An AI policy for small businesses that just use AI

What an AI policy is, and what it isn't

An AI policy, sometimes called an AI acceptable use policy, is a short internal document that tells your team how AI tools may be used at work. It isn't a compliance program or a twelve-page manual. If people won't read it, it doesn't exist.

Ridgeback Box Co., a 45-person maker of corrugated packaging, uses an assistant to draft emails and scheduling software to plan shifts. It didn't build either one. Like most small businesses, it just uses AI. For a company like that, the work comes down to two jobs: knowing which uses are sensitive, and writing down the house rules.

Why bother, if you only use AI

Because your team is already using it. If there's no policy, every person has written their own without telling you: which tool, which account, what they paste in. A written page fixes three things at once. People know what's allowed, client information stops traveling to personal accounts, and when something goes wrong there's somebody to ask.

What a one-page AI policy covers

Five questions, plus a review date. Each one takes a sentence or two.

1. Which tools are approved

Name them, and say which account to use. The real choice is between “only the tools we've approved” and “any tool, but on a company account.” A personal account is the one thing to rule out: the company can't see it, set it up, or switch it off when someone leaves.

2. What data stays out

List it in plain words: personal data about customers and employees, health data, passwords, bank details. Decide whether clients' confidential information is on the list too; if your contracts have confidentiality clauses, it probably should be. What each tool does with what you type varies by account, and we cover that in company data in ChatGPT.

3. Who checks the output

What an AI tool writes is a draft. It can state something false with total confidence. So the policy says who reads anything that goes out to a customer: the person sending it, or a second person. Dates, amounts and names get checked against the source.

4. What you don't use AI for

This is the line that matters most. The usual candidates: deciding about people (hiring, evaluating, firing), scoring or ranking individual customers, and talking to anyone without telling them it's AI.

5. Training, and who to ask

Twenty minutes showing how the tool works and where it goes wrong does more than a signed form. And name one person for questions. The questions will come either way.

And a review date

Tools change every few months. Six months is a reasonable interval, or sooner when you add a tool.

An AI policy for employees: how to roll it out

• Start from what people already do. Ask which tools they use before you write a word.
• Present it in person, with examples from each job, not as an email attachment.
• Explain the why behind each rule. “Client contracts stay out because clients asked us to keep them private” sticks better than “prohibited.”
• Don't ban everything. A flat ban usually ends the same way as silence: people keep using it, only in secret.
• Whether employees should sign it, and how it fits with your handbook, is a question for your attorney or HR advisor.

When the law comes into it

We're not going to tell you what your legal obligations are; that depends on your state, your industry and what you use AI for. These are the areas to raise with your attorney, with the official pages we could open.

Hiring and decisions about employees

This is where rules aimed at employers already exist. New York City's Local Law 144 is the clearest example. Per the city's Department of Consumer and Worker Protection, employers and employment agencies may use an automated employment decision tool only if three things are true. It has had a bias audit within one year of use. Information about the audit is publicly available. And certain notices have gone to employees or job candidates. The department says enforcement began on July 5, 2023 (NYC DCWP: automated employment decision tools, checked on November 12, 2026).

Colorado passed a broader law, SB24-205, “Consumer Protections for Artificial Intelligence.” The legislature's summary of the bill as enacted says a deployer of a high-risk AI system must use reasonable care to protect consumers from algorithmic discrimination. The duties include a risk management policy and an impact assessment (Colorado General Assembly: SB24-205, checked on November 12, 2026). That page describes the bill as it passed; we couldn't confirm from it the dates and details in force today, so we don't print them. If you operate in Colorado, ask your attorney where it stands.

Other states may have their own rules on AI in employment. Illinois is one people often ask about; we couldn't open its official text on the day we checked, so we don't summarize it. If you hire there, or anywhere you're unsure about, ask before you put AI anywhere near a hiring decision.

Does the EU AI Act apply to US companies?

It can. Article 2 of the EU's AI regulation says it applies to deployers of AI systems located in the EU. It also covers providers and deployers in a third country “where the output produced by the AI system is used in the Union” (Regulation (EU) 2024/1689 on EUR-Lex, checked on November 12, 2026). If you have no customers, staff or operations in Europe, it's unlikely to be the first thing on your list. If you sell into the EU or have people there, raise it with your attorney.

What you say about AI in public

If you advertise what an AI-based product or service can do, know that the Federal Trade Commission has brought cases over that kind of claim. It keeps a running page of its AI-related cases and statements (FTC: artificial intelligence, checked on November 12, 2026).

Your industry and your contracts

Health care and financial services carry their own privacy rules (HIPAA and the Gramm-Leach-Bliley Act are the names you'll hear), and client contracts often say where their information may go. We link the official pages in the guide to company data in ChatGPT. Ask your attorney which apply to you.

Common mistakes

• Thinking a policy is only for companies that build AI. Using it is enough to need house rules.
• Copying a ten-page template from a big company. Nobody reads it, so nobody follows it.
• Looking at the tool instead of the use.
• Writing it once and never touching it again.
• Leaving out the name of the person to ask.

When this guide isn't enough

Talk to an attorney if you use AI to screen or evaluate people, or to decide credit or pricing for individuals. Do the same if you make a product with AI inside, sell a tool to others under your own brand, or handle health or financial data. In those cases you may be more than a company that just uses AI.