How to Write an AI Use Policy for a Small Business

An AI use policy tells your team which tools they can use, what information must stay out of those tools, and who checks the work before anyone relies on it. For a small business, a short document that people actually follow is more useful than a long policy nobody reads.

This guide explains how to write those rules around your business. It is practical guidance, not legal advice. Privacy, employment, contractual and professional obligations still need their own consideration.

Start with how your team uses AI

Ask your employees and contractors what they use AI for today. Drafting customer emails, summarizing meetings, preparing marketing copy and researching a topic create different questions from ranking job applicants or recommending a decision about a customer.

A short conversation or list is enough to start. Identify the tools, the work and the information involved. Do not assume that an AI subscription makes every use appropriate.

Then ask three questions for each activity:

• What information would someone enter into the tool?
• Who could be affected if the output were wrong?
• Who is responsible for reviewing and approving the result?

This is a practical starting point, not a requirement to maintain a formal AI register for Ethicality certification.

Put five decisions into writing

1. Which tools and uses are permitted?

Name the tools your team may use for work, and explain who can approve another one. Where necessary, distinguish between an approved tool and an approved use: permission to draft an email is not automatically permission to upload a customer file.

2. What information must stay out?

Tell staff not to enter confidential, privileged or sensitive business information into public or unapproved AI tools. Keep passwords and security credentials out too. Make clear who to ask before using sensitive information in an approved service.

Canadian privacy regulators identify legal authority, appropriate purposes and transparency among the considerations for generative AI involving personal information. A workplace policy does not replace those privacy obligations. 1

3. What needs human review?

Explain that a person must review material AI-assisted work before it is sent, published or relied upon externally. Define who approves important recommendations or decisions informed by AI.

Give that reviewer permission to change, reject or ignore the output. A rule that requires approval but leaves the reviewer unable to intervene is not meaningful oversight. Read our human oversight checklist for a practical workflow.

4. When should people be told about AI use?

Set expectations for meaningful AI use in customer work, substantial AI contributions where a reasonable customer would expect to know, and direct interaction with an AI chatbot or agent. Keep public statements accurate.

Use our business AI disclosure examples to separate a general website statement from a notice on a particular deliverable or interaction.

5. Who owns the policy?

Name a person staff can approach when they are unsure. Explain who stays responsible for final work and who handles questions or mistakes. Share the rules with everyone who uses AI for the business, including contractors where relevant.

NIST describes its AI Risk Management Framework as voluntary guidance, organized around Govern, Map, Measure and Manage. It is a useful broader reference for governance, not a certificate or a legal-compliance checklist. 2

Example wording to adapt

We use only AI tools permitted for the relevant work. Confidential, privileged or sensitive information and security credentials must not be entered into public or unapproved AI tools. A person reviews material AI-assisted work before it is shared externally and approves important AI-informed recommendations. Reviewers may change or reject AI output, and a person remains responsible for the final work. We explain meaningful AI use to customers where appropriate. Staff who are unsure ask the person responsible for our AI-use rules before proceeding.

This is an illustrative starting point. Replace general wording with rules your team can actually follow, and do not claim a review process exists unless it does.

How this connects to EAUS 1.0

The Ethicality AI Use Standard (EAUS 1.0) has fifteen requirements covering transparency, human responsibility and confidential information. A policy can provide evidence for several requirements when it accurately reflects real practices; adopting a template alone does not guarantee certification.

You can use the free AI Use Policy template, take the readiness check, or apply for certification. The policy is a starting point. The practices behind it are what matter.