WeeklyTake

A one-page AI acceptable use policy template for small businesses

Most AI policy templates are written for companies with a legal department. Twelve pages, a list of defined terms, a governance committee. Your team won't read it, and a policy nobody reads doesn't protect anyone.

You still need one. In a 2026 survey of people who use AI at work in five countries, including the US, 43% said their company's guidance on what not to share with AI was missing or unclear. 32% admitted sharing sensitive company information with AI tools without their employer knowing (SecureWorld, on the NCA and CybSafe Oh, Behave! report). Most of those people aren't careless. Nobody showed them where the line is.

Below is a policy that fits on one page. Copy it, fill in the parts in brackets, and send it.

What a small-team policy has to answer

Your team has four questions. A good policy answers all four and nothing else.

  1. Which tools can I use?
  2. What can I put in, and what can't I?
  3. What do I have to check before it goes out?
  4. Who do I ask when I'm not sure?

The template

[Company name]: How we use AI at work Last updated: [date]. Questions: [name]. We want you to use AI. It can save real time on writing, summarizing and research. These rules are here so you can use it without worrying about getting it wrong. 1. Use our work accounts. Use [ChatGPT Business / Copilot, signed in with your work account]. Don't use personal or free accounts for work. Our work accounts don't use what you type to train AI models. Free and personal ones may. Want to try a different tool? Ask [name] first. We'll usually say yes. 2. Never put in: Social Security numbers, ID numbers, bank or card details, passwords. Clients' financial or health information, or anything a client asked us to keep private. Employee information, like pay, reviews or health. This applies everywhere, including drafts, notes and files you upload. If you're not sure, ask first. 3. Fine to put in, as long as nothing from rule 2 is in it: drafts of emails, posts and documents. Public information, like a published price list or a property's listed features. Your own notes and ideas. General questions about how to do something. 4. Check before it goes out. AI gets things wrong, and it sounds sure of itself when it does. You're responsible for what you send, whether AI helped or not. Before anything goes to a client or outside the company, check every number, name, date and fact, and read it once as the person receiving it. 5. Be open about it. You don't need to hide that you use AI. Share prompts that work with the team. If a client asks whether AI helped with something, tell them the truth. 6. If something goes wrong, like pasting something you shouldn't have, tell [name] the same day. Nobody gets in trouble for reporting a mistake. We just need to know so we can fix it. 7. Questions? Ask [name]. If the same question comes up twice, we'll add the answer here.

How to fill it in

Name the tools you actually pay for. This is the rule that matters most, because the free and paid versions handle your data differently. OpenAI says it doesn't use content from ChatGPT Business, Enterprise or its API to train its models, while people on personal plans have to opt out (OpenAI). Microsoft says Copilot Chat prompts and responses aren't used to train the AI models behind it when someone is signed in with a work account (Microsoft). Check the current terms for whatever you use, then name it in rule 1.

Make the "never" list match your business. A real estate office might add showing codes and buyers' pre-approval letters. An accounting firm might add tax returns. Use the words your team already uses for those things.

Pick one person to ask. It doesn't have to be you. An office manager who likes trying new tools is often the better choice. What matters is that people know who it is.

Keep rule 6. If owning up to a mistake gets someone told off, the next person will hide it. And hidden mistakes are the ones you can't fix.

How to roll it out

Sending it as an attachment isn't enough. Here's what works in a small team:

  1. Paste it into the body of an email or a team message, so nobody has to open a file.
  2. Spend ten minutes on it at your next team meeting. Give one real example of "fine" and one of "never" from your own work.
  3. A week later, ask one anonymous question: "Is it clear what you can use AI for now?" with three answers: Clear, Mostly, Still unsure.
  4. If a lot of people say "Still unsure," ask what's unclear, then add the answer to the policy and change the date at the top.

That last step is how a policy gets better. The first version will have gaps. Your team will tell you where they are if you ask.

This template is a starting point, not legal advice. If your business handles health, financial or legal information, have a lawyer check it before you send it.

WeeklyTake can send the "is it clear?" question the week your policy goes out, and show you on Thursday which part people are still unsure about.