An AI Use Policy for a Small Company

Large organizations write long AI governance documents with committees and review boards. A small company needs something people will read in five minutes and remember.

Two principles keep it useful. First, tailor it. Littler advises against relying on generic templates, because the policy has to reflect the specific risks and needs of the employer (Littler). A dental practice, a design studio and an accounting firm handle very different data. Second, be concrete. centrexIT recommends naming the specific approved tools, because that is clearer than describing categories of tools (centrexIT).

A good test: could a new employee read the policy and answer these questions without asking anyone?

• Which AI tools can I use for work, and on which account?
• What information must I never put into one?
• Do I need to check or disclose AI-generated work?
• What am I not allowed to use AI for at all?
• Who do I ask about a tool that is not on the list?

Examples do more work than principles. "Do not share confidential information" leaves people guessing about whether a customer's first name counts. "Do not paste customer emails, invoices or account details into any tool not on the approved list" does not. For each rule, add one example from your own business, using the documents and systems your staff handle every day.

Policy templates from law firms, HR publishers and security firms converge on a common set of sections. Here is what each should contain in a small company.

Littler stresses that the policy should cover everyone who might access the company's AI tools or systems, including independent contractors (Littler). Morgan Lewis lists the core contents in similar terms: scope and purpose, access and use controls such as approved tools and company logins, disclosure requirements, confidentiality and intellectual property provisions, and a named responsible person to whom employees report problems (Morgan Lewis).

For data rules, a tiered approach is easy to apply. centrexIT's template uses four tiers: public material that may go into any reputable tool; internal material allowed only in approved business tools on company accounts; sensitive data such as customer, employee, financial and regulated information that needs explicit approval and tools with data handling agreements; and credentials and encryption keys that must never be processed by AI tools at all (centrexIT).

For human review, the same template treats AI outputs as drafts that need human verification, and requires review for accuracy before AI-assisted content goes into customer communications, proposals or official documents (centrexIT).

Disclosure has two sides. Morgan Lewis distinguishes internal disclosure, such as telling a supervisor that AI was used, from external disclosure that may be required by law or by a tool's terms of use (Morgan Lewis). Fisher Phillips' sample policy asks employees to inform their supervisor when they have used a generative AI tool to help perform a task, and not to represent AI-generated work as their own original work (Fisher Phillips).

The biggest choice is what to do about free, public AI tools used on personal accounts. Brightmine notes that some large organizations banned public chatbots outright, and advises weighing the security, privacy and quality risks against the alternatives before allowing them (Brightmine).

For most small companies, a middle path works better than a ban:

• Public tools on personal accounts: allowed only for public information, such as rewording a published blog post or brainstorming general ideas.
• Business tools on company accounts: the default for internal work, after someone has read the vendor's data terms.
• Sensitive data: only in tools specifically approved for it, for named uses.

Fisher Phillips' sample policy offers a memorable rule for anything going into a public tool: treat every piece of information you provide as if it will go viral on the internet, attributed to you or the company, regardless of the tool's settings or its maker's assurances (Fisher Phillips). The same sample requires written permission from a supervisor and IT before anyone connects a generative AI tool to internal company software.

It also helps to list the kinds of work AI is good for in your business, not only what is forbidden. Brightmine suggests describing the types of tasks employees can and cannot use AI for, giving the example of allowing chatbots for routine emails but not for technical research (Brightmine). A short list of encouraged uses, such as first drafts of routine emails, summaries of long internal documents, or rewording a job advert, tells staff where to start.

Remember that AI is now built into tools you already pay for. Littler observes that AI features are being integrated into existing software, phones and computers in ways that can obscure the fact that AI is involved at all (Littler). Your policy should cover AI features inside your email, documents and customer systems, not only standalone chatbots.

Some uses carry more legal and ethical risk than others, and decisions about people are at the top of the list. Fisher Phillips' sample policy prohibits using generative AI tools to make or help make employment decisions about applicants or employees, including recruitment, hiring, promotion, performance monitoring, discipline and termination (Fisher Phillips).

Littler describes human oversight as a guardrail to observe at every stage of AI selection, deployment and use, and says an effective policy should state that AI tools cannot make final decisions without human involvement (Littler). It gives the example of a policy that keeps AI out of recruitment because of the risk of bias and the changing legal landscape in that area.

The same logic extends to customers. centrexIT's template prohibits using AI to make automated decisions affecting customers or employees without human review (centrexIT). In practice, AI can draft, summarize, sort and suggest. A person decides whether to hire someone, deny a refund, close an account or discipline an employee.

Adapt this to your business. Replace the bracketed parts, and have someone with legal knowledge check it against your local employment and privacy rules.

[COMPANY] AI USE POLICY            Owner: [name]   Next review: [date]

1. Purpose. AI tools can save time. This policy explains how to use
   them without risking our customers' trust, our data or our name.

2. Who it covers. Everyone who works for or with [COMPANY], including
   contractors and freelancers.

3. Approved tools. Use only these, on company accounts:
   [Tool A] for writing and research
   [Tool B] built into our email and documents
   [Tool C] for customer chat, configured by [owner]
   Ask [owner] before using anything else. Requests get an answer
   within [one week].

4. Data rules.
   Public information: any approved tool.
   Internal information: approved tools on company accounts only.
   Customer, employee, financial or health information: only in
   [named tools] for [named tasks], or not at all.
   Passwords, keys and payment card numbers: never.

5. Check everything. AI output is a draft. You are responsible for
   anything you send, publish or decide, whether AI helped or not.
   Check facts, figures, names and tone before it leaves the company.

6. Be open about it. Tell your manager when AI did a substantial part
   of a piece of work. Do not present AI output as a client's
   personalized advice without review by a qualified person.

7. Never use AI to:
   - make or recommend decisions about hiring, pay, discipline or firing
   - make final decisions about customers without a person's review
   - connect to our systems without approval from [owner]
   - get around security controls

8. Mistakes. If you put the wrong information into a tool, or AI
   output caused a problem, tell [owner] the same day. We fix problems;
   we do not punish honest reports.

9. Breaches of this policy are handled under our normal disciplinary
   process.

A policy nobody has read protects no one. Littler recommends training so employees understand the tools available to them, the policy itself, and how the tools affect their roles, along with periodic audits to check compliance (Littler). In a small company, a thirty-minute team session with real examples does more than a signed acknowledgment form.

Give it an owner and a calendar. centrexIT's template keeps the approved tool list under quarterly review and asks employees to check the current list before using any tool for work (centrexIT). FRSecure's template routes any AI platform use or integration through a review and approval step, including a vendor review and an impact analysis, and commits to updating the policy as risks, regulations and technology change (FRSecure).

Make reporting easy. Lattice's policy template includes rules for employees to report unethical uses of AI or policy violations (Lattice). The sample above goes further for a small team: an honest report of a mistake is not punished, so problems surface while they are still small.

Connect it to what you already have. Brightmine suggests stating how the AI policy works alongside existing policies on cybersecurity, privacy and conduct (Brightmine). Littler encourages employers to invite feedback and to update the policy to keep pace with legal requirements and best practice (Littler). Each time someone asks a question the policy cannot answer, add the answer.