AI Policy Template for Small Businesses That Already Use AI

Seventy-five percent of small businesses with fewer than 100 employees already use AI tools, averaging four distinct tools across nearly twenty operational areas, according to the SBE Council's 2023 survey. The governance problem is not coming. It arrived before most founders noticed.

The harm is already documented

Sixty-nine percent of small businesses have encountered drawbacks from generative AI, including bias and inaccuracies in content, security incidents, and decreased efficiency from time spent checking AI output, per Xero's Future Focus AI research across 3,051 business leaders with 50 or fewer employees. Fifty-one percent of those same businesses are sharing identifiable customer information with AI tools. Twenty-three percent report increased security or privacy issues after adopting generative AI.

This is not a fear of future risk. These are reported incidents from firms that have no structured response to them.

Why NIST and ICO guidance won't help you

The NIST AI Risk Management Framework and the UK ICO's AI and data protection guidance are serious documents. The ICO guidance covers lawful bases for processing personal data through AI, data minimisation, algorithmic fairness, and Article 22 obligations around automated decision-making. The NIST AI RMF spans AI governance across design, development, deployment, and evaluation.

Both assume you have someone whose job is to read them.

The research scope for this piece names this directly: these frameworks "often feel remote to a founder running a team of under fifty people." The choice most small businesses face is not between a plain-language template and the ICO risk toolkit. The evidence shows it is between a plain-language template and nothing.

A fair objection: a template that tells employees not to share sensitive data does not establish a lawful basis under GDPR for using customer records with a third-party AI model, and it does not address what the vendor's terms of service permit them to do with data already uploaded. That gap is real. A template does not close it. What a template does close is the documented gap between the three most commonly reported harm categories in the Xero data — sensitive data disclosure at 41%, bias and inaccuracies at 18%, and security incidents at 23% — and the current state, which is no written rules at all.

A ready-to-use AI policy for your team

Use this as a working document. Edit the bracketed fields. Share it with every employee who uses an AI tool at work.

---

AI Acceptable Use Policy — [Business Name] Effective date: [Date]

Approved tools: Employees use only AI tools approved by [Owner/Manager Name]. The current approved list is [list tools here, e.g., ChatGPT, Grammarly, Otter.ai]. Using an unapproved tool for work tasks requires written sign-off first.

Data access rules: Do not enter customer names, addresses, financial records, health information, or any information a customer shared with us in confidence into any AI tool. This applies to free tools and paid tools equally. If you are unsure whether a piece of information counts, ask before entering it.

Human review requirement: Any AI-generated content sent to a customer — emails, quotes, reports, social posts — requires a second person to read and approve it before it goes out. AI output is a draft, not a final product.

Customer consent: When AI has been used to process a customer request or generate a response on their behalf, tell them. A single line is enough: "We used an AI tool to help prepare this." Customers who ask us not to use AI in their interactions get that request honored and logged.

Employee responsibilities: Every employee using an AI tool at work has read this policy, keeps their login credentials private, and reports any AI output they believe is inaccurate or potentially harmful to [Owner/Manager Name] within 24 hours.

Policy review: This policy is reviewed every six months or when we add a new AI tool, whichever comes first.

---

The Intuit QuickBooks 2023 survey found that only 40% of small-business owners feel familiar with AI despite 83% already using it. A policy does not replace that familiarity. It gives your team a consistent floor to operate from while you build it.