permits that material. The same rules apply to files, screenshots, recordings and connected folders.

5. Customer data. Use invented examples or remove identifying details wherever possible. Before using identifiable customer information, obtain written approval for the specific task, tool, account and data. The owner must check our customer commitments, permission to share, vendor terms, access and retention settings. Send only what the task needs. If approval is missing or unclear, stop and ask.

6. Review before use. Check facts, sources, calculations, confidentiality, rights to use the material and unfair or misleading content before relying on, sending or publishing a result. The person sending it remains responsible. Code needs the normal review and tests. Do not let AI independently send messages, spend money, change records, or make hiring, pay, credit or other consequential decisions. Those uses need a separately approved process.

7. Be clear about AI use. Tell the internal reviewer when AI materially drafted or analyzed the work. Tell customers when our agreement requires it, when they interact directly with AI, or when hiding its role would mislead them. Do not describe AI output as a human interview, original research or personally verified work unless that is true. Ask the owner if unsure.

8. Ask and report promptly. Send new-tool and exception requests to the owner before use. Report suspected data exposure, unsafe actions or harmful output immediately through the contact above, without copying sensitive content into an open channel. Stop the affected activity and follow the owner's instructions. Acknowledge this policy; breaches are handled through our existing staff or contractor procedures. The owner reviews it quarterly and when tools, terms or workflows change.

Keep the policy short by maintaining its approved-account list separately. Each entry should name the exact product and plan, company workspace, permitted data, allowed task, responsible owner and approval date. An empty entry means the tool is awaiting approval.

Why Business Plans Matter for Staff AI Use

Approve the account and its data terms before staff use private business material. A vendor's promise to exclude business data from model training is valuable, but it does not itself authorize you to share a customer's records.

Verified against the makers' live documentation on 19 October 2026: the business services below carry commitments against training on covered customer data by default or without permission. Their scope and exceptions differ. Model training means using data to improve the underlying AI; it is separate from storing a conversation or processing it to answer your request.

OpenAI ChatGPT: Use the Approved Business Workspace

OpenAI ChatGPT, a conversational AI assistant, excludes ChatGPT Business and ChatGPT Enterprise customer content from model training by default. OpenAI's data-governance documentation confirms that commitment and discusses stored chat history separately. Review retention alongside the training terms when approving an account.

Treat reimbursing a personal subscription and approving a company workspace as separate decisions. Your account list should name the permitted workspace, and staff should be able to recognize it before pasting anything internal.

The ChatGPT for Business guide covers the broader account decision.

Anthropic Claude: Include the Feedback Rule

Anthropic Claude, an AI assistant for drafting and analysis, does not train on commercial-product inputs and outputs by default. For staff using Claude Team or Enterprise, an important exception is feedback: Anthropic says explicitly reported feedback or bugs, or other chosen sharing, can allow chats and coding sessions to be used for training. Anthropic's commercial-data policy explains both.

Make feedback sharing an owner decision. Anthropic documents an owner control under Organization settings > Data and Privacy > Rate chats to disable thumbs-up/down feedback for Team and Enterprise members. A staff rule saying “do not share company conversations as feedback” should accompany that setting.

Microsoft Copilot: Confirm Enterprise Data Protection

Microsoft Copilot, Microsoft's work assistant formerly named Microsoft 365 Copilot, and Microsoft Copilot Chat have organizational data protections. Microsoft says prompts, responses and data accessed through Microsoft Graph, its connection to work information, are not used to train foundation models. Its documentation notes that older product names may remain during the transition. Microsoft's enterprise data protection page gives the scope.

Have the administrator confirm the company account and covered service. Microsoft documents a green shield in Copilot Chat when enterprise data protection applies. It also documents conversation logging, so staff should not interpret the training restriction as “nothing is stored.” Copilot Chat privacy and protections explains these checks.

Web search queries sent to Bing have separate data-handling terms, and agents need their own terms checked. Record whether those features are allowed for each approved workflow. Approval of the main assistant should not silently approve every connected service.

