An AI policy for small business: a one-page version for 5 to 50 people

A business of 5 to 50 people needs an AI policy that fits on one page. It should name the tools and accounts staff may use, the data that stays out, who reviews AI-assisted work, and who owns the policy. The most important choice is the account type. A business account and a personal account on the same AI tool can handle your data differently.

Small firms often skip a policy because nobody has asked for one. Staff use AI tools anyway. In Microsoft's 2024 Work Trend Index survey, 78% of AI users said they brought their own AI tools to work. The figure was 80% at small and medium-sized companies (Microsoft). A one-page policy turns that private use into agreed use.

Start with the account type

Before you write any rules, decide which accounts staff will use. The major providers treat business and personal accounts differently on model training. Check the current terms for each tool you approve. As published in October 2026:

• OpenAI says it does not train its models on business data by default. That covers ChatGPT Business, Enterprise and Edu, and its API (OpenAI). On personal ChatGPT accounts, users control training through a setting called "Improve the model for everyone" (OpenAI Help Center).
• Anthropic lets users of its consumer Claude plans (Free, Pro and Max) choose whether their chats are used for training. Its commercial products, including Claude for Work and the API, are outside that change (Anthropic).
• Google says Gemini in Workspace does not use customer data to train models without the customer's permission or instruction (Google).

Training is one question among several. Business plans often add admin controls, the ability to remove a departing employee, and a data processing agreement. For a firm that handles client data, those features matter as much as the training setting.

A one-page sample policy

Adapt the wording, the tool names and the contact. Keep it short enough to read in three minutes.

1. Tools

• You may use the AI tools listed on our approved list, signed in with your work account.
• Do not use personal AI accounts for any work that involves clients, staff or company information.
• To try a new tool, ask [owner] first. We will check its data terms within a week.

2. Data

• Never enter passwords, bank details, or ID numbers into any AI tool.
• Never enter health or other sensitive personal information about clients or staff.
• Enter client names, contracts or internal figures only in tools on the approved list for that data.
• When in doubt, remove names and figures first, or ask.

3. Checking

• You are responsible for anything you send or publish, whether or not AI helped.
• Check every fact, figure, name and link in AI-assisted work before it goes to a client.
• Do not send AI-written advice on legal, tax, health or safety matters without review by a qualified person.

4. Decisions about people

• Do not use AI to decide who to hire, promote, discipline or let go.
• You may use AI to help draft a job ad or organize interview notes. A person makes the decision.

5. Problems

• Tell [owner] the same day if client data went into the wrong tool, or if an AI error reached a client.
• We want to hear about mistakes early. Reporting one is expected.

6. Ownership

• [Owner] maintains this policy and the approved tool list.
• We review this policy every six months, and when we add a new tool.

What a small firm can leave out

A large company policy often has committees, risk tiers and approval workflows. A small firm does not need them. One named owner, one approved list, and one place to report problems cover most of the risk. Add detail only when a real case shows a gap.

Questions small firms ask

• Should we ban AI tools instead? Under a ban, staff who need AI for their work may turn to personal accounts, where the firm cannot see the use. An approved list with clear data rules gives the firm more control.
• What about AI features inside software we already pay for? Treat them like any other tool. Check whether the feature is on by default, and what the vendor’s terms say about your data.
• What if a client contract limits AI use? Some contracts restrict where client data can go. Ask staff to check with the owner before using AI on work for a client with such terms, and keep a list of those clients.
• Do we need a lawyer to write this? A one-page policy based on the sample above is a reasonable start. Ask a lawyer to review it if you handle regulated data, such as health or financial records.

If you have clients or staff in the EU

The EU AI Act's AI literacy duty in Article 4 applies to deployers of AI systems regardless of size. Deployers include any business whose staff use AI tools for work. The article asks the Commission and Member States to support small and medium-sized enterprises in meeting it (AI Act Service Desk). The Commission says no certificate is needed, and an internal record of training and guidance is enough to keep (European Commission). This is general information, not legal advice. See EU AI Act Article 4 for detail.

Rolling it out in a week

1. Ask each person which AI tools they use now, and for what. A short survey works: see AI skills survey questions.
2. Choose the approved tools and set up business accounts.
3. Fill in the sample policy and share it at a team meeting.
4. Spend 30 minutes on the data rules and the checking rule, with one real example of each.
5. Put the review date in the owner’s calendar.

Emeri’s team AI use policy template offers a longer version if the firm grows. Larger organizations can compare how to write an AI policy for employees. To see where each person’s skills stand, staff can take the free check, which takes about 15 minutes.