How to Write an AI Usage Policy for a Small Company (Sections to Include)

In many small companies, AI use started quietly. One person used ChatGPT for emails, another for social posts, someone else for spreadsheets. Nobody decided on rules because nobody thought they were needed. Then a question comes up: can we paste a client's contract into this? Who checks what the AI wrote?

An AI usage policy answers those questions before they become problems. It does not need to be long. A clear two-page document is better than a twenty-page one nobody reads. Here are the sections worth including.

1. Purpose and Scope

Start with a short statement of why the policy exists: to let staff use AI productively while protecting customers, the company and themselves. State who it covers, including full-time staff, part-timers, interns and freelancers who work on company material.

Keep the tone encouraging. If the policy reads like a list of punishments, people will simply use AI quietly and not ask questions. The goal is safe use, not no use.

Include a short definition of what counts as an AI tool for the policy. This should cover chat assistants, AI features inside existing software, image generators, transcription tools and browser extensions. Many people do not realise that a grammar extension or meeting recorder may also send text to an AI service.

2. Approved Tools and Accounts

List which AI tools are approved and on which accounts. For example: "Company Microsoft 365 Copilot and the company ChatGPT business workspace are approved. Personal AI accounts must not be used for company or customer information."

Name who can approve new tools. AI products appear constantly, and staff will want to try them. A simple request process, such as a message to one named person, avoids both chaos and frustration. Note who manages account access, especially when staff leave.

Also mention browser extensions and phone apps. Some free AI extensions request permission to read every page you visit, which can include internal systems and customer records. Require approval before installing them on work devices.

3. Data Rules

This is the most important section. Be concrete about what can and cannot be entered:

• Allowed: public information, general writing tasks, anonymised examples, internal non-sensitive drafts
• Allowed only in approved business tools: internal documents, non-personal business data
• Not allowed: IC numbers, bank details, health information, passwords, customer lists, confidential client documents unless specifically approved

Link this section to your privacy notice and to the Personal Data Protection Act obligations. Our PDPA-minded checklist for AI at work gives more detail.

Give two or three real examples for each category so staff do not have to interpret the rules. "Drafting a reply to a general enquiry: allowed. Pasting a customer's full WhatsApp chat with their address: not allowed." Examples are remembered far better than definitions.

4. Checking and Responsibility

State clearly that the person who uses AI is responsible for the result. AI output must be reviewed before it is sent to customers, published or used for decisions. Facts, numbers and legal or medical statements must be verified from reliable sources.

A useful rule: "If your name is on it, you have checked it." AI is a tool, and the person using it owns the outcome.

Add a short note on transparency, for example whether customers should be told when they are chatting with an AI assistant. Many companies choose to disclose this, which builds trust. For a practical method, see how to fact-check AI answers.

Spell out who to contact when something goes wrong, for example if confidential information was entered by mistake. A named person and a simple "report it the same day" rule make it easy for staff to own up quickly.

5. Content, Copyright and Review Cycle

Cover AI-generated images and text used in marketing. Staff should avoid prompts that copy a living artist's style or a competitor's brand, and should not present AI images as real photos of your products or premises when they are not.

Finally, set a review date. AI tools and their terms change quickly, so revisit the policy every six months. Ask staff what is working and what is unclear. Keep a short log of questions people raise, because they show exactly where the policy needs improving.

To roll it out, hold a 30-minute session, walk through real examples, and pin the policy where people can find it easily.

FAQ

How long should an AI policy be?

For most SMEs, one to three pages. Short enough that everyone reads it, specific enough that it answers real questions.

Do freelancers need to follow it?

If they handle company or customer information, yes. Include it in your briefing or contract.

What if staff ignore it?

Start with training and examples. Most problems come from unclear rules, not bad intent.

An AI usage policy turns scattered personal habits into a shared, safe way of working. Write the five sections above, keep the language plain, and update it as your tools and confidence grow.