- An AI policy for small business employees only has to answer three questions: which tools are approved, which information is off limits, and who signs off before an output is used.
- Approve one tool first, in writing, on company accounts. Comparing five tools delays the day people stop using personal accounts for company work.
- Read the vendor terms for the exact plan you will buy, on the day you decide, and paste the link into the approval. Terms differ by plan and change.
- Put a real name next to every sign-off. A role that nobody holds signs off nothing.
- A week after you share the page, ask three people which tools are approved. If they cannot answer, the policy has not landed.
The three questions every session ends on
The last of the five parts in our AI training is data and approval guardrails. Every participant leaves with a clear answer to three questions: which tools are approved, which information is off limits, and where a human must sign off. That is the whole of a workable AI policy for small business employees. Everything else is detail.
We put it at the end of every session for a plain reason. The first thing the training covers about tools is which data may go into them and which may not. A team that learns a fast workflow without those three answers learns it on whatever account each person happens to have.
Why a small business needs this before it needs more training
Picture the usual starting point: AI use has begun before anyone wrote a rule. Someone drafts customer emails in a personal ChatGPT account. Someone else summarises a contract in a free tool they found last month. Nobody decided this; it just happened, one person at a time.
The AI tool approval checklist names the goal in one line: end "everyone uses their personal account" by approving one tool, in writing. The companion AI data boundaries one-pager is built so that every employee can read it in two minutes. Between them, they are the policy. The rest of this post is how to fill them in, and where it goes wrong.
How to write an AI policy for small business employees
- Approve one tool first. Pick the tool people already want for three named tasks, such as a first-draft customer reply, a weekly report or a meeting summary. Do not start by comparing five products; that only delays the day personal accounts stop.
- Read the vendor terms for the exact plan, on the day. Answer five questions from the vendor's current pages: does it train on what you enter, how long data is kept, where it is stored, whether you can delete it, and whether there is an admin console with an audit log. Paste the link and the date. If the answer is "trains on our data, no opt-out", the fix is usually a different plan, not a different tool.
- Write the "never goes in" list in plain words. The template starts with passwords and access keys, government ID numbers, bank and card details, health information about any person, customer data under a contract or NDA that forbids it, and unreleased financial results. Add your own lines. If people need a lawyer to read the list, they will not follow it.
- Add a "check first" list and a "fine to use" list. Check first: customer names with account details, employee information such as pay and performance, contracts and legal letters. Fine to use: public information, your own published material, and anonymised data with names removed before it goes in.
- Put a real name next to each sign-off. Anything sent to a customer, anything with a number in it, anything that goes to leadership: each one gets a person, not a job title.
- Say what happens when something goes in that should not have. One line: tell a named person the same day. The template adds that there is no blame for reporting; the problem is not reporting.
- Tell everyone the same day you decide. One message: which tool, for what, use your company account, never put this in, questions go to this person. Then walk the team through the page in ten minutes and pin it where the work happens.
What goes on the page
| Question | What you write | Example line |
|---|---|---|
| Which tools are approved? | The tool, the plan, company accounts only, and who to ask about anything else | "Anything not on this list is not approved for company work." |
| Which information is off limits? | A "never" list, a "check first" list and a "fine to use" list | "Anonymised data: names and identifiers removed before it goes in." |
| Who signs off? | One named person per type of output | "Anything with a number in it: checked by the office manager." |
If you already keep a list of documents the AI is allowed to read, link it from the "fine to use" section. The approved source inventory is the one-page version of that list.
When a one-page AI policy does not work
It does not replace legal or security advice when you handle regulated data. Both templates say so on the page: the approval checklist organises a decision, and the boundaries page records working rules. If your business holds health, financial or other regulated information, treat the one page as the summary your team reads, and have counsel review the actual policy.
It does not work when nobody owns it. The page has an owner line for a reason. Tools and terms move every few months, so the checklist sets a review date; a page with no owner quietly goes out of date and people stop trusting it.
It does not work as a ban with no alternative. If the policy says what is forbidden but approves nothing, the work that people were doing with AI does not stop. It moves back to personal accounts, where you cannot see it.
And it does not work if it never gets tested. Writing the page is the easy part. The template's own check is blunt: ask three people a week later which tools are approved.
What to do in the next 14 days
- List every AI tool people in the office use today, including personal accounts. Ask; do not guess. Fifteen minutes.
- Fill in the approval checklist for the one tool most people already use, with the vendor terms open for the plan you would pay for. About thirty minutes.
- Draft the "never goes in" list and the three sign-off names, share them, and put a reminder in the calendar one week out to ask three people which tools are approved.
The approach in this post is what we teach in hands-on AI training for Dallas teams.
Questions people ask
Does a small business need an AI policy for employees?
If anyone on the team already uses AI for work, yes, because the rules exist either way; without a page, each person makes them up. A small business does not need a long document. One page that answers which tools are approved, what never goes in, and who signs off is enough to start.
What should an employee AI policy include?
The approved tools and plans, with company accounts only. A list of information that never goes into an AI tool, a list to check first, and a list that is fine to use. A named person who signs off on each type of output, and who to tell the same day if something went in that should not have.
Can employees use their personal ChatGPT account for work?
That is a decision for each company, and it is exactly the decision the approval checklist is there to make. The checklist is built around ending personal accounts for company work by approving one tool on company accounts, with a date after which personal accounts are no longer for company work.
What information should employees never put into AI tools?
A common starting list is passwords and access keys, government ID numbers, bank and card details, health information about any person, customer data covered by a contract or NDA that forbids it, and unreleased financial results. Add anything specific to your business, and keep the wording plain.
Is a one-page AI policy enough for a regulated business?
No. For regulated data, the one page is the summary employees read, not the policy itself. Have counsel and IT review the full policy, and keep the one page in step with it.