Blog · October 31, 2026

AI Acceptable Use Policy Template for Small Business (Copy-Ready)

An AI acceptable use policy tells your staff which AI tools they may use at work, what information they may put into them, how to check what the tools produce, and who to tell when something goes wrong. Most small businesses don’t need a long legal document to get started. They need one or two pages that people will actually read and sign. This guide explains what to include, gives you a copy-ready template you can paste into a document and edit, and shows how to roll it out in a small office.

The template below is a starting point, not legal advice. Have someone who knows your industry and local rules review it before you adopt it.

Why a small business needs an AI use policy

AI tools are already in most offices, whether or not anyone approved them. Staff use chat assistants to draft emails, summarize documents and write code. Browser extensions and desktop apps add AI features quietly. Some tools now go further and act on a computer for you, which our guide to what an AI agent on your computer is explains in plain English.

Without written rules, each person makes their own call about what is safe to paste into a chat box. A short policy gives everyone the same answer. It helps you:

Protect client and company data by being clear about what may never go into an AI tool.
Keep quality up by requiring a person to check AI output before it reaches a client.
Know what’s in use so you can support the tools that help and retire the ones that don’t.
Respond quickly when someone makes a mistake, because they know who to tell.

Recognized frameworks back this up. The NIST AI Risk Management Framework, which NIST says is "intended for voluntary use," organizes AI risk work into four functions: Govern, Map, Measure and Manage. A written use policy is a basic piece of the Govern function. The OWASP Top 10 for LLM Applications lists risks such as Sensitive Information Disclosure, Prompt Injection, Misinformation and Excessive Agency, each of which maps to a rule in the template below.

AI use policy vs. AI agent policy

An AI acceptable use policy covers how people use AI tools in general: chat assistants, writing tools, image generators and AI features inside the apps you already have. An AI agent policy goes further and covers software that takes actions on its own, such as clicking through websites, editing files or running commands.

Most small businesses should start with the general use policy below, then add agent rules. We cover agents in depth in our pillar guide, AI Agent Policy for Small Business: What to Include and How to Roll It Out, which includes a one-page agent policy template and a 7-day rollout plan. This article stays focused on the staff-wide use policy.

What to include in an AI acceptable use policy

A good small business policy covers eight areas. Keep each one short and specific.

Purpose and scope. Who the policy applies to (employees, contractors, interns) and which devices and accounts it covers.
Approved tools. A named list of AI tools staff may use, and how to request a new one.
Data rules. What information may go into AI tools, what may not, and what needs a manager’s OK.
Human review of output. Who checks AI-generated work, and when it can’t be used without a check.
Disclosure. When staff must tell clients, colleagues or the public that AI helped produce something.
Accounts and access. Which accounts to use, what permissions AI tools may get, and how access is removed.
Incidents. What counts as a problem and who to tell, quickly and without blame.
Training and acknowledgment. How people learn the rules and confirm they’ve read them.

The copy-ready AI acceptable use policy template

Copy everything between the lines into your own document. Replace anything in [brackets]. This template is a starting point, not legal advice.

[Company Name] AI Acceptable Use Policy

Version [1.0] · Effective [date] · Owner: [name and role] · Review date: [date, e.g. every 6 months]

1. Purpose

This policy explains how staff at [Company Name] may use artificial intelligence (AI) tools at work. It aims to help us use AI productively while protecting client data, company information and the quality of our work.

2. Scope

This policy applies to all employees, contractors and interns who use AI tools for [Company Name] work, on company devices or personal devices, and on company or personal accounts. "AI tools" includes chat assistants, writing and image tools, AI features built into other software, browser extensions and AI agents that can take actions on a computer.

3. Approved tools

3.1 You may use only the AI tools on the approved list below for company work.

Tool	Approved uses	Account type	Notes
[Tool name]	[e.g. drafting internal emails]	[Company account only]	[e.g. turn off chat history]
[Tool name]	[e.g. summarizing public research]	[Company account only]

3.2 To request a new tool, email [policy owner] with the tool name, what you want to use it for and what data it would touch. Don’t use the tool for company work until it is approved.

3.3 Don’t install AI browser extensions, desktop assistants or AI agents on company devices without approval.

3.4 [Policy owner] reviews this list at least every [6 months] and removes tools we no longer use.

4. Data rules

4.1 Never put the following into any AI tool unless [policy owner] has approved that specific tool for that data in writing:

Client or customer personal information (names with contact details, ID numbers, health or financial details)
Passwords, license keys, access codes or other credentials
Confidential contracts, pricing, financial records or legal matters
[Industry-specific data, e.g. patient records, case files, tax returns]

4.2 You may use public information, your own general writing and internal content marked [internal / non-confidential] with approved tools.

4.3 When you’re unsure, remove names and identifying details first, or ask [policy owner].

4.4 Use company accounts for company work. Don’t use personal AI accounts for client material.

4.5 Where an approved tool offers settings that limit how your inputs are kept or used, follow the settings listed in section 3.

5. Human review of output

5.1 You are responsible for anything you send, publish or act on, including work AI helped produce.

5.2 Check AI output for accuracy, missing context, tone and anything that sounds confident but may be wrong. AI tools can produce false information.

5.3 A person must review AI-assisted work before it goes to a client, is published, or is used for decisions about money, hiring, legal matters or [other high-stakes areas].

