Your team is probably already using AI tools, whether you have a policy or not. A short policy makes sure they use them safely, with your customers' data and your reputation in mind.
Why write one now
Without rules, each person decides alone what is fine to paste into a chat tool. Most will be careful. One mistake with customer data or an unchecked AI answer sent to a client can still cost you trust.
A policy does not need to be long. One page that everyone has read beats a long document nobody opens.
What to include
- Which AI tools are approved for work, and which accounts to use.
- What must never be entered: customer personal data, passwords, financial details, anything confidential.
- That a person reviews AI output before it is sent, published or acted on.
- When to tell customers that AI was used, if your industry or the law requires it.
- Who owns the policy, and who to ask with questions.
A template
Purpose. We use AI tools to work faster and better. This policy keeps our customers' information safe and our work accurate.
Approved tools. [List the tools]. Use your work account, not a personal one.
Never enter. Customer names with personal details, contact or payment information, passwords, contracts, financial records or anything marked confidential. When in doubt, remove the details or ask.
Always review. A person checks every AI-assisted email, document, post or decision before it leaves the business. You are responsible for anything you send, however it was drafted.
Facts and numbers. Check prices, dates, figures and claims against the source. AI tools can be confidently wrong.
Being open. If a customer asks whether AI was used, answer honestly. Follow any rules in our industry about disclosing AI use.
Questions. Ask [name]. This policy is reviewed every six months.
Last updated: ______
Make it practical
- Give examples. "Summarising your own meeting notes is fine. Pasting a customer's contract is not." Examples teach more than rules.
- Share good prompts. A shared page of prompts that work saves everyone time. There is a list in ChatGPT prompts for small business owners.
- Share the business context. If everyone pastes the same short page about your business, products and voice, AI output is more consistent. See how to give AI context about your business.
Check the rules that apply to you
Data protection and AI rules differ by country and industry. If you handle health, legal, financial or children's data, the bar is higher. Check the rules that apply to you, and ask a lawyer if you are unsure. This template is a starting point, not legal advice.
Review it regularly
AI tools change quickly. Look at the policy every six months: which tools people use, what went well, and any near misses. Update the approved list and the examples.
Introduce it to new hires as part of their onboarding checklist, so it is part of how you work from day one.