Free AI Acceptable Use Policy Template for Small Businesses

An AI acceptable use policy template gives you a ready-made set of rules for how your team uses tools like ChatGPT, Copilot, Claude and Gemini at work. It answers four questions: which tools are approved, what information never goes into them, who checks AI output before it leaves the building, and who to ask. The free template below is written for businesses with roughly 5 to 100 employees, and you do not need to sign up or give an email to use it. Copy it, fill in the brackets, and roll it out in a week.

This is general information, not legal advice. Have your attorney or HR advisor read your final version, especially if you handle health, financial or legal records.

Why a short, clear policy beats a ban#

Banning AI feels safe. In practice it pushes the use onto personal phones and personal accounts, where you cannot see it. Your team is also probably unsure where the lines are today. In the U.S. results of a University of Melbourne and KPMG study (opens in a new tab) (surveyed from November 2024 to January 2025, including 1,019 people in the U.S. out of more than 48,000 in 47 countries), half of U.S. workers said they use AI tools at work without knowing whether it is allowed. In the same survey, 46% admitted uploading sensitive company information and intellectual property to public AI platforms, and 53% said they present AI-generated content as their own.

The bigger risk is the account, not the tool. A personal AI account runs on consumer terms your company never agreed to. Anthropic, for example, lets each person on its Free, Pro and Max plans decide (opens in a new tab) whether their data is used to improve Claude. On a personal account, that choice belongs to your employee, not to you. Anthropic says that change does not apply to services under its Commercial Terms, such as Claude for Work.

Business plans are written differently. Microsoft's documentation for the work version of Copilot states that prompts, responses and data accessed through Microsoft Graph are not used to train (opens in a new tab) the foundation models behind it. Google says Workspace does not use customer data for training models (opens in a new tab) without the customer's prior permission or instruction.

So the policy's first job is simple: move work into company accounts you control, and keep the most sensitive information out of AI altogether. A few pages people actually read do that better than a 20-page document nobody opens.

What should an AI acceptable use policy include?#

A useful policy for a small business covers 10 things. Each one answers a question your employees are already asking.

The free AI acceptable use policy template (copy and paste)#

Copy everything from the policy name down to the acknowledgment. Replace each item in [brackets] and delete any example that does not fit your business.

[Company Name] AI Acceptable Use Policy

• Effective date: [date]
• Policy owner: [name and title]
• Next review: [date six months from now]

1. Purpose and scope#

AI tools can save time on writing, summarizing, research and analysis. They can also expose private information and state wrong things with confidence. This policy explains how to use AI at work in a way that protects our customers, our coworkers and [Company Name].

It applies to all employees, contractors and interns, on any device, whenever the work is [Company Name] work. "AI tool" means any service that writes or generates text, images, audio, video or code, or that summarizes or analyzes information for you. That includes chat assistants, AI features inside software we already use, browser extensions and meeting note-takers.

2. Approved tools#

Use only these AI tools for company work, signed in with your company account:

• [Tool and plan, for example: Microsoft Copilot Chat with your work account]
• [Tool and plan]
• [AI features built into software we already use, such as our CRM or accounting system, for the data that software already holds]

Personal AI accounts, free or paid, are not approved for company work. To use anything not on this list, follow section 7 first. A free trial counts as a new tool.

3. What information can go into AI tools#

Green: fine in any approved tool. Information that is already public, such as our website, published marketing, general questions and public research.

Yellow: approved tools only, signed in with your company account. Internal information that is not public, such as drafts, procedures, pricing, proposals, meeting notes, and customer or vendor names and contact details without any Red items.

Red: never goes into any AI tool unless [Policy Owner] has approved that specific tool and use in writing.

• Social Security numbers, and driver's license, passport or state ID numbers
• Bank account, credit card or debit card numbers, and any security code, PIN or password
• Usernames or email addresses together with a password or security question
• Health, medical or health insurance information about anyone
• Employee records: pay, reviews, discipline, medical leave, background checks
• [Industry records, for example: patient charts, client legal matters, tax returns]
• Anything a contract or nondisclosure agreement says we must keep confidential
• Passwords, multifactor codes, network details and security settings

When you are unsure, treat it as Red and ask.

4. A person checks everything before it goes out#

You are responsible for any work you send, whether AI helped or not. Before AI-assisted work goes to a customer, vendor, job candidate, the public or a government agency:

1. Read all of it.
2. Check every name, number, date, quote, citation and link against the original source.
3. Remove anything you cannot verify.
4. Get sign-off from [role] for [contracts, legal notices, HR documents and quotes over a dollar amount you choose].

5. Things AI does not do here#

• No final decisions about people. Hiring, firing, discipline, pay, promotion and credit decisions are made by a person who can explain the reason. AI may help draft or organize. It does not decide.
• No fake reviews or testimonials. Never use AI to write customer reviews, testimonials or endorsements, or to pose as a customer.
• No impersonation. Never use AI to copy a real person's voice, face or writing without their written permission.
• Nothing that breaks another policy or the law. If it would be wrong to do by hand, it is wrong to do with AI.

6. Being open about AI#

You do not need to label every email AI helped you draft. You do need to:

• Make sure people know when they are talking to AI, such as a chatbot on our website.
• Tell everyone on a call or in a meeting before an AI note-taker or recorder joins, and turn it off if anyone objects. Recording rules differ by state.
• Answer honestly when a customer asks whether AI was used.
• Follow any contract that limits AI use or requires you to disclose it.

