Write the policy as a short operating guide rather than a legal document. A useful small-team AI policy should name the approved tools, explain what information can be entered, define the human review required, set disclosure rules and identify one person who handles questions.
To create it, start with the workflows your team wants to improve. List the tools that are allowed, divide information into clear data categories, add review steps for customer-facing or high-risk work, and give everyone a simple route for asking before they proceed. Keep the first version short enough for people to use during a busy working day.
A workflow design approach for AI adoption can help you decide where AI assists, where a person decides and where an approval is required. For a wider view of suitable tools, compare options in this guide to AI tools for small business, then approve only the ones that fit your workflows and data rules.
The short answer: build five rules
A practical policy can be organised around five rules:
- Use approved tools only. Keep a short register of team or enterprise accounts, their owners and their permitted uses. Personal accounts should not be used for company information.
- Classify information before prompting. Public material may be suitable for approved tools. Internal information needs stronger controls. Personal, confidential and commercially sensitive information should be excluded unless a specific approved process exists.
- Keep a person accountable. AI can draft, summarise, classify or suggest. A named team member checks the result before it affects a customer, a decision, a contract, a campaign or the company’s reputation.
- Disclose assistance when appropriate. Be clear when an automated system directly interacts with customers or substantially creates an external deliverable. Follow client agreements and sector requirements where they set a higher standard.
- Ask the AI lead when uncertain. One owner should maintain the tool list, review new use cases and handle incidents or unclear data questions.
Put these rules near the front of the policy. The rest of the document should explain how they work in sales, marketing, customer support and operational workflows.
Why a small business needs a policy
People may use AI for ordinary work such as drafting emails, researching prospects, summarising calls and preparing support replies. A policy gives employees a safe way to use useful tools openly, rather than leaving each person to interpret unclear boundaries.
This matters because disclosure can feel risky when no internal rule exists. Research from Slack’s Workforce Lab found that 48% of surveyed desk workers were uncomfortable telling their direct managers that they used artificial intelligence for common job tasks (Slack Workforce Lab, 2024). A clear policy should make responsible use easier to discuss, while still setting firm limits around confidential information and external claims.
Written rules alone do not create control. The Littler Mendelson Annual Employer Survey found that 68% of surveyed employers had a formal workplace AI policy, while only 55% had an approval process for specific tools and 54% had concrete limits on the data employees could enter (Littler Mendelson Annual Employer Survey, 2026). Your policy needs a route from principle to action: which tool, which data, which review and which owner.
The risk also depends on the product and account type. Consumer and business plans can have different settings for data use, retention and administration, and vendor terms can change. Check the current terms for every approved tool and record what the account provides. A business may choose a team or enterprise plan with suitable contractual protections, but that does not make every type of information safe to paste into it.
Start with workflows and ownership
Begin with three to five real workflows. Choose work that is frequent, reasonably bounded and easy to review, such as creating a first campaign brief, turning a call transcript into action points or drafting a response to a common support question. Avoid a general instruction such as “use AI wherever useful”, because it gives people no practical boundary.
For each workflow, write down four things:
- The task and its purpose.
- The approved tool and account type.
- The information the tool may receive.
- The person who reviews and owns the final result.
For example, a marketing team might allow an approved business account to turn a public product page into draft campaign variations. The marketing owner checks claims, audience fit, accessibility and brand requirements before publication. A sales team might use AI to prepare research questions from public company information, while the salesperson verifies every fact before it enters a prospect conversation.
Assign one AI lead rather than forming a large committee. This could be an operations manager, marketing lead or founder, depending on the size of the business. The AI lead maintains the approved tool register, checks vendor terms, records decisions and reviews new use case requests. A target response time, such as two working days, helps people know when they can expect an answer without turning the process into a barrier.
The AI lead does not own every output. The person using AI owns the accuracy and suitability of the work they submit, send or publish. This keeps accountability close to the workflow.
Set simple data rules
A traffic-light model makes the policy easier to remember. Define the categories in your own language, then give examples that match your business.
| Category | Examples | Rule |
|---|---|---|
| Green | Public web copy, published product information, open-source documentation | Allowed in approved tools after checking the tool’s permitted use |
| Yellow | Anonymised meeting notes, internal process descriptions, aggregate operational information | Allowed only in approved business workspaces with suitable data controls |
| Red | Customer personal data, passwords, confidential contracts, proprietary code, unannounced financial information | Do not enter into generative AI prompts |
Green information still needs care. Public information can be inaccurate, copyrighted or unsuitable for a particular purpose. The user remains responsible for checking the output and using the source material properly.
Yellow information needs careful preparation. Remove names, email addresses, phone numbers, account identifiers, financial figures and other details that could identify a person or reveal a sensitive matter. If the work cannot be anonymised, ask the AI lead before proceeding.
Red information should stay outside general-purpose generative tools. This includes customer records, passwords, private legal documents, confidential pricing and unreleased business plans. The Information Commissioner’s Office explains that entering personal information into a generative AI tool is personal data processing, including when the entry is incidental or unintentional (ICO, 2024). If red data is entered by mistake, stop using the output, inform the AI lead, record what happened and follow the company’s incident process.
