Status: 7 November 2026. A practical guide, not legal advice. Rules differ by country, state and industry, so check your own situation.
People use AI tools at work whether or not you have a rule. Without one, each person decides alone what is safe to paste into a chat box, and the answers differ. A written policy does three things: it tells people what is allowed, it makes it safe to ask questions and to report a slip, and it gives you something to point to when a customer asks how you handle their data.
It does not need to be long. A policy nobody reads protects nobody. Aim for a few pages plus a one-page summary for the wall.
3. The data rule: red, amber, green
A traffic light is the easiest rule to remember. Three levels cover most days:
- Red, never: names, addresses, phone numbers and emails of customers or staff, health data, pay and HR data, passwords, trade secrets, unpublished figures.
- Amber, anonymised only: customer cases, quote texts, internal procedures. Take out names, places and amounts first.
- Green, allowed: public information, general drafts, ideas, templates with no personal or confidential content.
When in doubt, it is red. Give two or three examples from your own business next to the rule; examples are what make it stick.
Keep a one-page register: tool, what it is used for, the highest data level allowed, which account, who approved it and when it is reviewed. Before you add a tool, find out from the provider's own pages whether inputs are used to train its models and whether you can switch that off, where data is processed, how long it is kept, and whether there is a business plan with proper access control. Write «not stated» where you cannot find an answer: that is information too. Tools get new features and new terms, so review the register yearly.
5. Human review
AI tools can state wrong things with confidence, including invented sources, numbers and quotes. So the rule is simple: AI writes drafts, a person checks them and answers for them. Two limits are worth writing down: no unchecked advice on legal, medical, tax or safety questions to customers, and no decision about a person (hiring, firing, pay, credit) made by AI alone.
More guides: AI use policy guides overview.
6. A short example to adapt
This example is invented and only shows the structure. Replace everything in [square brackets] with your own details.
AI use rules at [Company name]
1. Use only tools on our approved list. Ask [Name] before
you try a new one.
2. Use your company account, never a private free account.
3. Never enter customer or staff names, addresses, health,
pay or contract details. If you are not sure, treat the
information as red.
4. Anonymise first if you want help with a customer case.
5. AI writes drafts. You check the facts and the tone and
you answer for what you send.
6. No unchecked legal, medical, tax or safety advice.
7. Made a mistake? Tell [Name] within 24 hours. Nobody is
blamed for reporting in good faith.
Why it works: it is short enough to remember, it says who to ask and whom to tell, and it removes the fear that makes people hide mistakes.
7. Legal pointers (please check)
- Is a policy required? We do not know of a general law that obliges every small business to have one. Data protection rules, contracts with clients and rules for your sector can still require careful handling of data, and some countries and regions have AI-specific rules. Check what applies to you.
- Personal data. Laws such as the GDPR and UK GDPR can apply when you enter personal data into an AI tool, in particular when the provider processes data in other countries. The safest default is to keep personal data out unless the tool and the legal basis have been checked.
- Staff. Introducing a new workplace rule may need agreement, consultation or a change to contracts, depending on your country and your contracts. Check before you roll it out.
- Intellectual property. Whether AI-generated material is protected, and who owns it, differs by country. Do not present other people's protected content as your own.
When in doubt, ask a lawyer or a data protection adviser.
8. Rolling it out
- Name one owner and find out which tools people already use.
- Decide which tools are approved and fill in the register.
- Adapt the policy and check it against your contracts and the rules that apply to you.
- Announce it by email and hold a session of 20 to 30 minutes with three real examples.
- Collect a signed acknowledgement from everyone and file it.
- Keep an incident log, ask for feedback after three months, and review the policy every year.
- Brief every new starter in their first week.
FAQ
Does a small business need a written AI policy?
We do not know of a general law that obliges every small business to have one. But data protection rules, client contracts and sector rules can still require careful handling of personal and confidential data, and some countries and regions have AI-specific rules. A short written policy helps you apply them in daily work. Check what applies to you.
What should an AI use policy cover?
At least: who and what it covers, which tools are approved, which data may never be entered, who checks AI output, what is not allowed, how incidents are reported, and when the policy is reviewed.
Can staff put customer data into AI tools?
As a safe default, no. Keep personal and confidential data out of AI tools unless the tool and the legal basis have been checked and approved in writing. Anonymise first wherever you can.
This guide is a practical aid, not legal advice. LeZo, Andrin Portmann, Switzerland. Imprint · Privacy