Google Gemini: Check the Workspace Edition

Google Gemini, Google's AI assistant, has business protections when used through the appropriate Google Workspace services. Google says Workspace customer data is not used to train generative AI models without the customer's prior permission or instruction. That includes the prompts and content covered by its Google Workspace generative AI privacy hub.

For the Gemini app, confirm that the Workspace license includes it as a core service, meaning a service covered by the relevant Workspace terms. Google's current list includes Business Starter, Business Standard and Business Plus. Other account arrangements can have different protections; check the work-account edition table, rather than approving anything with a Google login.

If you are still deciding which service to standardize on, the Gemini vs Claude comparison and Copilot vs Gemini comparison cover the product choices. Your employee policy should point to the choices you have already approved.

How a Generative AI Acceptable Use Policy Works

An AI acceptable use policy is your company's set of rules for AI-assisted work. “Generative AI” means tools that create text, images, code or other content from instructions. Think of the policy as the rules for a shared kitchen: the equipment can be available to everyone while certain ingredients stay locked away and someone checks what leaves the counter.

For an owner, the job is to authorize tools and name the decision-maker. For an operations lead, it is to turn that decision into a usable account list and answer questions. For each employee, it is to check the inputs and own the output.

Separate Public, Internal and Restricted Material

Give staff examples they can recognize. A published product description is public. An unpublished operating checklist is internal and belongs only in an account approved for that material. A payroll export contains confidential employee information and stays outside the baseline policy.

Also inspect attachments. A screenshot of a harmless error may contain a customer's email address or an access token. Uploading the image still shares those details. A rule that covers only typed prompts misses the work people actually do.

Customer Data Needs Approval for the Task

“Remove the name” is a useful first step, but it may leave an address, order number, distinctive complaint or identifying combination of details. Prefer a fictional example when the customer's identity is irrelevant.

For a delivery-delay reply, a support lead can ask for wording using “a customer whose delivery is late” and the published delivery policy. The lead adds the correct customer details later in the normal support system. Uploading the full complaint thread is a different use and needs explicit approval.

When identity is necessary, the owner should record which fields may be shared, for what purpose, in which account, who can access them and how long they will remain. Existing permission to hold customer data should not be treated as automatic approval for a new AI workflow.

Human Review Means Checking the Work

The reviewer needs the original source material and enough knowledge to challenge the answer. A fluent reply can still promise a refund the company does not offer; a plausible spreadsheet summary can still use the wrong column.

Before release, verify the claims against the source, recalculate important totals and inspect the final audience and attachments. For consequential work, name a qualified reviewer. If nobody can evaluate the result, keep it as a draft and escalate it.

For disclosure, use plain language such as “AI helped draft this summary; I checked it against the source documents” only when that describes what happened. Minor spelling assistance and AI-written analysis need different levels of disclosure. Customer agreements and the risk of misleading the recipient decide the external disclosure.

AI Acceptable Use Policy Examples for Everyday Work

Adopt routine drafting now when the account, data and reviewer are clear. Wait on identifiable customer uploads and autonomous actions until their approvals are explicit. These are illustrative applications of the template:

• An owner preparing an announcement: use the approved assistant to rewrite already-public product details. Check every promise and date before publishing. There is no reason to upload the confidential launch budget.
• An operations lead handling support: create a reply from a fictionalized situation and the approved service policy. Keep the customer record in the support system unless a specific workflow permits it.
• An agency account manager: tell the internal reviewer that AI helped draft the client report. Check the client agreement before processing client material or deciding what disclosure belongs in the deliverable.
• A technical builder: use only a coding workflow approved for the repository's data. Review changes and run the project's normal checks. Permission to draft code does not authorize the assistant to deploy it.

A staff member researching a public topic within the approved rules can keep working. A staff member about to connect the shared customer folder should ask first. The policy should make that distinction easy.

