Generative AI acceptable use policy template for a small company
A fill-in AI usage policy for companies of roughly 5 to 200 people: approved tools table, data classification for what may be pasted where, allowed and prohibited uses, review and disclosure rules, product AI features, and incident reporting.
File in Operations by AISkillHub Library
What it does
Most small companies have no written AI policy, so people either avoid useful tools or paste customer data into whatever is open. A short, specific policy fixes both. This template is written to be read by everyone, not just legal, and to be finished in an afternoon.
**Sections**
1. Purpose and scope (employees, contractors, any device, any AI feature, including those built into other software) 2. Five principles: you own the output, data only where allowed, approved tools for company data, disclose where it matters, ask when unsure 3. **Approved tools table**: tool, plan, maximum data class, account type. Includes a reminder to check training use, retention, processing location and DPA status per plan, since business and personal plans often differ. 4. **Data classification grid**: Public, Internal, Confidential, Restricted, with examples and where each may go 5. Allowed and prohibited uses, including no AI-only decisions about people, no impersonation, and no connecting agents to production or customer data without approval 6. Quality, review and disclosure: verify facts and code, human review for customer-facing content, tell customers when they are talking to an automated system 7. Rules for AI features you build into your own product 8. Incident reporting, framed so people report quickly 9. Acknowledgement line
**Variables to fill**
`{{company_name}}`, `{{policy_owner}}`, `{{effective_date}}`, the approved tools rows (`{{tool_1_name}}` and so on), `{{review_turnaround}}`, `{{incident_contact}}` and `{{incident_report_window}}`. A table at the end lists each one.
**What it will not do**
This is a practical starting point, not legal advice. It does not cover sector-specific rules (health, finance, public sector) or particular laws in your jurisdiction. Have someone responsible for legal or privacy review it before you publish it, and add any obligations from your customer contracts.
How to use it
1. Copy `docs/ai-acceptable-use-policy.md`. 2. Replace every `{{...}}` value. The table at the bottom of the file explains each one. 3. Fill the approved tools table. For each tool, record the exact plan (free, team, enterprise) and check its data terms before listing it. 4. Delete the block-quote guidance notes. 5. Ask whoever handles legal or privacy to review it, and add any contract-specific restrictions. 6. Publish it where people work (handbook, wiki), announce it with two or three concrete examples of what is and is not allowed, and collect acknowledgements. 7. Put a calendar reminder for the six-month review, and update the tools table whenever a tool is approved.
Files
Save each file at the path shown, relative to your project root.