[YOUR COMPANY]: AI use policy (one page)
Version 1.0 · Effective [DATE] · Owner: [NAME, ROLE] · Next review: [DATE + 6 MONTHS]

From the free Stepthrough starter kit "AI Governance for Small Business" (https://learn.ynteractive.com/content/explainers/ai-governance-for-small-business). Replace everything in [BRACKETS]. This is a starting template, not legal advice. Your client contracts, professional rules and local law come first; if your field is regulated, have a lawyer or compliance person review it before you rely on it.

1. Why we have this policy
We use AI to save time on drafts, summaries and research. We never let it put client trust at risk. This page says which tools we use, what never goes in, and who checks the work.

2. Approved tools only
Use only the tools on our Approved AI Tools list ([LINK TO LIST]), on the company account. No client or company work in personal AI accounts, free browser extensions or apps that are not on the list. Want a new tool? Ask [NAME] using [REQUEST FORM LINK] before you sign up.

3. What never goes into AI
Never paste or upload: passwords and logins; full bank, card or account numbers; Social Security or other ID numbers; health or medical details; employee HR records; anything a client asked us to keep confidential; anything marked Confidential in our data cheat sheet ([LINK]). When you need help with a confidential item, replace names and numbers with placeholders such as [CLIENT] and [AMOUNT].

4. What is fine to use
Public information (our website, published prices), your own writing, and internal notes with names removed, in an approved tool on the company account.

5. Account settings
The account owner keeps model training off where the plan allows it, reviews shared links monthly and deletes ones nobody needs, and keeps memory off on any login more than one person uses. Use Temporary Chat (or your tool's equivalent) for anything sensitive.

6. A person checks every output
AI drafts. People decide. Read every AI output before it goes to a client, a vendor or the public. Check every name, number, date, promise and quote against the source. AI can make things up and sound sure. You are responsible for anything you send.

7. Automations and agents
Any workflow or agent that sends, pays, deletes or posts on its own needs [NAME]'s approval before it goes live, and must include a step where a person approves [CLIENT-FACING MESSAGES / PAYMENTS OVER $AMOUNT].

8. Being open with clients
If a client asks whether we use AI, tell them the truth: which tools, what for, and that a person reviews all work. [OPTIONAL: Add one sentence on AI use to engagement letters.]

9. Mistakes: tell us the same day, no blame
If you pasted something you should not have, or an AI output went out with an error, tell [NAME] the same day. Do not delete anything first. We would much rather hear about it in an hour than find out in a month. Nobody is blamed for reporting.

10. Training and questions
Everyone reads this page and takes the five-question quiz in their first week, and again when it changes. Questions go to [NAME] at [EMAIL].

I have read this policy. Name: ______________ Date: __________