Also address retention. Information may remain in a provider’s systems for safety, abuse monitoring or other stated purposes, even when it is not used to train future models. Tell users to check account settings and provider terms rather than assuming that closing a chat deletes information immediately. Graphite’s overview of AI privacy and security highlights the need to review retention, training use, access controls and contractual terms for business deployments (Graphite, 2026).
Define review and disclosure rules
Human review should be specific. “Check the output” is too vague for a useful policy. State what the reviewer must verify and what they have authority to change or reject.
For customer-facing work, the reviewer should check facts, calculations, names, tone, promises, citations, personalisation and compliance with the brief. For internal analysis, the reviewer should check whether the source material was suitable, whether important context has been lost and whether the result is being treated as a suggestion rather than a verified fact.
The National Institute of Standards and Technology describes four functions for managing AI risk: Govern, Map, Measure and Manage (NIST, 2023). A small business can apply those ideas without creating enterprise bureaucracy:
- Govern: name the AI lead, approved tools and accountable users.
- Map: record where AI is used, what information it receives and who is affected.
- Measure: test accuracy, omissions, bias, security and failure cases.
- Manage: correct the workflow, pause the use case or remove the tool when risks are unacceptable.
The reviewer must understand enough about the work to challenge the draft. A quick glance is weak oversight if the person cannot check the facts or lacks authority to reject the result. For high-impact work, require a second reviewer or a subject-matter owner.
Disclosure needs a clear internal standard. Require it when an AI system communicates directly with a customer, when automated content substantially shapes an external deliverable, when a contract requires it or when withholding the information could create a misleading impression. For routine internal assistance, record AI involvement where another person may need to understand how the work was produced.
Business guidance also makes clear that companies remain responsible for deceptive claims and errors in AI-assisted outputs (Littler, 2025). Prohibit invented sources, unsupported performance claims and statements that imply human work was completed when an automated system produced the material.
Turn the policy into daily decisions
The policy should include a short decision path that a team member can follow without interpreting legal language.
Before using AI: identify the task, check the data category and confirm that the tool is approved.
While using AI: provide only the minimum information needed, follow the approved workflow and avoid copying full records when a summary or redacted extract will do.
Before sharing the result: check facts, calculations, sources, tone, confidentiality and the intended audience. Confirm that a named person accepts responsibility for the final version.
When uncertain: pause and ask the AI lead. Do not solve uncertainty by trying another free tool or removing only part of a sensitive record.
After an incident: preserve enough information to understand what happened, notify the owner and follow the business’s privacy or security process. Do not delete evidence before the issue has been assessed.
A simple internal label can help with traceability. For example, a document can carry a note that says “AI-assisted, reviewed by the marketing lead” in the working file or project record. The label does not replace review. It helps the next person know where to inspect the work.
For marketing, the rule might require checking every factual claim and approval before a campaign goes live. For sales, it might require verifying prospect research against the original company source before a call. For customer support, it might allow suggested replies for common questions but require a trained person to handle complaints, refunds, account security and vulnerable customers.
Put the rules in a two-page document
Use this structure for the first version:
- Purpose and scope: who the policy covers and which work it applies to.
- Approved tools: tool name, account owner, permitted workflows and review date.
- Data rules: the Green, Yellow and Red categories, with business-specific examples.
- Review rules: what must be checked before internal use, customer contact or publication.
- Disclosure rules: when to tell customers, clients or colleagues about AI assistance.
- Ownership: the user’s accountability, the AI lead’s role and the route for escalation.
- Incident response: what to do after entering sensitive data or sending an unchecked output.
- Review date: when the policy and tool register will be checked again.
Keep a separate tool register if the list becomes longer than the policy. For each tool, record the business owner, account type, allowed workflows, data restrictions, relevant vendor terms and next review date. Re-check vendor privacy settings and terms at least twice a year, and sooner when a provider announces a major product or policy change.
Do not rely on automated AI detectors to police staff behaviour. Such detectors can produce false positives and false negatives, which can damage trust without proving how work was created. Clear expectations, useful training, transparent labelling and occasional workflow checks are more practical for a small team.
Test the policy with one real task from sales, marketing and customer support. Ask each person to use the document without verbal help. Wherever they pause, add an example or rewrite the rule. A policy is ready for wider use when a new team member can understand what to do with an ordinary work request.
Where to start this week
On Monday, choose one workflow and write its current steps. Mark the points where information enters a tool, where a person reviews an output and where a customer or colleague could be affected. Then create the first approved tool list and apply the traffic-light data rules to that workflow.
On Tuesday, ask the team to test three hypothetical prompts: one with public information, one with anonymised internal information and one with customer information. The expected response should be clear: proceed, check the business workspace and safeguards, or stop and ask.
On Wednesday, name the AI lead and add the escalation route to the policy. On Thursday, run a review exercise using a deliberately imperfect draft, checking whether the reviewer spots unsupported claims, missing context and inappropriate tone. On Friday, publish the short version and set a review date.
This creates a small, owned system that can grow with evidence. It also gives training a practical purpose: people learn how to use AI inside the workflows and boundaries the business has chosen. If your team needs guided practice with real sales or marketing workflows, the AI Accelerator live training provides a structured way to build those habits.
