Your team is almost certainly using AI tools already, whether or not you have approved them. Someone pastes a client email into a chatbot to draft a reply; someone else uploads a spreadsheet to get a summary. Most of this is harmless and saves time. Some of it puts client data, confidential plans or your reputation at risk. An AI usage policy sets out what is allowed, what is not and who decides, in language a small team will read. This article explains what to include and gives a short template you can adapt.
Why a small team needs an AI usage policy
Large companies write long policies with legal teams. A business of five or fifty does not need that, but it does need clear answers to a few questions:
- Which AI tools may staff use for work, and on which accounts?
- What information must never go into them?
- Who checks AI-generated work before it reaches a client?
- When do you tell clients that AI was used?
- What happens if something goes wrong?
Without written answers, each person makes their own rules. A short policy protects the business, gives staff confidence to use AI where it helps, and makes it easier to answer clients who ask how you handle their data.
Start with your data obligations
Your AI policy should sit on top of the data protection rules that already apply to you. In India, the Digital Personal Data Protection Rules, 2025, notified in November 2025 under the DPDP Act 2023, set out requirements on notice, consent, security safeguards and breach reporting, with a phased period for compliance. In the UAE, the federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) applies to many businesses, while free zones such as DIFC and ADGM have their own data protection regimes. Client contracts and non-disclosure agreements may add further limits.
Before writing the policy, list the types of data your team handles: customer personal data, client confidential information, financial records, employee data, source code. Each type needs a clear rule.
What to include
1. Purpose and scope
One or two sentences: why the policy exists and who it covers. Include contractors and freelancers if they handle your data.
2. Approved tools
List the AI tools staff may use for work and which account type. Business or team plans often come with stronger data terms than free consumer versions, such as commitments not to train on your inputs. Check each provider’s current terms before approving it. Say how staff can request a new tool and who approves it.
3. Data rules
The most important section. A traffic-light approach works well:
- Green, allowed in approved tools: public information, your own marketing drafts, general research questions, anonymised examples.
- Amber, allowed only in approved business-plan tools and with care: internal documents without personal data, code that contains no secrets or keys.
- Red, never: customer or employee personal data, client confidential information, passwords and API keys, financial account details, anything covered by an NDA, unless a specific tool has been approved for that data.
4. Human review
State that a person is responsible for anything produced with AI help. Spell out what must be checked: facts, figures, names, legal or tax statements, quotes and links. AI tools can produce confident errors, so anything going to a client, a regulator or the public needs a human check.
5. Disclosure
Decide when you tell clients or customers that AI was used. Some businesses disclose in their terms of service; others disclose case by case. Follow any client contract that requires disclosure or bans AI use on their work. For customer-facing chatbots, make it clear the customer is talking to an automated system and offer a way to reach a person.
6. Intellectual property and originality
Remind staff not to present AI output as original research, and to check that generated images, text or code do not copy identifiable third-party material. If you use AI for client deliverables, check whether your contracts promise original work or assign ownership of it.
7. Incidents
Tell staff what to do if they paste something they should not have, or spot an AI error that reached a client: who to tell, how quickly, and that honest reporting will not be punished. Link this to your data breach process so personal data incidents are assessed for any reporting duties.
8. Ownership and review
Name the person who owns the policy, and set a review date. AI tools and rules change quickly; every six months is a sensible rhythm for a small team.
An AI usage policy template
Adapt this to your business. Keep it to one or two pages.
- Purpose: This policy explains how [Company] staff and contractors may use AI tools for work, to protect our clients’ and customers’ data and the quality of our work.
- Approved tools: Staff may use [tool names] on company accounts only. To request another tool, email [owner]. Personal AI accounts must not be used for company work.
- Never enter: personal data about customers, clients or staff; client confidential information; passwords, keys or financial account details; anything covered by an NDA.
- Allowed: drafting, summarising and research using public or anonymised information, and internal documents without personal data in approved business-plan tools.
- Review: The person sending any AI-assisted work is responsible for it. Check all facts, figures, names and links before it leaves the company.
- Disclosure: We disclose AI use where a client contract requires it, and our chatbots identify themselves as automated.
- Incidents: If you enter restricted data into an AI tool or find an AI error in client work, tell [owner] the same day.
- Owner and review: [Name] owns this policy. It will be reviewed every six months, next on [date].
Say a Bengaluru marketing agency of twelve people adopts this. They approve one business-plan assistant, ban client customer lists from all AI tools, and add a line to client contracts explaining how AI is used in drafting. When a new client asks about data handling during onboarding, the account lead sends the one-page policy.
Rolling it out
- Draft the policy with input from two or three people who use AI most.
- Have it checked by your legal adviser if you handle sensitive data or work under strict client contracts.
- Walk the team through it in a 30-minute session with real examples from your work.
- Ask each person to confirm they have read it.
- Set up the approved accounts so following the policy is the easy option.
We help businesses choose AI tools and set policies as part of our technology advice, and build AI steps into workflows with the right safeguards through our automation work. If you want a second pair of eyes on your draft, we can go through it on a call.
This article is general information, not legal advice. Check your obligations with a qualified adviser.
Frequently asked questions
Do small businesses need an AI policy?
If anyone in your business uses AI tools for work, a short written policy is sensible. It tells staff which tools are approved, which data must never be entered and who checks AI-assisted work. It also helps you answer clients who ask how you protect their information. For a small team, one or two pages is enough.
Can employees use free ChatGPT or other free AI tools for work?
That is a decision for your policy. Free consumer versions of AI tools may have different data terms from business plans, including how inputs are stored or used. Many businesses allow free tools only for public or non-sensitive information and require business accounts for anything else. Check each provider’s current terms before deciding.
How often should an AI usage policy be updated?
Review it at least every six months, and sooner if you adopt a new tool, take on a client with specific AI requirements, or the law changes where you operate. AI products update their features and terms often, so a policy written once and left alone will soon be out of date.