How to Write an AI Use Policy for a Small Team

If you lead a small business, nonprofit or ministry, there is a good chance someone on your team is already using AI tools to draft emails, summarize documents or brainstorm ideas. That is not a problem. The problem is when everyone uses them differently, with no shared idea of what is safe to paste in, what needs checking and what customers should be told.

A short AI use policy fixes that. It does not need legal language or twenty pages. One clear page that people actually read is far more useful than a binder nobody opens.

Why a written policy helps

• It protects private information. People will not accidentally paste client files or donor records into a consumer chatbot.
• It protects quality. Everyone knows that AI output is a draft, not a finished product.
• It protects trust. Customers and members get honest communication about when AI is involved.
• It reduces anxiety. Team members who were unsure whether they were "allowed" to use AI now know how to use it well.

The seven sections of a one-page policy

1. Purpose

One or two sentences on why you use AI and what you value. For example: "We use AI tools to save time on routine writing and research so we can spend more time with the people we serve. People remain responsible for everything we produce."

2. Approved tools and accounts

List the AI tools the team may use for work, and say whether to use organization accounts or personal ones. Business plans of many AI tools offer stronger data controls, such as not using your content to train models by default, but check each tool's current terms. Ask people to request approval before adopting a new tool for work.

3. Information that stays out

Be specific. Most small teams prohibit entering passwords and access keys, payment card and bank details, government ID numbers, health information, confidential client or donor records, personnel matters and anything covered by a confidentiality agreement. Our guide to what not to paste into an AI chatbot offers a fuller list you can adapt.

4. Human review and accountability

State plainly that the person who uses an AI tool owns the result. Anything going to customers, members, donors or the public gets reviewed by a person before it is sent or published. Facts, numbers, names, quotes and links are checked against reliable sources. Our step-by-step guide to fact-checking AI-written content can serve as your review standard.

5. Disclosure

Decide when you tell people AI was involved. Common choices:

• Tell customers when they are chatting with an AI system rather than a person.
• Label images that are AI-generated when they could be mistaken for real photos.
• Do not present AI-written testimonials, stories or quotes as if they came from real people. Ever.

Some places have laws about AI disclosure in certain situations, so check what applies to you.

6. Uses that are off-limits

Name the uses your team should avoid entirely. Many organizations include:

• Making decisions about people, such as hiring, firing, discipline or eligibility for services, based on AI output without careful human judgment.
• Giving clients legal, medical, tax or financial advice drafted by AI.
• Creating images, audio or video that impersonate a real person.
• Generating content meant to mislead, including fake reviews.

7. Questions and updates

Name the person to ask when something is unclear, and commit to reviewing the policy regularly, perhaps every six months, since tools change quickly.

A sample one-page outline

You can adapt this outline directly:

• Purpose: why we use AI and our commitment to people-first work.
• Approved tools: the list, and how to request a new one.
• Keep out: the categories of information never entered into AI tools.
• Review rule: a human reviews and verifies anything shared outside the team.
• Disclosure: when and how we tell people AI was used.
• Off-limits uses: the short list above, adjusted for your work.
• Contact and review date: who to ask and when we will revisit the policy.

Rolling it out

A policy only helps if people understand it. Hold a thirty-minute session where you walk through the page, show a few good and bad examples, and invite questions. Share helpful prompts and workflows that fit the policy, so it feels like an enabler rather than a restriction. Revisit it when you add a new tool, such as a customer service chatbot, since that brings new questions about disclosure and review.

A policy like this is guidance, not legal advice. If your organization handles regulated information, such as health records, or uses AI in hiring, talk with an attorney about specific requirements. And if you would like help thinking through your team's approach, reach out to us.

Frequently asked questions

Do small businesses really need an AI policy?

If anyone on your team uses AI tools for work, a short policy is worth it. It prevents the most common mistakes, such as pasting private data or publishing unchecked facts, at almost no cost.

Should we ban personal AI accounts for work?

Many organizations require approved business accounts for work tasks because they offer better data controls and keep work in the organization's hands. At minimum, prohibit putting confidential information into personal accounts.

How often should we update the policy?

Review it at least twice a year and whenever you adopt a new AI tool or use case. AI products and their terms change frequently.