Someone on staff pastes a client contract into a free AI chatbot to get a quick summary before a meeting. No one told them not to, and nothing in writing says they can, either. That gap, an assumption that people are being careful with no actual boundary behind it, is where most small businesses stand on AI right now. It is not a hypothetical risk to plan for later. As covered in our look at shadow AI, employees are already doing this today, policy or not, which means the only real choice a business has is whether to set the boundary or leave it unset.
1. "We don't have an AI policy" really means "we haven't decided yet"
Without a written policy, every employee is making their own individual call about what is safe to type into an AI tool, usually with no idea that free consumer AI products can retain and reuse submitted text under terms most people never read. One employee might be careful. Another might paste in a spreadsheet of client financials to get a formula fixed faster. Neither one did anything malicious, but the business has no way to know which happened, or to whom, until it matters. A written policy does not eliminate AI use. It replaces dozens of individual, invisible risk decisions with one visible standard everyone is working from.
2. What actually belongs in the policy
A generic downloaded template rarely survives contact with how a specific business actually works, so the policy needs a few concrete provisions rather than vague good-judgment language. First, name the tools that are approved for work use and say plainly that anything else is not, since "use AI responsibly" means nothing without a specific list to check against. Second, spell out which data can never be pasted into an AI tool: client personal or financial information, anything under a signed NDA, credentials or API keys, and anything the business is contractually obligated to keep confidential. Third, require a human to review AI-drafted material before it reaches a client, a vendor, or the public, since an AI tool will state something confidently and incorrectly with equal ease. Last, the policy should say plainly that the employee who used the tool still owns the accuracy of the output, the same way they would if they had written it themselves without help.
3. Rolling it out so it gets followed, not filed
A ten-page legal document that sits unread in an employee handbook protects no one. The version that actually works is one page, written in plain language, reviewed with new hires during onboarding rather than buried in a stack of other paperwork they sign on day one. It should also have an expiration date built in: put one named person, usually the owner or whoever owns IT and compliance decisions, in charge of reviewing it at least once a year, since AI tools and their data-handling terms move faster than almost any other workplace policy a small business maintains.
Where to start this week
Start with the risk list from our shadow AI post as a starting inventory of what employees might already be doing, then write down which tools are approved and which categories of data are off-limits. That single page, reviewed once a year, closes most of the exposure. An AI acceptable use policy is also one piece of the written policy suite, alongside things like an incident response plan and an access control and acceptable use policy, that a managed IT relationship should already be maintaining for you rather than leaving you to draft alone.
Frequently asked questions
What is an AI acceptable use policy?
A short written document naming which AI tools employees can use for work, which data can never go into them, and when a human has to review AI-drafted work before it goes out the door. It sits alongside other written policies like an incident response plan and an access control policy.
Does a small business need an AI policy if it hasn't officially adopted any AI tools?
Yes. Employees at nearly every small business are already using free AI tools on their own initiative. Not having a policy does not stop that, it just means no one has set any boundary around what data goes into it.
What should never be pasted into an AI chatbot?
Client personal or financial data, anything under an NDA, credentials or API keys, and anything the business is contractually or legally required to keep confidential. Free consumer AI tools in particular may retain submitted text under terms most employees never read.
Who should own updating the AI acceptable use policy?
One named person, typically the owner or whoever owns IT and compliance decisions, who revisits it at least once a year. AI tools change quickly enough that a policy with no owner and no review date goes stale fast.
Don't have a written AI policy yet?
30 minutes with an engineer with DoD infrastructure experience. We'll look at what your team is already doing with AI tools and help you put one page in writing.
Book your free assessmentPrefer to talk first? Email sales@ghosxt.com or call (831) 204-0501.