Someone on your team pasted a client contract into ChatGPT last month, despite having no AI use policy template to tell them where the line was. You do not know who, you do not know which client, and you do not know whether that tool was set to train on it. That is not a hypothetical. In a business of ten people, it is closer to a statistical certainty.
Most owners respond in one of two ways. They ignore it, or they announce a ban that everyone quietly works around. Both are worse than the third option, which is writing down the rules once, on a single page, so people know where the lines are.
This is the policy I give founder-led businesses. Nine sections, plain English, no legal padding. I will walk through what each section is for, what to actually write in it, and how to get it signed off in a week.
Key Takeaways
- An AI use policy template for a small business should fit on one page and cover nine things, not forty. Length kills adoption faster than anything else.
- Your staff are already using AI. Roughly half do not tell their employer, so a ban does not stop usage; it just stops you from seeing it.
- The single most useful clause is a traffic light data rule: what can be pasted into a public tool, what needs care, and what never leaves the building.
- Name one owner and one review date. A policy with no owner is out of date within a quarter, and nobody notices.
- The human check clause matters more than the tool list. Anything AI helped write that goes to a client gets read in full by a named person first.
- Under the NZ Privacy Act 2020, a serious privacy breach is notifiable whether a person or a chatbot caused it. The tool does not change your obligation.
- Rolling this out takes about five hours across one week: draft it, test it against three real scenarios, brief the team, then leave it alone for a quarter.
Why Your Team Is Already Using AI Without a Policy
Ask a ten-person team on a Monday morning who is using AI for work, and you will get two or three hands. Ask them anonymously, and the number is usually most of the room.
That gap has a name now. Shadow AI is the same pattern as shadow IT fifteen years ago, when everyone started using Dropbox because the company file server was slow. People are not being sneaky. They found something that made a two-hour task take twenty minutes, and they kept using it because the alternative was staying late.
The uncomfortable part for owners is that the usage is invisible and unevenly skilled. Your best salesperson is drafting proposals with AI and checking every line. Your newest admin is pasting an entire client spreadsheet in to ask a question about it. Same tool, wildly different risk, and you have no way to tell the two apart because neither of them told you.
Here is the bit that changes how you think about it. The information going into these tools is the same information your business runs on. Client lists, pricing, contract terms, the notes about which customer is unhappy. That is not filler; that is the asset. One client of mine had 319 dormant contacts sitting in a database his team had written off completely. Worked properly, that list returned $49,000. If a list like that is worth that much to you, it is worth something to somebody else too.
So the question is not whether your team should use AI. They should, and the ones who use it well are already pulling ahead. The question is whether anybody has told them where the edges are. In most small businesses, nobody has.
The Four Risks an AI Use Policy Template Actually Prevents
Before writing anything, get clear on what you are protecting against. There are four risks that matter in a business this size, and a pile of imagined ones that waste your time.
Confidential information leaving the building
The obvious one. Client data, staff records, financials, anything covered by an NDA, pasted into a consumer tool that may retain it or use it to train a model. Most business-tier AI products do not train on your inputs by default, but consumer tiers vary, and settings get changed. Nobody on your team is reading the terms of service.
AI output reaching a client without a human check
This is the risk that actually bites small businesses, and it gets far less attention than the data one. A quote with a wrong figure. A client email that invented a policy you do not have. An SEO article with a confidently fabricated statistic in it. AI is extremely good at being wrong in a fluent, professional-sounding way, which is exactly how errors get through.
No record of what happened
If a client asks whether AI was involved in their work, you need an answer. If something goes wrong, you need to know which tool, whose account, and what went in. With no policy, there is no register, no audit trail, and no way to reconstruct events.
Tool and billing sprawl
Nine people on nine personal subscriptions, paid on nine different cards, with company data spread across all of them. When someone leaves, that data leaves with their personal account. This one is boring, and it is the one that catches people out most often.