7. Asking for a new tool#

Send [Policy Owner] the tool's name, what you want to do with it, what information it would touch and what it costs. [Policy Owner] will check:

• Whether it offers a business plan we control, with company sign-in and the ability to remove someone's access when they leave
• Whether the vendor uses our data to train its models, and whether we can turn that off
• Where our data is stored and how long it is kept
• What it can see if it connects to our email, files or other systems

Expect an answer within [number] business days. Approved tools are added to section 2.

8. If something goes wrong#

If you put Red information into any AI tool, use an unapproved tool for company work, or send AI output that turns out to be wrong, tell [Policy Owner] right away and no later than [the end of the same business day]. Do not delete the chat first. We may need it to understand what happened. Reporting quickly is the right call and will be treated that way. Hiding a mistake is a violation of this policy.

9. Accounts, chats and files belong to the company#

AI accounts used for company work, and the chats, prompts, files, custom assistants and agents in them, are company records. Save anything important in [our shared drive or system], not only in chat history. When you leave [Company Name], we close or transfer your AI accounts the same way we handle your email.

10. Enforcement and review#

Violations are handled under [our disciplinary policy or handbook section]. [Policy Owner] reviews this policy every six months and whenever we approve a new tool. Questions go to [Policy Owner] at [email or phone extension].

Acknowledgment

I have read the [Company Name] AI Acceptable Use Policy, had the chance to ask questions, and agree to follow it.

• Employee name:
• Signature:
• Date:

Why the template says what it says#

The Red list starts with state breach law. Its first four items cover the data Wisconsin's and Florida's breach laws count as personal information, in most cases when it is tied to a person's name (details below). That is the data that can start a notice clock.

Human review is not optional. Microsoft's own Copilot documentation says the responses generative AI produces "aren't guaranteed to be 100% factual." (opens in a new tab) In the University of Melbourne and KPMG study (opens in a new tab), 58% of U.S. workers admitted relying on AI to complete work without properly evaluating the outcomes.

The fake review rule has teeth. The FTC's final rule banning fake reviews and testimonials (opens in a new tab), announced August 14, 2024, covers reviews that misrepresent that they are by someone who does not exist, "such as AI-generated fake reviews," and lets the FTC seek civil penalties against knowing violators.

Same-day reporting buys you time. Breach notice deadlines are counted in days. You need time to find out what was exposed, get advice and decide whether notice is required. Hearing about a mistake the same day gives you all of that time.

How to roll out your AI policy in one week#

Day 1: Pick your approved tools. Most small businesses need one general assistant for everyone, plus the AI already built into their other software. If you are still choosing, our side-by-side comparison of Copilot, ChatGPT, Claude and Gemini lays out the differences. If you run Microsoft 365, Microsoft says Copilot only surfaces data a user already has permission to view (opens in a new tab), so old sharing links matter. Our 12-point Microsoft Copilot readiness check walks through them.

Day 2: Fill in the brackets. Name the policy owner (often the owner, office manager or HR lead). Add Red items specific to your industry. Send the draft to your attorney or HR advisor.

Day 3: Hold a 30-minute team meeting. Walk through real examples from each role. Ask what people already use, with no penalty for anything before today. Their answers tell you which tools belong on the approved list.

Day 4: Move work into company accounts. Set up business seats, help people copy useful prompts out of personal accounts, and stop using those accounts for work.

Day 5: Make it official. Collect signed acknowledgments, add the policy to your handbook, and put the six-month review on the calendar.

Then train. A policy tells people what not to do. Training shows them what to do instead, which is the part that makes the rules stick.

Wisconsin and Florida: when a paste can become a breach question#

Neither state's breach notification law mentions AI. Both are written around personal information ending up with someone it should not, and both start a clock when you find out.

Wisconsin. Under Wis. Stat. § 134.98 (opens in a new tab), personal information is a person's name linked to an unencrypted Social Security number, driver's license or state ID number, financial account number (including credit or debit card numbers, or a code or password that opens the account), DNA profile or unique biometric data. When a business knows that personal information in its possession has been acquired by a person it has not authorized, it must make reasonable efforts to notify the people affected, within a reasonable time not to exceed 45 days after it learns of the acquisition. Notice is not required if the acquisition creates no material risk of identity theft or fraud. Our Wisconsin data breach notification law guide covers the details.

Florida. Under Fla. Stat. § 501.171 (opens in a new tab), a breach is "unauthorized access of data in electronic form containing personal information." Florida's list is longer. Along with Social Security, driver's license and financial account numbers and biometric data, it includes passport and military ID numbers, medical and health insurance information, and geolocation. It also covers a username or email address together with the password or security question and answer that opens an online account, even without a name. Notice to affected people is due no later than 30 days after the breach is determined or there is reason to believe one occurred (unless a law enforcement delay or a waiver applies), and a breach affecting 500 or more people in Florida must also be reported to the Department of Legal Affairs. See our guide to Florida's 30-day breach notice rule.

So is a customer's name and card number pasted into an employee's personal chatbot account an "unauthorized acquisition" or "unauthorized access"? It might be. Both laws also carve out good-faith access by your own employees for a business purpose. The answer turns on facts like the vendor's terms and what happened to the data, and it is a question for your attorney, not one to work out against a 30-day or 45-day clock. The template's Red list keeps that data out, business accounts put the vendor under terms your company accepted, and same-day reporting gives you the most time to get advice.

If HIPAA, PCI DSS or the FTC Safeguards Rule already applies to you, your AI policy should sit inside that program rather than beside it. Our compliance management work includes policy development for those frameworks.

Frequently asked questions#

Roll the policy out with your team#

A policy on paper changes little until people know what good AI use looks like in their own jobs. Book a team AI training and we will run a private, hands-on workshop for your company, so the rules arrive with practice. If you would rather have help writing the policy itself, our AI adoption consulting includes a written acceptable use policy, along with tool recommendations and help with the rollout.