Roll Out This AI Use Policy Template in 20 Minutes

Use one short meeting to practice the decisions staff will face. The agenda below is a proposed 20-minute format, not a claim that buying accounts, reviewing contracts and configuring access takes that long.

Before the meeting, the owner fills in the policy, confirms approved accounts, names a backup contact and publishes the account list. The administrator checks access and the relevant data-sharing settings. Managers identify who reviews customer-facing and consequential work.

1. 1

   5 minutes: Explain the rules

   Show the policy and say what staff may do today. Point to the prohibited-input list and name the person who can approve an unfamiliar use. Use the difference between a public product paragraph and a customer export to make the boundary concrete.

2. 2

   5 minutes: Confirm the accounts

   Have everyone locate the approved company workspace or service. Show where the approved list lives. Record access problems for follow-up; tell anyone without access to wait on work requiring that account.

3. 3

   7 minutes: Practice the decisions

   Walk through three cases: a public announcement, a customer complaint and a payroll export. Ask what can be used, what must be removed or kept out, and who checks the output. Under this baseline policy, the payroll export stays out. Demonstrate a prompt with invented details.

4. 4

   3 minutes: Confirm ownership and reporting

   Ask each person to acknowledge the policy and locate the questions-and-incidents contact. Confirm the reviewer for their normal work. Explain that reporting a mistake promptly helps contain it; concealing the mistake makes response harder.

After the first week, review the questions people asked. Fix ambiguous wording, remove unused approvals and add good examples. Keep the scheduled quarterly review, and revisit the policy whenever a new integration or workflow changes what data the assistant can see or what it can do.

What's Overhyped About an Acceptable Use Policy for AI?

A signed policy does not configure an account, revoke a connector or stop an automated send. Assign someone to make the settings and permissions match the document.

The business-data promises are also narrower than “safe for anything.” Training, storage, access, third-party services and your permission to share the material are separate questions. Business plans are a useful starting point, followed by an approval for the actual task.

Avoid measuring acceptable use by how much text AI wrote. A heavily assisted public draft can be appropriate after careful review; a short prompt containing a secret can fail the policy immediately. Judge the data, action and accountability.

Frequently Asked Questions

What is the 30% rule of AI?

This policy does not adopt a 30% quota. A percentage of AI-written text does not establish whether customer data may be shared or whether a result is accurate. Use the approved-account, permitted-data and human-review rules instead.

What are some acceptable uses of AI?

Examples include brainstorming with public information, drafting from permitted internal material and summarizing documents approved for that account. A responsible person must check the result before using it.

How much AI use is acceptable?

As much as the approved task permits and a person can responsibly verify. Stop when the data is prohibited, the action is unauthorized or nobody can judge the output.

What is an example of an acceptable use policy?

“Use approved company AI accounts for permitted work, keep restricted data out, and check every result before relying on or sharing it.” The template above adds the owner, disclosure and reporting rules needed to apply that instruction.

What is not allowed under the acceptable use policy?

The template prohibits credentials and the other listed sensitive records, unauthorized customer uploads, deceptive or discriminatory uses, and independent consequential actions outside a separately approved process. A tool being on the list does not override those restrictions.

What are the five most common statements used in acceptable use policies?

There is no universal ranking used here. For this small-business policy, prioritize five instructions: use approved accounts, protect data, review outputs, disclose material AI involvement appropriately, and report problems promptly.

What are three key elements of an effective acceptable use policy?

Clear permitted uses, specific data limits and an accountable person for review or escalation. Employees should be able to apply each element to a task they perform.

Can you give me an example of a policy?

A practical rule is: “Customer complaint threads may enter an AI tool only when the owner has approved the task, account and data; otherwise use a fictional example.” Copy the full template above for the surrounding rules.

Can you provide an example PDF of an IT acceptable use policy?

For an AI-specific document, copy the template above into your document editor, replace the bracketed fields and export it as a PDF. It covers AI use and should sit alongside your broader IT policy for devices, email, access and security.

For practical ways to put AI to work in a small business, join the newsletter.