There is also a fake fix worth naming. Banning AI does not reduce your risk; it relocates it. Staff move from tools you could have approved and configured onto personal phones where you have no visibility at all. The 90-day AI automation checkpoint is a useful companion read here, because the same pattern shows up in businesses that adopted AI with no plan and businesses that banned it. Both end up with a mess they cannot see.
The AI Use Policy Template: Nine Sections to Write Down
Here is the template. Aim for one page, or two if your business is regulated. If it runs past three pages, nobody reads it, and you have built a compliance artefact instead of a working rule set.
Each section below has the purpose, then a sample clause you can adapt. Replace the bracketed parts with your own details.
1. Purpose and scope
One short paragraph. Who this covers and where it applies. Contractors are the part people forget, and contractors are often the heaviest AI users on the team.
This policy covers everyone doing work for [Business], including employees, contractors, casual staff and agencies. It applies to any AI tool used for work purposes, on any device, on or off site.
2. The approved tools list
Name the tools people can use without asking. Keep it short and keep it current. The point is not to restrict choice; it is to make the safe option the easy option.
Staff may use the tools listed below for work without further approval: [ChatGPT Team, Claude, Microsoft Copilot, and so on]. Anything not on this list needs a quick check with [owner] before it touches client work. Approving a new tool usually takes a day, so ask rather than guess.
Add a line about who maintains the list and how to request an addition. If requesting takes longer than five minutes, people will skip it.
3. The traffic light data rule
This is the most important section in the whole document. Three categories, written in the language of your actual business, not in abstract terms like “sensitive information” that nobody can apply under pressure.
Green, use freely. Public information, marketing copy drafts, general how-to questions, anything already on your website or in a brochure.
Amber, use with care. Internal processes, de-identified client scenarios, financial figures with no names attached. Fine in an approved business-tier tool, not in a free consumer account.
Red, never goes in. Client names combined with personal details, health information, bank or account numbers, passwords, signed contracts, anything covered by an NDA, staff records and payroll data.
The test: if you would not email it to a stranger, do not paste it into a chatbot.
That last line does more work than three paragraphs of definitions. People remember it.
4. The human check before anything leaves
Simple, non-negotiable, and the clause that prevents most real-world damage.
Anything AI helped produce that goes to a client, a supplier, the bank or the public is read in full by a person before it is sent. That person is accountable for the content, including any figures, claims or commitments in it. AI drafts, humans send.
If you want one clause and only one clause, make it this one.
5. Disclosure: when the client gets told
Founders tie themselves in knots over this. The workable position is narrow and specific.
Disclosure is not required for internal drafts, admin, research or first-pass writing. Disclose AI involvement where a client has asked, where a contract or tender requires it, or where a client could reasonably assume a person produced the work by hand, such as personal advice or original creative work.
Get this one wrong in either direction, and it costs you. Over-disclose and you are apologising for using a spellchecker. Under-disclose in a tender that asked, and you have a contract problem.
6. Accounts, access and billing
The unglamorous section that saves you when someone resigns.
Work AI accounts use work email addresses, are paid through the company, and are recorded in the tools register with the account owner’s name. Personal accounts are not used for client work. Where a tool offers a setting to exclude your data from model training, that setting is switched off before the account is used for work.
7. Client and supplier obligations
Your own rules are not the only rules that apply.
Before using AI on a client’s data or files, check the client contract and any NDA. If it prohibits AI use, do not use it. If it is silent and the data is sensitive, ask the client before proceeding and record the answer.
If you subcontract delivery, push the same clause down to your subcontractors. My AI automation contract checklist covers the reverse case: what to look for when someone is building AI systems for you.
8. What to do when something goes wrong
The section most templates skip, and the one that determines whether you find out about problems in an hour or in a year.
If confidential information goes into a tool by mistake, tell [owner] the same day. Nobody is disciplined for reporting a mistake quickly. Delete the conversation, check the tool’s data controls and retention settings, and record what happened in the incident log.
