AI use policy template for small offices
A free AI use policy template for small businesses: what to include, a one-page sample you can copy, and how to roll it out to your team without a lawyer-length document.
By Aaron Tibbitts, High Basin Solutions · · 7 min read
The short answer
A small office AI policy can fit on one page. It should name the AI tools staff may use, list what never goes into them, require a person to review anything AI helped write before it reaches a customer, and say who to ask. Your team is probably already using AI, so a short written rule helps more than a long one nobody reads.
Why a small office needs one
Your staff are probably already using AI. Someone drafts emails with ChatGPT, someone summarizes a long document, and AI features keep switching on inside software you already pay for. Most of it is helpful. The problem is that nobody has said what's okay, so each person guesses.
A written policy replaces the guessing. It tells people which tools to use, what to keep out, and when to check with someone. It also gives you something to point to if a client asks how you handle their information.
What a good policy covers
- 1
Approved tools
Name the AI tools staff may use for work, and say they must be on a business account, not a personal one. Anything not on the list isn't approved yet.
- 2
What never goes in
Spell out the information that stays out of AI tools: client and patient details, financial account numbers, passwords, and anything under a confidentiality agreement. Examples help more than categories.
- 3
Review before it reaches a customer
AI can be confidently wrong. Anything AI helped write that goes to a client, like an email, a number, or advice, gets read by a person first.
- 4
Ask first for new tools and connections
New AI tools, browser extensions, and connections that let AI read your email, files, or calendar need a yes before anyone turns them on.
- 5
Offboarding
When someone leaves, remove their access to AI accounts and any shared logins, the same way you would for email.
- 6
Who to ask
Name one person staff can go to with questions. A policy without a contact turns into guessing.
A one-page sample policy
Copy this and replace the bracketed parts. It's a starting point, not legal advice, so adjust it to your office and any rules in your field.
[Business name] · AI use policy · effective [date]
How we use AI tools at [Business name]
AI tools can save us time. This page explains how to use them without putting client information or our reputation at risk. It applies to everyone who works for [Business name], including part-time staff and contractors.
1. Approved tools
You may use [Tool 1] and [Tool 2], signed in with your [Business name] work account. Don't use personal or free accounts for work. If a tool isn't on this list, it isn't approved yet.
2. What never goes in
Never enter client or patient names with birth dates, Social Security numbers, health details, bank or card numbers, passwords, or anything covered by a confidentiality agreement. Replace details with placeholders like [client] when you can.
3. Review before it reaches a customer
AI can be wrong and still sound sure. A person reads and checks anything AI helped write before it goes to a client, including emails, numbers, and advice.
4. Ask first
Ask [Contact name] before trying a new AI tool or browser extension, or connecting AI to email, files, calendars, or client systems.
5. When someone leaves
[Contact name] removes their access to AI accounts and shared logins on their last day.
6. Questions and mistakes
If you're not sure, ask [Contact name] at [email or phone]. If something goes into an AI tool that shouldn't have, tell [Contact name] right away. We'd rather know early.
I've read and will follow this policy.
Name, signature, and date: [ ]
Reviewed every six months. Next review: [Date].
How to roll it out in a week
- 1
Fill in the blanks
Copy the sample above, replace the bracketed parts, and cut anything that doesn't fit how your office works. Aim to keep it to one page.
- 2
List what's already in use
Ask your team which AI tools they use today, with no penalty for the answer. Add the good ones to the approved list and move them to business accounts.
- 3
Check the settings
On each approved tool, look at the data and training settings and turn off anything you don't need.
- 4
Walk the team through it
Spend fifteen minutes at a staff meeting going over the page. Show one real example of what's fine and what isn't.
- 5
Get a signature and set a date
Have each person sign or acknowledge it, then put a reminder on the calendar to review it in six months.
Add-ons for your industry
Some fields have their own rules, and those rules apply to AI tools too. Add a line or two for yours:
- Tax and accounting. The FTC Safeguards Rule requires tax preparers to keep a written information security plan. Add your AI rules to it: which tools may touch client data, and how. IRS Publication 4557, Safeguarding Taxpayer Data, is a good place to start.
- Dental and health. Only use AI tools with patient information if the provider has signed a HIPAA business associate agreement with you. Without one, keep patient details out entirely.
- Legal. Your duty to keep client information confidential under your state's bar rules applies to AI tools too. Add a line on what may go in, and check whether your bar has issued guidance on AI use.
The bottom line
A one-page AI policy is one of the cheapest, fastest ways to make AI safer in a small office. Keep it short, make it specific to the tools you actually use, and review it every few months as the tools change.
Want a version filled in from your answers? Take the free AI check. And if you're deciding what belongs on the “never goes in” list, read Is it safe to put client data into ChatGPT?
This guide is general information, not legal or compliance advice. Check your AI provider's current terms and any rules that apply to your industry.