AI usage policy template for a small company

The template

[Company] AI usage policy  ·  Owner: [name]  ·  Review: [date]

1. Approved tools
   Use [tool, plan] with your company account for company work.
   Personal AI accounts are for public information only.

2. Never put into any AI tool
   - passwords, keys, access codes
   - [customers'/patients'/candidates'] personal details
   - [list: payroll, contracts under NDA, unreleased figures, ...]
   unless [owner] has approved that tool for that data.

3. Review before it leaves the company
   A person reads and checks every AI-drafted [email/report/quote]
   before it goes to a [customer/supplier/regulator].
   Check facts, numbers, names, dates and promises.

4. Saying AI was used
   Say so when someone asks, and where [contract/law] requires it.

5. New tools
   Ask [owner] before using a new AI tool or connecting one to
   company systems. Answer within [3] working days.

6. Mistakes
   If something on the never list went into an AI tool, tell
   [owner] the same day. Reporting is never punished.

7. Training
   Everyone completes [session] within [30] days of starting.
   [Owner] keeps the attendance record.

8. Changes
   [Owner] reviews this page every [6] months and when a tool,
   contract or law changes.

How to fill the blanks

• Part 1: use a plan that doesn't train on your data by default: ChatGPT Business or Enterprise, Claude Team or Enterprise. On personal ChatGPT plans, training is on unless each person turns it off.
• Part 2: build the list from your contracts, your privacy notice and what you've promised customers. Name categories people recognize: "the client folder", "the payroll export".
• Part 3: name the documents, not "outputs". The UK Government's AI Playbook calls this keeping meaningful human control at the right stages.
• Part 7: in the EU, Article 4 of the AI Act asks companies using AI to support staff AI literacy; the Commission says an internal record is enough.

A filled-in example

Illustration: a made-up business. A 14-person architecture practice fills the template like this:

• Approved: Claude Team, company accounts. ChatGPT personal accounts for public research only.
• Never: signed client contracts, any client's agreed fees, planning applications before submission, staff salaries, anything from the HR folder, door codes and site access details.
• Review: a partner reads every AI-drafted client report and proposal letter before it's sent. Fees are added by hand after the draft, never by the AI.
• Disclosure: when a client asks, and in any document submitted to a planning authority that requires it.
• Owner: the practice manager; review every six months.

It took the practice manager 50 minutes with the template, and the partners' lawyer flagged one change: the disclosure part now refers to the client contract's confidentiality clause.

Make it real

1. Find out which AI tools people use today, by asking.
2. Fill the template with your tools, data and documents.
3. Have a lawyer review parts 2 and 4.
4. Launch it in a short session, not by email; see AI training for employees.
5. Put the rules into the AI itself where you can: shared instructions that remind people not to include client details.

Next step

The policy says what people must do; shared AI skills make it the default. A skill for proposal letters can carry "leave the fee as [FEE]; a partner fills it in" so nobody has to remember the rule. AI skills, explained covers the idea, and making your first Claude skill the steps. For the theory behind the policy, see AI governance for a small company.

The AI skill below fills the template for you: answer its questions about your tools, data and customers, and your AI writes the policy in plain language and marks each point a lawyer should check.

Questions

What should an AI usage policy include?

Approved tools and accounts, what never goes into AI, who reviews AI output before it leaves the company, when to disclose AI use, how to request a new tool, what to do after a mistake, training, an owner and a review date. One page is enough for a small company.

Is there a free AI usage policy template?

Yes, the one on this page: copy it, fill the blanks in brackets, and have a lawyer review the data and disclosure sections against your contracts and local law.

How is an AI usage policy different from AI governance?

Governance is the whole system: who decides, how risks are tracked, how rules are kept current. The usage policy is the one page every employee reads and follows; it's the part of governance a small company starts with.