AI usage policy: what to include, with examples

In short: AI usage policy: the short set of rules your team follows when using AI tools at work: which tools are approved, what must never be typed into them, and how every answer is checked before it’s used. Write it before something goes wrong and have every member of staff sign it. One leaked client file can cost you the account. Use our free one-page AI rules sheet to get your team working safely this week.

Written by Mike Armstrong, a company director of over 30 years. Last reviewed: 22 October 2026.

When I started my businesses, we had a policy for using computers at work and another for using the internet. The questions were the same as today's: what's allowed, what must never leave the building, and who answers for it when something goes wrong. Today I run three businesses and use AI tools in all of them every day, but nothing they write goes out until a person has checked it against the original source. An AI usage policy is simply the latest version of a document business owners have been writing for decades.

Let's leave the dial-up modems behind and look at a typical Monday in a small business today.

Dave has a proposal due by lunchtime. He pastes the client's sales figures into a free chatbot and asks it to "make it sing". It sings beautifully. It also adds that the client's sales "grew 40% last year", which nobody ever said, and the proposal goes out at 11.58am. Dave is very good at deadlines. Dave is less good at checking where a number came from.

On Tuesday the client rings to ask where the 40% came from. On Wednesday someone asks where their sales figures went. Nobody had told Dave which tools were approved, what must never go into them, or that every number gets checked. He wasn't careless. He just had no rules to follow.

On this Learn page you'll find out what an AI usage policy is, why your business needs one now, what to put in it, how to write one in six steps, two short examples, the rules to know in the US and UK, and the mistakes to avoid. You'll also find a free one-page rules sheet to start with.

What is an AI usage policy?

An AI usage policy is a short set of workplace rules that tells staff which AI tools they may use, what they must never put into them, and how AI output is checked before it is used or sent.

You'll also hear it called an AI acceptable use policy. For a small business, they're the same thing: a rulebook staff read and sign, like a section of a staff handbook. A few larger organisations also write a separate "AI policy" or AI strategy that covers which AI projects to invest in. That's a different document, and a small business rarely needs one to start.

If the idea feels new, it isn't. It's the same document you may have written years ago for computers and the internet, with a new tool in the middle.

So why does a small business need one now, rather than when it gets round to it?

Why your business needs an AI usage policy now

Because your team is probably already using AI, with or without a policy. In 2024, Microsoft and LinkedIn's Work Trend Index found that 75% of knowledge workers were using AI at work, and 78% of those were bringing their own AI tools rather than ones their employer provided. A tool nobody approved is a tool nobody set up safely.

Without rules, the risks are real and expensive:

• Leaked information: many AI tools keep what you type, and some use it to improve their products. The UK National Cyber Security Centre advises against putting sensitive information into queries to public AI tools.
• Made-up answers: AI can invent facts, figures, quotes and sources, and sound completely sure of itself. The US National Institute of Standards and Technology (NIST) lists this as one of the main risks of generative AI.
• Invented claims and reviews: a made-up result in a proposal can cost you a client, and fake reviews are banned outright (more on that below).
• Unfair decisions about people: AI can carry bias into hiring or performance decisions, and the rules on that are tightening.

The good news: a few pages of plain rules deal with almost all of it. Here's what goes in them.

What to include in an AI usage policy

A complete AI usage policy for a small business covers eight things. The US City of Boston's guidelines for staff using generative AI and the UK government's guidance to civil servants on generative AI cover the same ground.

• Who it covers: employees, contractors and anyone else doing work for you, on any device.
• Responsibility: you own what you send, with or without AI. "The AI wrote it" is never an excuse.
• Approved tools: which tools are allowed, on business accounts, and who approves new ones.
• What AI can be used for: a simple go ahead, ask first or never list.
• What never goes in: customers' personal details, staff records, confidential prices and plans, passwords, and anything shared in confidence.
• Checking: every fact, figure, quote and translation is checked against the original source before it is used.
• People and customers: a person makes the final decision about people, no AI-written reviews, and customers are told when they're talking to an AI.
• Training, reporting and review: a short briefing for everyone, a no-blame way to report AI mistakes, what happens if the rules are broken, and a review every six months.

Now let's turn that into a policy.

How to write an AI usage policy in six steps

1. Find out what your team already uses

Ask everyone which AI tools they use for work, including the free ones on their phones. Make it an amnesty, not an interrogation: you can't set sensible rules for tools you don't know about. You may be surprised. Dave certainly was.

2. Choose your approved tools

Pick a small number of tools and use their business versions, which usually let you stop your information being used to train the AI and give you more control over who sees what. Name one person who approves anything new. Personal accounts are never used for work information.

3. Draw the lines: go ahead, ask first, never

Drafting a letter you'll check before sending? Go ahead. Anything sent in your business's name for the first time, or an AI note-taker in a meeting? Ask first. Making the final decision about a person, or writing a review? Never. A short table beats ten pages of principles every time.

4. List what never goes in

Be specific: customers' personal details, staff records, confidential prices and plans, passwords, card and bank details, and anything a customer or supplier shared in confidence. If someone needs AI's help with a document holding any of these, the details come out first.

5. Make checking a rule, not a hope

Every fact, figure, quote, source and translation gets checked against the original, never against the AI. Then look at the work again once it's live, because a published page shows things the draft didn't. Hope is lovely, but it isn't a checking process.

