Policy template
AI use policy template
Staff are already using AI tools. A one-page policy tells them which tools are approved, what data stays out and who checks the work. This template gives you the clauses and our notes on each.
In short
An AI use policy should say which tools are approved, what data may never be entered, who must review AI output before it leaves the company, when to tell customers AI was used, and how to report a problem. Keep it to two pages, name an owner, and review it twice a year.
What the policy has to cover
This is a business template, not legal advice. Have your lawyer check it against your sector, especially in healthcare, finance, education and legal services.
Download the checklist as a file and edit the brackets. We keep the sample clauses short on purpose: a policy nobody reads protects nobody.
- Purpose and scope: who it applies to, including contractors
- Approved tools and how to request a new one
- Data classes and what each may be used for
- Human review rules
- Disclosure to customers and partners
- Intellectual property and attribution
- Incident reporting and consequences
- Owner and review date
Sample clauses with our notes
| Section | Sample clause | Our note |
|---|---|---|
| Approved tools | Staff may use only the AI tools on the approved list kept by {owner}. Personal accounts must not be used for company work. | Personal accounts are the usual leak. Offer a business account so the rule is easy to follow. |
| Data rules | Never enter customer personal data, passwords, financial account details or unpublished contracts into a tool that is not approved for that data class. | Give three examples staff will recognize rather than a legal definition. |
| Review | A named person must read and approve AI-written material before it is sent outside the company or used in a decision about a person. | Say what review means. Skimming is not review. |
| Disclosure | When a customer talks to an AI system, we tell them at the start. We do not present AI output as a named person's work. | Check local rules. The EU AI Act and several US states have disclosure duties for some uses. |
| Accuracy | AI tools can be wrong. Check names, numbers, quotes and legal or medical statements against a primary source. | Fabricated citations are the failure we see most. |
| Intellectual property | Do not paste in third-party material you are not licensed to use. Keep a note of which assets were AI-generated. | Ownership of AI output varies by country. Ask counsel before relying on it. |
Data classes in a table
A simple three-level scheme works for most small firms.
| Class | Examples | AI use |
|---|---|---|
| Public | Published blog posts, product pages | Any approved tool |
| Internal | Process notes, draft plans, anonymized figures | Approved business-account tools only |
| Restricted | Customer personal data, health, payment, HR records, source code with secrets | Only tools with a signed data processing agreement and a documented need |
If you have EU or UK customers, your tools may be processors under GDPR. That means a written agreement, a list of sub-processors and a view on where data is stored.
Rolling it out
- Audit current useAsk staff which tools they use today. An amnesty on the answer gets more honesty than a ban.
- Pick the approved listStart with two or three tools with business plans and clear data terms.
- Write two pagesUse the sections above. Add a one-page quick card for the desk.
- Train for thirty minutesShow real examples of what is allowed and what is not, including a prompt that would break the data rule.
- Set the reviewPut a date in the calendar twice a year. Tools and rules change quickly.
Where policies fail
- The policy bans tools but offers no approved alternative, so people use them in secret.
- Nobody owns it, so the approved list goes stale.
- It lists rules but no consequences or reporting route.
- It ignores AI features switched on inside existing software, such as meeting note-takers.
- It is written for lawyers, not for the person at the front desk.
If you need help deciding which uses to allow, our AI consulting work covers policy drafting alongside a use-case review.
Updated 30 October 2026
Questions, answered
Do small businesses really need an AI policy?
Should we ban public AI tools?
Who should own the policy?
How often should it change?
Can Liftup write our policy?
Keep exploring
AI readiness checklist
Most failed AI projects fail before a model is chosen. The process was unclear, the data was scattered or nobody owned the result. Score these before…
ServiceAI consulting services: decide what to build, what to buy and what to skip
Many AI projects fail because the wrong problem was picked, not because the technology was weak. Our consulting work is a short, written decision…
ChecklistAI vendor evaluation checklist
Whether you are buying an AI product or hiring a team to build one, the demo is the least useful part. Ask for evidence on your data, your edge cases…
Want the policy fitted to your tools?
Send us the tools your team uses and we will propose a drafting and training scope.