5.4 Don’t follow instructions that appear inside AI output, documents or web pages without checking that they make sense and came from someone you trust.

6. Disclosure

6.1 Tell your manager when AI produced a substantial part of a deliverable.

6.2 Disclose AI use to clients when [a contract requires it / the client asks / the work is presented as personally written or expert advice].

6.3 Don’t present AI-generated images, voices or quotes as real people or real events.

7. Accounts and access

7.1 Sign in to approved AI tools with your company account, using [single sign-on / a strong unique password and multi-factor authentication].

7.2 Give AI tools only the access they need. Don’t connect an AI tool to company email, calendars, file storage or other systems without approval from [policy owner].

7.3 AI agents that can act on a computer or account (open apps, edit files, send messages, make purchases) need separate approval under our AI Agent Policy [link].

7.4 When you leave [Company Name] or change roles, your AI tool access will be removed. Disconnect any company accounts you linked to AI tools.

8. Incidents

8.1 Report any of the following to [contact, e.g. email or chat channel] within [24 hours]:

You put restricted data into an AI tool by mistake
An AI tool or agent did something you didn’t ask for
You find an AI tool on a company device that you don’t recognize
AI output was sent to a client and later found to be wrong

8.2 Report quickly. Honest mistakes reported promptly will be treated as a chance to fix the process, not as grounds for blame.

8.3 [Policy owner] will record the incident, take steps to contain it (for example, stopping a task, revoking access or changing passwords) and update this policy if needed.

9. Training and acknowledgment

9.1 All staff will complete a short AI use briefing when they join and when this policy changes.

9.2 [Violations may lead to removal of tool access and other steps under [Company Name]’s existing policies.]

9.3 Questions go to [policy owner].

Acknowledgment I have read and understand the [Company Name] AI Acceptable Use Policy and agree to follow it.

Name: ______________ Signature: ______________ Date: ______________

Reminder: this template is a starting point, not legal advice. Laws and client contracts vary by industry and location, so have it reviewed before you adopt it.

How to customize the template

Fill in the approved tools table first. Ask staff what they already use. You’ll get a more honest answer if you make clear the goal is to approve useful tools, not to punish anyone.
Name your sensitive data. "Confidential data" is vague. "Client tax returns" or "patient intake forms" is clear.
Pick one owner. In a small office this is often the owner, office manager or outside IT provider. One name beats a committee.
Match your existing admin controls. If you use Google Workspace, Google documents how admins can turn the Gemini app on or off for users. If you use Microsoft 365, Microsoft Purview offers data security and compliance protections for Microsoft 365 Copilot and other generative AI apps. Write your policy to match the settings you actually use.
Keep it short. If a rule doesn’t apply to your business, delete it.

Where AI agents fit

AI agents raise questions a general use policy only touches on, because they act rather than answer. Section 7.3 of the template points to a separate agent policy for that reason.

A few things are worth knowing as you write it:

Windows 11 has its own agent features. Microsoft’s Experimental agentic features setting is off by default, can only be turned on by an administrator, and once on applies to all users on the device. Our guide to Windows 11 agentic AI and how to turn it off shows where it is.
Staff need to know how to check. Our guide on how to tell if an AI agent is running on your Windows PC covers Task Manager, startup apps, extensions and settings.
Staff need to know how to stop one. Our step-by-step guide on how to stop an AI agent on Windows 11 is a good companion to section 8 of the template.

For the full set of agent rules, a one-page agent template and a rollout plan, see the AI agent policy for small business pillar guide.

Rolling out the policy in a small office

Ask before you write. A short, no-blame survey of which AI tools people use gives you your starting approved list.
Draft and trim. Fill in the template and cut anything that doesn’t apply.
Have it reviewed. Ask your attorney, accountant or IT provider, depending on your industry.
Walk through it in person. A 20-minute team meeting gets more questions answered than an emailed attachment.
Collect acknowledgments. Keep signed copies with your other staff records.
Check in. Revisit the approved list on the review date, and update the policy after any incident.

How PERCARIS helps

A policy says which tools are approved. It helps to see what is actually active on each PC. PERCARIS surfaces recognized AI-agent activity on your Windows computer and gives you a Stop control for agents you did not authorize. PERCARIS recognizes known AI tools. It won’t flag every AI agent.

You decide whether to press Stop. PERCARIS works alongside your existing security tools, and each Windows PC is managed on its own. You can read more on how it works.

Plans cover a single PC, a few PCs or a small business. For 26 or more PCs, contact support@percaris.com. See plans.

FAQ

What is an AI acceptable use policy?

It is a short set of rules telling staff which AI tools they may use at work, what data they may put into them, how to check AI output and how to report problems.

Does a small business really need one?

If anyone on your team uses AI tools for work, a written policy gives everyone the same rules for client data and quality. One or two pages is usually enough to start.

Is this template legally binding?

It is a starting point, not legal advice. Have it reviewed by someone who knows your industry and location before you adopt it, and connect it to your existing employee policies.

How is an AI use policy different from an AI agent policy?

A use policy covers how people use AI tools in general. An agent policy covers software that takes actions on its own. Our AI agent policy guide covers agents in depth.

How often should we update our AI policy?

Set a review date, such as every six months, and update it after any incident or when you approve or retire a tool.

Sources

Product features change often. Checked against each source on October 31, 2026. The template is a starting point, not legal advice.

— The PERCARIS Team