6. Brief everyone, get it signed, and review it every six months

Walk your team through the policy, have each person sign to say they've read it, and include it in every new starter's first week. AI tools and the law change fast, so put a review date in the diary for six months' time.

Here's what the result can look like in practice.

AI usage policy examples

Two short examples, both typical of small businesses. The names are made up.

Example 1: a 15-person accounting firm (accountancy practice) in the US

Example 2: a six-person marketing agency in the UK

• Approved tools: one AI writing tool and one image tool, both on business accounts. The owner approves anything new.
• Go ahead: first drafts of blog posts and social posts, brainstorming headlines.
• Ask first: AI images in a client campaign, so the client knows and agrees.
• Never: writing reviews or testimonials, or copying another brand's style or logo.
• Check before sending: every statistic is traced to its original source and linked; anything that can't be traced comes out.

Different businesses, same backbone. The full versions, with every section ready to fill in, are inside our AI Policy Template.

Rules inside your business also sit alongside rules from outside it.

The laws and rules to know (US and UK)

This is a summary, not legal advice. AI law is changing fast, so check the current rules where you operate.

• Fake reviews (US): the Federal Trade Commission's rule on fake reviews and testimonials bans reviews that misrepresent who wrote them, including ones generated by AI.
• Fake reviews (UK): the Digital Markets, Competition and Consumers Act 2024 bans fake reviews, and the Competition and Markets Authority enforces it.
• Personal data (US): privacy laws vary by state and industry, and in New York City, AI tools used in hiring must be independently checked for bias each year.
• Personal data (UK): the Information Commissioner's Office is clear that data protection law applies to personal data used with AI, and a personal data breach that risks harm to people must be reported to it within 72 hours of becoming aware of it.
• Copyright (US): the US Copyright Office's view is that material generated entirely by AI is not protected by copyright; work a person has meaningfully shaped can be. In the UK, the law is less settled and under review.
• The European Union: if you trade in the EU, the EU AI Act brings in its rules in stages up to 2028. Take advice on what applies to you.

One more set of rules comes up for businesses working towards a certificate.

Does ISO 9001 require an AI usage policy?

Not by name. But ISO 9001:2026 asks you to protect your information from loss of confidentiality and improper use (clause 7.5.3), to look after property belonging to customers, which the 2026 edition says includes personal data (clause 8.5.3), and to make only the claims about your products and services that you can deliver (clause 8.2.2). An AI usage policy does all three. If you are working towards ISO 9001, our ISO 9001:2026 Certification-Ready System covers the whole standard.

Even with all that in place, a few mistakes catch businesses out.

Common mistakes with AI usage policies

• Banning AI outright. People use it anyway, on their phones, with no rules at all. That's shadow AI, and it's the riskiest kind.
• Writing a 30-page policy. Nobody reads it. A few pages with tables gets read, signed and followed.
• Leaving out the checking rule. A lot of AI trouble isn't the tool; it's an unchecked answer going out with your name on it.
• Never reviewing it. A policy written for last year's tools is already out of date.
• Punishing people who report mistakes. Do that once and you'll never hear about the next one, until a customer tells you.

What we've covered

An AI usage policy, also called an AI acceptable use policy, is a short set of rules your team reads and signs. It names the approved tools, draws the line between go ahead, ask first and never, lists what never goes in, makes checking a rule, keeps a person in charge of decisions about people, and gets reviewed every six months. Write it before something goes wrong, and Dave's next proposal goes out with real numbers in it.

What next

• Start free: fill in and print the AI rules on one page and put it where your team will see it.
• Get the full policy: the AI Policy Template gives you every section in Word: approved tools, the traffic-light table, the never list, the checking table, a worked example and a staff sign-off sheet.

AI usage policy FAQ

What should an AI usage policy include?

Who it covers, who is responsible, the approved tools, what AI can be used for, what must never go into it, how output is checked, rules on people and customers, and training, reporting, discipline and review. A few pages with tables is enough for a small business.

Is an AI acceptable use policy the same as an AI usage policy?

For a small business, yes. Both are the workplace rules staff read and sign. Larger organisations sometimes also write a broader AI strategy, which is a different document.

Are there AI usage policy examples I can follow?

Yes. This page has two short examples, a US accounting firm and a UK marketing agency. The AI Policy Template includes a full worked example ready to copy.

Should a small business just ban AI?

Usually not. People tend to use it anyway, on their own phones and accounts, with no rules at all. Approving a few tools and setting clear rules is safer than a ban nobody follows.

Is it safe to put company information into AI tools?

Only into approved tools, on business accounts, and never customers' personal details, staff records, passwords or confidential information. Many AI tools keep what you type, so the safe rule is: if in doubt, leave it out.

Who is responsible if AI gets something wrong?

The person who used it and sent the work, and the business behind them. That is why every AI answer is checked by a person before it is used.

Do staff need to sign an AI usage policy?

It is good practice. A signature shows each person has read the rules, and it gives you a record if anything goes wrong. The AI Policy Template includes a sign-off sheet.

How often should an AI usage policy be reviewed?

At least every six months, and sooner if you start using a new kind of tool or the law changes. Dave suggests putting it in the diary, not just in his memory.

About the author

Written by Mike Armstrong, senior ISO consultant, former company director, and founder of Plain Standards. In over 30 years running companies at director level, Mike built his own management systems to drive profit long before he adopted ISO 9001, so he comes at this from the owner's side, not the auditor's. Plain Standards helps small and medium sized businesses get ISO certified without a consultant.