Then add the legal line. In New Zealand, the Privacy Act 2020 requires you to notify the Office of the Privacy Commissioner and the affected people if a privacy breach has caused, or is likely to cause, serious harm. The Office of the Privacy Commissioner has guidance on assessing that threshold. Australian businesses have an equivalent obligation under the Notifiable Data Breaches scheme. A chatbot causing the breach instead of a person does not change any of it.
9. Owner and review date
Two lines. Both essential.
This policy is owned by [name]. It is reviewed every quarter, next review [date]. Version and date appear at the top of the document.
A policy with no named owner is orphaned on the day it is written. Six months later it references a tool that no longer exists and permits a model that has been retired.
How to Roll the Policy Out in a Week
Writing the document is the small part. Getting people to actually follow it is the rest. Here is the sequence that works, and it costs about five hours total.
Monday, draft it. Take the nine sections above and fill in the brackets. Sixty to ninety minutes. Do not send it to a lawyer yet. Do not workshop it with the team yet. Get a complete draft on one page first, because a complete rough draft attracts better feedback than a polished half-draft.
Tuesday, test it against three real situations. Pull three things that actually happened in your business in the last month. A quote that went out. A client complaint that needed a careful reply. A report someone spent a day on. Walk each one through the policy. Is the data green, amber or red? Who does the human check? Is disclosure needed? You will find at least one section that does not survive contact with reality. Fix it now, not after the team has read it.
Wednesday, get the two people most likely to argue to read it. Not the whole team. The two who use AI most and the one who is most sceptical. Fifteen minutes each. They will find the gaps and, more usefully, they become the people who explain it to everyone else.
Thursday, brief the team in twenty minutes. Not an email. A short meeting where you read the traffic light rule out loud, explain the human check, and say the sentence that determines whether this works: nobody gets in trouble for reporting a mistake fast. If the team thinks reporting a slip-up is career-limiting, they will hide the slip-ups and you will find out from a client instead.
Friday, set up the two supporting artefacts. A tools register, which is a spreadsheet with the tool name, who owns the account, what it is used for and whether training is disabled. And an incident log, which is a second tab on that same spreadsheet. Both take fifteen minutes, and both are the first things anyone will ask for if something ever goes wrong.
Then leave it alone for three months. Resist the urge to keep revising it. A policy that changes weekly teaches people that nothing in it is fixed.
One thing to avoid: do not roll a policy out alongside a new tool launch. People conflate the two and the policy reads as a brake on something they were excited about. Give the policy its own week. If you are still working out where AI fits in the business at all, sort that first. AI adoption for an SME covers the sequencing, and policy is a lot easier to write once you know what you are actually doing with the technology.
Keeping Your AI Use Policy Template Alive
Every policy in a small business dies the same way. It gets written during a burst of concern, saved to a folder, and never opened again. Twelve months on, it names two tools nobody uses and misses the four everyone does.
Three habits keep it current, and none of them takes real time.
Quarterly, fifteen minutes. Open the tools register. Anything on the approved list nobody uses? Remove it. Anything in use that is not on the list? Either approve it properly or stop it. Anything in the incident log? Read it back and check whether the policy would have prevented it.
On every new tool, one question. Before anyone signs up for anything: what data goes in, and what colour is it? If the answer is red, the tool needs a proper look at its terms and a business-tier account, or it does not get used. That single question handles about eighty per cent of tool decisions with no further thought.
On every new hire, ten minutes. The policy goes in the induction pack next to the health and safety brief. New people arrive with habits from their last job, and those habits were formed under someone else’s rules or no rules at all.
There is a broader principle underneath all of this. A policy tells people what not to do. It does not tell them what your business actually knows, how it operates, or what good work looks like here. That is a different problem, and it is the one that eats most founders alive: everything that matters lives in the owner’s head, so every decision routes back through them.
