An AI use policy your employees can follow in two pages

The short answer

An AI acceptable use policy tells employees which AI tools they may use for work, what information they may never put into them, how AI output must be checked before it is used, and who to ask when unsure. For a small business it can fit on two pages. The core rules: use only approved tools on business accounts, never enter confidential client, employee or financial data into unapproved tools, review every output for accuracy, and disclose AI use where clients or rules require it.

This article is general information, not legal advice. If you work in a regulated field such as healthcare, law or finance, have counsel review your policy.

Why you need one now

Your employees are almost certainly using AI already, often on personal accounts you cannot see. The risks are practical, not theoretical:

• Data exposure. Client details pasted into a consumer chatbot may be stored or used under that service’s terms, not yours.
• Wrong answers. AI tools produce confident errors. Microsoft’s own Copilot documentation says generated responses are not assured to be fully factual and users should review output before sending it.
• Confidentiality duties. Professional rules may apply. The American Bar Association’s Formal Opinion 512, issued in July 2024, says lawyers must assess confidentiality risks before entering client information into generative AI tools, and that boilerplate consent in engagement letters is not enough.
• Inconsistency. Without rules, each person decides alone what is acceptable.

A short, clear policy lets people use AI productively while keeping sensitive data where it belongs.

What the policy should cover

1. Purpose and scope. Who it applies to (employees, contractors, interns) and which activities (any work task, on any device).
2. Approved tools. A named list, such as Microsoft Copilot or Gemini under your company account, and the rule that anything else needs approval first.
3. Account rules. Use company-managed accounts only, never personal accounts, for work data. Business tiers typically offer stronger data terms; Microsoft, for example, states that Copilot prompts and responses are not used to train its foundation models.
4. Data classification. What may never be entered, what may be entered only into approved tools, and what is fine anywhere.
5. Human review. Every output is checked by a person before it reaches a client, the public or a decision.
6. Disclosure. When to tell clients or colleagues that AI helped produce something.
7. Prohibited uses. For example, decisions about hiring, firing, pay or credit made by AI alone; generating content that impersonates real people; uploading others’ copyrighted material without rights.
8. Security. No connecting AI tools or browser extensions to company email, files or systems without IT approval.
9. Incidents. What to do if confidential data was entered by mistake, and who to tell.
10. Ownership and review. Who maintains the policy and how often it is updated.

A simple data rule employees will remember

Three buckets are easier to follow than a long list of data types. Put examples from your own business in each one.

Do not forget AI notetakers and browser extensions

Two kinds of AI tools slip past most policies. Meeting notetakers join calls, record them and send transcripts to a third-party service, sometimes for every participant, including clients who never agreed. Browser extensions that summarize pages or rewrite emails can read everything on screen. Your policy should say whether notetakers are allowed, require participants to be told when a call is recorded, and ban unapproved extensions on work devices. Recording consent rules vary by state, so confirm the requirements with counsel.

Want to know where AI could help, and where it could leak data? Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report rating your cybersecurity, applications, automation and AI opportunities, with a short list of next steps in order. The report is yours to keep, with no obligation. Book your assessment.

Sample policy language

Adapt these clauses to your business. Have counsel review them, especially in regulated industries.

• Employees may use only AI tools listed in the approved tools register, accessed through company accounts.
• Employees must not enter confidential client information, personal data about employees or customers, health information, payment data or credentials into any AI tool that is not approved for that data.
• All AI-generated content must be reviewed for accuracy, bias and appropriateness by the employee before use. The employee remains responsible for the final work.
• AI must not be the sole basis for decisions about employment, compensation, credit or access to services.
• Employees must report any accidental disclosure of confidential information to an AI tool to immediately.
• Requests for new AI tools or integrations go to for security and contract review.

Make it work in practice

A policy only helps if the technology backs it up and people understand it.

• Provide a good approved tool. If the sanctioned option is worse than the free one, people will use the free one.
• Fix permissions before rolling out workplace AI. Microsoft notes Copilot surfaces any content a user already has permission to view. Overshared SharePoint sites become overshared answers. Our Microsoft 365 security settings guide covers the basics.
• Control app consent so employees cannot connect unknown AI apps to company email and files.
• Train with examples from your own work, not abstract rules. Fifteen minutes on what to never paste beats a long document nobody reads.
• Get signatures at onboarding and when the policy changes.
• Review twice a year. Tools and terms change fast.

For a broader frame, NIST’s voluntary AI Risk Management Framework and its Generative AI Profile describe how to govern, map, measure and manage AI risk. Small businesses do not need the full framework, but its questions are useful for larger AI projects.

Where to start this week

1. Ask your team which AI tools they use today. Make it safe to answer honestly.
2. Pick one approved tool on business accounts.
3. Write the three data buckets with your own examples.
4. Draft the policy using the outline above and have counsel review it if you are regulated.
5. Train everyone in a short session and collect signatures.

For ideas on productive uses, see practical AI uses for small business owners. JLB USA helps businesses put practical AI and automation to work, with the security controls that keep data in the right place.

Keep reading

• Zapier vs Make: pricing, complexity and reliability compared for 2026
• 20 business process automation examples for small businesses
• AI tools for small law firms: what to use, what the ethics opinions say and how to roll out safely
• AI for small business owners: practical, safe uses that save time

Related services

• Automation and practical AI
• Cybersecurity services
• Free Technology Health Assessment