How do you write an AI use policy for a small business?

If people in your business use ChatGPT or similar tools, you already have an AI policy. It just isn't written down, so each person makes it up as they go. One employee pastes a customer's complaint, name and address included, into a free chatbot; another refuses to touch AI at all. A short written policy replaces guesswork with a shared rule, protects your customers' information, and gives staff permission to use the tools well.

For a small business, the policy doesn't need legal language or twenty pages. It needs to answer four questions clearly: which tools, what data, when to disclose, and who checks.

The four parts of a one-page policy

1. Approved tools. Name the tools staff may use for work, and on which account. A personal free account and a business plan can treat data differently. For example, OpenAI says it doesn't train its models on data from ChatGPT Team, its workspace plan launched in January at $25 to $30 per user per month. Whatever you choose, read the provider's terms on how inputs are stored and used.

2. Data rules. This is the heart of the policy. Personal information about customers or employees, passwords, financial account details and confidential business information stay out of AI tools unless a specific, approved tool and purpose allow it. Anonymizing (removing names and identifying details) should become a reflex.

3. Disclosure. Decide when customers should be told that AI helped. A reasonable baseline: tell people when they are interacting with an automated system, such as a chatbot on your site, and when a decision about them relies on automated processing.

4. Human review. AI drafts can contain errors stated with confidence. Anything that leaves the business, such as a quote, an email, a social post or a product description, is read and approved by a person, who is responsible for it.

Notes for Québec businesses: Law 25

In Québec, Law 25 has been modernizing private-sector privacy rules in stages since September 2022, with a major set of obligations in force since September 22, 2023. The Commission d'accès à l'information (CAI), Québec's privacy regulator, publishes a checklist of these obligations. Several connect directly to AI use:

• Every business must have a person in charge of protecting personal information, with their title and contact details published. By default this is the person with the highest authority in the business, who can designate someone else to take it on.
• Businesses must have governance policies and practices for personal information and publish information about them in clear terms on their website. An AI policy fits naturally alongside them.
• A privacy impact assessment is required in certain cases, for example before communicating personal information outside Québec. Many AI services process data elsewhere, which is one more reason to keep personal information out of them.
• The CAI suggests informing people when a decision about them is based exclusively on automated processing.
• Confidentiality incidents involving personal information must be handled, recorded in a register and, when there is a risk of serious harm, reported.

The CAI notes that its checklist is general and that the law always takes precedence, and suggests consulting a privacy lawyer. This article is not legal advice either; outside Québec, check your own province's or country's privacy rules.

A worked template

The following is a starting point to adapt, not a finished legal document. Replace the brackets and remove what doesn't apply.

[BUSINESS NAME] AI USE POLICY            Version 1, [DATE]

Purpose: We use AI tools to save time on drafts, ideas and summaries, while protecting our customers' and employees' information.

1. Approved tools: [TOOL, PLAN/ACCOUNT TYPE]. Use only these for work. Ask [NAME] before trying a new tool for work.

2. Never enter: names, addresses, phone numbers or emails of customers or staff; health or financial information; passwords; supplier prices or contracts; anything marked confidential.
   Allowed: anonymized text, public information, our own marketing copy.

3. Disclosure: Our website chatbot says it is automated. We tell a customer if a decision about them was made by an automated system.

4. Review: A person reads, checks facts and approves anything AI helped write before it is sent or published. The person who sends it is responsible for it.

5. Problems: If personal information is entered by mistake, tell [PRIVACY CONTACT NAME] the same day.

Questions: [NAME, EMAIL]      Next review: [DATE]

You can also ask a chatbot to help adapt this template to your trade, as long as you describe your business in general terms and don't paste in real customer data.

Who should approve it?

The owner or the person with the highest authority in the business should sign it, because the policy sets rules for everyone and commits the business to how it treats customer information. In Québec, that same person is by default responsible for protecting personal information under Law 25, unless they have delegated the role, so the policy naturally sits with them or with the delegate.

Approval works best after consultation. Ask the people who use AI daily what they actually do with it; their answers will reveal risks and good uses you hadn't thought of. If you have an accountant, IT provider or lawyer who handles your privacy obligations, a quick review from them is worth the time.

Then make the approval visible and repeatable. Date the policy, have each employee read it, and set a review date. AI tools and their terms change often, so a yearly review, or sooner when you adopt a new tool, keeps the page accurate.