The businesses that get the most out of AI are the ones that have written down how they operate, not just what is forbidden. When the context sits in a system the AI can read, the tools stop producing generic slop and start producing work that sounds like your business. Rules plus context, in that order. The policy is the guardrail. The written-down operating knowledge is what makes the whole thing worth having. The US National Institute of Standards and Technology AI Risk Management Framework makes the same point at enterprise scale: governance is a practice you run, not a document you file.
Bringing It Together
A ten-person business does not need an AI governance programme. It needs one page that answers four questions: which tools, what data, who checks the output, and what happens when it goes wrong. Using a simple AI use policy template gives you the structure to support those four answers without creating unnecessary red tape.
Write it this week. Test it against three real jobs. Brief the team in twenty minutes and mean the part about reporting mistakes. Then review it once a quarter and otherwise leave it alone.
The point is not to slow your team down. The people using AI well in your business are the ones giving you the most output right now, and a policy that treats them as a threat will push them back to doing things the slow way, or push them somewhere you cannot see. Give them clear edges, and they will run faster inside them.
The bigger prize sits just past this. Once the rules are set, the next question is what your business actually knows and where that knowledge lives. Right now it is probably in your head, which is why you are still the bottleneck.
If you want to work out where AI fits in your business and what to build first, book a 30-minute Discovery Call. No pitch deck, no obligation. Just a straight conversation about where your time is going and which part of it a system could take off your hands.
Frequently Asked Questions
What should an AI use policy include?
At minimum: scope, an approved tools list, a data classification rule covering what can and cannot be entered into AI tools, a human review requirement before AI-assisted work reaches a client, disclosure rules, account and billing standards, client contract obligations, an incident reporting process, and a named owner with a review date. Nine sections. One page is enough for most businesses under fifty people.
Does a small business really need an AI use policy?
Yes, and arguably more than a large one. Big companies have IT controls that block risky tools. A ten-person business has none, so the only control is what people know. Surveys consistently find that a large share of staff use AI at work without telling their employer. A one-page policy costs a few hours and removes the guesswork for everyone.
Is it legal to put client data into ChatGPT in New Zealand?
It depends on the data and the tool’s settings. The Privacy Act 2020 applies regardless of which software you use, so you remain responsible for personal information you disclose to a third party. Personal, health or financial details should not go into a consumer-tier tool. Use a business account with training disabled, check the client contract first, and de-identify where you can.
How long should an AI use policy be?
One page for most small businesses, two if you work in a regulated sector like health or finance. Length is inversely related to compliance. A forty-page document written by a law firm gets signed once and never read again, which means it protects nobody. Short, specific and actually memorised beats comprehensive and ignored every time.
Who should own the AI use policy in a small business?
Whoever will actually open it every quarter. In a ten-person business, that is usually the owner or the operations manager, not an outsourced IT provider. The owner’s name goes at the bottom of the document alongside a review date. Policies without a named individual attached drift out of date within about two quarters, and nobody notices until something goes wrong.
What is shadow AI and why does it matter?
Shadow AI is staff using AI tools for work without the business knowing. It matters because usage you cannot see is usage you cannot manage. Your most careful person and your least careful person are both feeding company information into tools you have not assessed. Writing a policy does not create shadow AI; it converts it into visible, manageable use.
Should I ban AI tools instead of writing a policy?
Banning moves the activity onto personal phones and personal accounts where you have no visibility and no recourse. It also puts you behind competitors whose teams are working faster. A policy with clear limits gives you the safety a ban promises without the productivity loss, and it keeps the conversation open so people tell you what they are using.
About Octavius
Titus Mulquiney is the founder of Octavius AI, where he builds AI brains and AI workforces for founder-led businesses stuck running everything out of their own head. Twenty years in marketing, ex-Sony product manager, ex-GM Zeal NZ. Based in Auckland, working with operators across NZ, Australia, and the US. Connect on LinkedIn.