Free AI Acceptable Use Policy Template for Small Businesses

QUICK ANSWER

An AI acceptable use policy tells employees which AI tools they may use, what information they may put into them, and who reviews AI output before it reaches a customer. The free template below covers the eleven sections a small business needs. Copy it, fill in the bracketed fields, and have leadership sign it.

WHY A SMALL BUSINESS NEEDS ONE NOW

Your staff already use AI. Surveys of knowledge workers consistently find that many use AI tools their employer never approved, often on personal accounts. Without a written policy, nobody knows whether pasting a client contract into a chatbot is allowed. A short policy gives employees a clear yes or no, gives you something to point to when a client or insurer asks how you manage AI, and gives your IT provider a rule to enforce.

WHAT THE TEMPLATE COVERS

Section	What it answers
1. Purpose and scope	Who the policy applies to and which tools count as AI
2. Approved tools	Which AI tools are allowed, and on which accounts
3. Requesting a new tool	How an employee asks for a tool not on the list
4. Data you may never enter	Which information stays out of AI tools entirely
5. Data you may enter with care	What is allowed, and under which conditions
6. Human review of output	Who checks AI output before it is used
7. Customer-facing use	When customers must be told AI was involved
8. Intellectual property	Who owns AI-assisted work, and how to avoid copying
9. Prohibited uses	What AI may never be used for
10. Reporting and incidents	What to do if something goes wrong
11. Review and acknowledgement	How often the policy is updated, and who signs

THE FREE TEMPLATE

Copy everything in this section into your own document. Replace each [bracketed field].

1. Purpose and scope

This policy sets the rules for using artificial intelligence (AI) tools at [Company Name]. It applies to all employees, contractors and interns who use AI tools for company work, on company or personal devices. "AI tools" means any software that generates text, images, code, audio or decisions, including chat assistants, writing assistants, browser extensions and AI features built into other software.

2. Approved tools

Employees may use only the AI tools listed below for company work, and only through company-managed accounts.

Tool	Approved for	Account type
[e.g., Microsoft 365 Copilot]	[Drafting, summarizing internal documents]	[Company account]
[e.g., ChatGPT Enterprise or Team]	[Research, drafting]	[Company workspace]
[Add rows as needed]

Personal AI accounts may not be used for company work.

3. Requesting a new tool

To use an AI tool not on the approved list, email [Policy Owner, e.g., IT lead or MSP contact] with the tool name, what you want to use it for, and what data it would touch. Do not use the tool until you receive written approval. We aim to respond within [5] business days.

4. Data you may never enter into an AI tool

• Customer personal information: names with account numbers, Social Security numbers, health information, payment card data.
• Credentials: passwords, API keys, access tokens.
• Confidential contracts and legal matters: unless the tool is approved for that use in Section 2.
• Regulated data: any information covered by [HIPAA / GLBA / state privacy law / client contract terms].

5. Data you may enter with care

Internal, non-sensitive business information may be entered into approved tools. Remove names and identifying details where you can. When in doubt, ask [Policy Owner] first.

6. Human review of output

AI output can be wrong, out of date or biased. A named person must review AI-generated content before it is sent to a customer, published, used in a financial or hiring decision, or relied on for legal or compliance purposes. The reviewer is accountable for the final result.

7. Customer-facing use

If AI generates content or makes a recommendation that a customer will rely on, [Company Name] will disclose that AI was involved where required by law or contract. AI chat tools that speak directly to customers require approval from [Executive Owner].

8. Intellectual property

Work created with AI tools for [Company Name] belongs to [Company Name]. Do not ask AI tools to reproduce copyrighted material, and do not present AI output as the work of a named third party.

9. Prohibited uses

AI tools may not be used to:

• Make automated decisions about people: hiring, firing, credit, or pricing for individuals, without human review.
• Deceive: create misleading content, impersonate real people, or generate fake reviews.
• Bypass security: work around company security controls or monitoring.
• Break the law: violate any law, regulation or client contract.

10. Reporting and incidents

If you entered prohibited data into an AI tool, or AI output caused a problem, report it to [Policy Owner] within [24 hours]. Reporting quickly is never a disciplinary matter on its own.

11. Review and acknowledgement

[Policy Owner] reviews this policy every [6 / 12] months, and whenever a major new AI tool is adopted. Violations may lead to disciplinary action.

Policy owner: [Name, Title] Approved by: [Name, Title] Effective date: [Date]

Employee acknowledgement: I have read and agree to follow this policy. Name: ________ Signature: ________ Date: ________

HOW TO ROLL IT OUT IN FOUR STEPS

1. Find out what is already in use: List the AI tools your team uses today before you write the approved list. Ask, and check browser and Microsoft 365 activity where you can.
2. Fill in the brackets: Name a policy owner, choose your approved tools, and match Section 4 to the regulations you actually face.
3. Get signatures: Send the policy with a short explanation and collect acknowledgements.
4. Put a review date on the calendar: AI tools change monthly; a policy nobody revisits drifts out of date.

FOR MSPS: WHITE-LABEL THIS TEMPLATE

Managed service providers may rebrand this template and hand it to clients under their own name. Replace the company fields, add your logo, and make it the first deliverable of an AI readiness engagement. RAIC's MSP partner program then lets you track each client's policy, approved tools and Shadow AI activity from one multi-tenant console, with each client's data kept separate. See the MSP White-Label AI Governance Playbook and RAIC for MSPs.

A POLICY ON PAPER VS. A POLICY IN PRACTICE

A signed policy states the rules. It does not tell you whether people follow them. RAIC closes that gap for small businesses:

• Shadow AI discovery: continuously detects supported AI services and model activity using browser and Microsoft 365 signals, matched against RAIC's curated AI catalog, so you can compare actual use with your approved list.
• Policy templates: ready-to-edit AI policies, including acceptable use, that you can adapt instead of starting from a blank page.
• Approvals with evidence: new-tool requests route to the right approver, and each decision records who approved it and when.
• Reports for clients and insurers: export your AI inventory and policy status when someone asks how you govern AI.

To find the AI tools already in use before you write your approved list, follow How to Detect Shadow AI in a Small Business. A policy is one part of a wider AI governance program. For the bigger picture, read Shadow AI: The SMB Guide.

NEXT STEPS

• Start a free trial: raic.rhindoncyber.com/pricing
• Book a demo: raic.rhindoncyber.com/demo
• Partner and MSP inquiries: [email protected]

Rhindon AI Risk & Integrity Cloud | raic.rhindoncyber.com | © 2026 Rhindon Cyber