AI Acceptable Use Policy for Small Business: What to Put in Writing
Someone in your office probably drafted an email in ChatGPT this week, and nobody decided that should happen. Microsoft’s 2024 Work Trend Index found that 78% of AI users bring their own AI tools to work. An AI acceptable use policy for small business puts a few simple rules around something that’s already helping, without shutting it down.
Is Your Team Already Using AI at Work?
Almost certainly. In most small offices, AI showed up the way any free app does. One person tried it to clean up an email or summarize a contract, it saved them twenty minutes, and they told a coworker. A few months later, half the office uses it, mostly on personal accounts they signed up for with their own email.
That’s not a crisis on its own. The problem is that with no rules, everyone makes their own. One person won’t paste anything with a client’s name in it. Another pastes the whole file. IT people call this shadow AI: AI tools used for work that the business never approved and can’t see. At a small business, shadow AI is usually just people trying to get their work done.
It tends to come up when someone asks about it. A client security questionnaire or a cyber insurance application starts asking how your team uses AI. Or an employee asks, “Am I allowed to use this?” and nobody has an answer.
Same Tool, Different Rules: Personal vs. Business Accounts
Here’s the part a lot of owners miss: the same AI tool follows different rules depending on which account you’re signed into. The screen looks identical. What happens to what you type does not. Three differences matter.
Training. Personal ChatGPT accounts can use your conversations to improve models unless the setting is turned off. OpenAI’s help page on model training explains where that setting lives. OpenAI’s business plans, like ChatGPT Business and Enterprise, don’t train on your data by default.
Control. A business account sits under the company’s admin. You decide who has access and what’s turned on. A personal account belongs to the employee. You can’t see it, set rules for it, or shut it off.
Offboarding. When someone leaves, a personal account leaves with them, along with every chat that had client details in it. A business account gets closed as part of your normal employee offboarding process.
You May Already Own the Safe Version
Many small businesses already pay for a business AI tool and don’t realize it. If you’re on Microsoft 365, Copilot Chat comes with enterprise data protection at no extra cost when people sign in with their work account, and Microsoft says prompts and responses aren’t used to train foundation models. If you’re on Google Workspace, Gemini in qualifying paid plans isn’t used for AI model training outside your domain without permission.
So a good AI policy for small business is less about banning tools and more about steering people onto the account the business already controls. Those admin controls only help if someone actually keeps an eye on them, which is why it matters who manages your Microsoft 365 setup. And if you’re planning to add the paid Copilot that works across your company files, run a permissions audit before you turn on Copilot. That post covers what AI can reach on its own. This one covers what your people hand to it.
What Actually Goes Wrong With AI at Work?
The real risks are ordinary: everyday shortcuts that go sideways.
Sensitive data in personal accounts. An employee pastes a client’s tax return into a personal chatbot to “summarize it.” It works great. But now that return sits in an account the business doesn’t control, and it’ll still be there after that employee moves on.
Confident, wrong output. AI writes smoothly whether it’s right or wrong. A staff member sends a customer an AI-drafted email with the wrong price, the wrong date, or a policy you don’t actually have. The customer doesn’t care that a chatbot wrote it. Your name is on it.
Browser extensions and add-ons. AI extensions and “assistant” add-ons often ask for permission to read every page you visit. That can include email, your banking portal, and client files. Someone installs one to summarize articles and never thinks about what else it can see.
IBM’s 2025 Cost of a Data Breach Report found that one in five organizations it studied reported a breach due to shadow AI. Organizations with high levels of shadow AI saw an average of $670,000 in higher breach costs than those with little or none. The takeaway for a ten-person office is simple: the risk comes from the AI nobody’s managing, not from AI itself.
Banning AI usually doesn’t fix that. It tends to push the activity onto personal phones, where you can’t see it at all.
What to Put in Your AI Acceptable Use Policy for Small Business
For a 10-person office, an AI acceptable use policy is one or two pages, not a governance binder. Write it as an AI policy for employees: plain language that answers the questions your team is already asking. If your office mostly uses ChatGPT, this is your ChatGPT policy. Here’s a copy-ready outline:
- Purpose. One line: we use AI to work faster without putting client or company data at risk.
- Approved tools and accounts. Which AI tools are approved, and that work happens only on the business account, never a personal one.
- Data that never goes in. Client personal information, financial and tax records, health information, passwords, and anything under a confidentiality agreement.
- Human review. A person checks AI-written work for accuracy before it reaches a customer, a client, or an official document.
- Disclosure. When staff should say AI helped, such as client deliverables where the client would reasonably expect to know.
- Add-ons and extensions. No AI browser extensions, plugins, or app connections without approval first.
- Who to ask. One named person for questions and for reporting mistakes, with no penalty for speaking up quickly.
- Review date. When the policy gets revisited, at least every six months.
The “data that never goes in” list is the heart of it. Make it specific to your business. A bookkeeping office and a dental office will have different lists, and examples from your own work stick better than generic categories.
The “who to ask” line matters more than it looks. If someone pastes the wrong thing into the wrong tool, you want to hear about it that afternoon, not months later. A policy that punishes honest mistakes teaches people to hide them.
How Do You Make an AI Policy Stick?
A policy only works if following it is easier than ignoring it.
Start by giving people the approved tool. If the business account is harder to use than the personal one, people will keep using the personal one. Set it up and sign everyone in before you hand out the policy.
Training can be short. Fifteen minutes at a staff meeting is enough to walk through the “never goes in” list with real examples from your own work. While you’re at it, review the settings your business account offers and pick them on purpose, instead of living with defaults nobody chose.
Then put a date on the calendar. AI tools change their plans and settings often, so a quick look every six months keeps the policy honest.
One more note for Colorado businesses. Colorado’s SB 26-189 applies starting January 1, 2027, and covers AI used in consequential decisions such as hiring. If you use AI to screen applicants or make similar calls, talk to your attorney about what it means for you. Our overview of IT compliance requirements for Colorado businesses covers the broader picture.
Not sure which AI tools your team is using, or whether you already pay for a business version? That’s a quick thing to sort out together. If you’re in the Denver/Aurora area, a short conversation is an easy place to start.
Frequently Asked Questions
Does my small business really need an AI policy?
If anyone on your team uses AI for work, yes, and they probably do. Microsoft’s 2024 Work Trend Index found that 78% of AI users bring their own AI tools to work. A one-page policy gives everyone the same rules instead of each person making up their own.
Is it safe to use ChatGPT for work?
It can be, if three things are in place: staff use a business account, sensitive data stays out, and a person checks the output before it goes anywhere. The biggest risk is usually personal accounts the business can’t see or control.
Does ChatGPT train on what my employees type into it?
On personal accounts, it can. Personal ChatGPT accounts can use your conversations to improve models unless the setting is turned off. OpenAI’s business plans, such as ChatGPT Business and Enterprise, don’t train on your data by default.
Do we already have a business AI tool through Microsoft 365 or Google Workspace?
Quite possibly. Copilot Chat signed in with a Microsoft 365 work account includes enterprise data protection at no extra cost. Gemini in qualifying paid Google Workspace plans doesn’t use your content for AI model training outside your domain without permission. Check what your current plan includes before buying something new.
What should employees never paste into an AI tool?
Client personal information, financial and tax records, health information, passwords, and anything covered by a confidentiality agreement. Even on an approved business account, share only what the task actually needs. When in doubt, leave it out or ask first.
Should I just ban AI at work?
Usually not. Bans tend to push AI use onto personal phones and accounts where you can’t see it at all, which is the problem you were trying to solve. Giving people an approved tool and a few clear rules works better.