What is an AI policy?
Quick answer
An AI policy is a short written rule that tells staff which AI tools they may use for work, what information they may and may not put into them, and who checks the output before it reaches a client. For a small firm it is usually one page that names an owner and gets reviewed a few times a year.
Last updated
Updated · By Robert Breen
Why it matters for a small business
Without a written rule, every person makes up their own. One bookkeeper uses a personal login, another pastes a payroll file to save time, and nobody can say which settings are on. The first time a client or an insurer asks whether their documents ever go into an AI tool, an AI policy is the difference between a one-sentence answer and an awkward week of checking.
A good policy is practical, not legal-sounding. It answers the questions staff actually have: Which account do I use? Can I paste this email? Who do I ask? It connects to related ideas such as an acceptable use policy, the habit of keeping personal information out of prompts, and the problem of staff using tools nobody approved, known as shadow AI.
What a one-page AI policy answers
| Question | What the policy says | Who it protects |
|---|---|---|
| Which tools are approved? | A short list, with the account type staff must use | The firm and its clients |
| What may be pasted? | Only what the task needs, with names and numbers replaced by placeholders | Clients and tenants |
| Who checks the output? | The person who sends it, before it goes out | The firm's reputation |
| Who do I ask? | One named owner | Staff, who no longer have to guess |
The rows are examples of the questions a small firm usually covers, not a legal template. Check client contracts and professional rules before you finish yours.
In a real lesson: Use AI at Work Without Leaking Client Data using ChatGPT
In the Use AI at Work Without Leaking Client Data lesson, a staff member at Lakeside Property Management, a made-up property management company, pastes a tenant's email, bank numbers and address into ChatGPT to save five minutes. The lesson turns the three things a policy would say into habits: check the settings, take private details out before you paste, and check the reply before it goes out.
That is what a policy looks like in practice. It is not a long document. It is the three rules above, written down once, so the next person does not have to learn them by making the same mistake.
Try this lesson free or read the step-by-step guide.
Common confusions
AI policy vs AI governance
An AI policy is the short set of rules staff follow. Governance is the wider set of roles, reviews and records a larger organization uses to manage AI risk. A small firm can start with the policy alone.
AI policy vs privacy policy
A privacy policy tells customers how you handle their data. An AI policy is internal and tells staff how to use AI tools. They should agree with each other.
Tips
- Keep it to one page and put a date and an owner on it.
- Say what staff may do, not only what they may not.
- Practice the rules once as a team on a real task, then review the page every few months.
Related terms
More Business terms
Where you use it: free lessons
- Use AI at Work Without Leaking Client Data using ChatGPT (ChatGPT, 7 min)
- iMini AI Agent: Turn a Rough Idea into a Launch Kit (iMini, 8 min)
- DomoAI: Turn a Product Photo into a Short Video for Social (DomoAI, 6 min)
- Collect Overdue Invoices Faster using ChatGPT (ChatGPT, 12 min)
Frequently asked questions
- Does a small business need an AI policy?
- If anyone on the team uses an AI tool for client or customer work, yes. A single page is enough to start, and it is easier to write before a problem than after one.
- What should an AI policy include?
- The approved tools and account type, what may and may not be pasted, who checks the output before it is sent, and one named person to ask. Add a review date.
- Who should write the AI policy?
- Usually an office manager or partner, with input from the people who use the tools. Have a lawyer or your insurer's guidance check it if you handle regulated data.