What to Include in an AI Policy for Your Business: A Practical Checklist

If you know your business needs some ground rules for AI but you are not sure what belongs in the document, that is a normal place to start. An AI policy does not need to predict every new tool or answer every legal question. It needs to give staff clear boundaries, a sensible approval process and a way to recognise when an AI task needs human judgement. This guide walks through the core sections so you can build a policy around the work your team actually does.

Start with the work, not a generic template

Before starting, Alex searched for a generic AI policy template and found one that looked polished but did not address half of what mattered to the design studio. It mentioned privacy in broad terms, but said nothing about uploading a client's unpublished brand files, checking generated copy before it went to a customer, or deciding who owned an image created with a text-to-image tool.

After working through this checklist, Alex has a clear list of the elements the policy needs to cover. The final document fits the way the studio's staff use AI day to day, including drafting proposals, summarising meetings, generating early design concepts and researching unfamiliar industries. That is the difference between a policy that sits unread in a folder and one that helps staff make better decisions.

Your first task is therefore to list the AI uses already happening in the business. Include official tools, free accounts, features built into existing software and any unofficial tools staff may be using. The policy can then respond to real activities instead of imagined risks.

1. Purpose and scope

Open with a short statement explaining why the policy exists. Keep it practical. The purpose may be to help staff use AI productively while protecting customers, employees, confidential information, creative work and the reputation of the business.

Define who and what the policy covers. This may include employees, contractors, temporary workers and external agencies using AI on behalf of the business. It should also cover AI features inside familiar products, not only standalone chatbots. Writing assistants, meeting transcription, image generation, customer service automation, recruitment screening and document analysis can all fall within scope.

Avoid defining AI so narrowly that the policy becomes outdated when a product changes its name or adds a new feature. A plain description such as software that generates, predicts, recommends, classifies or makes decisions from data is usually easier for staff to apply.

2. Approved tools and permitted uses

State whether staff may use any AI tool, only approved tools, or approved tools for particular tasks. A small business usually gets more value from a short approved list than from a complete ban. The list can identify the account type, approved purpose, business owner and any restrictions.

Separate low-risk uses from higher-risk uses. Brainstorming internal event ideas is different from generating advice for a customer, analysing employee performance or producing a final legal or financial document. Your policy can allow routine assistance while requiring additional approval for work that could materially affect a person, a customer or the business.

Include an approval route for new tools. Staff should know who reviews requests, what information they need to provide and whether a trial can use real business data. This reduces shadow AI, meaning tools adopted without the business knowing about them.

3. Information that must not be entered

This is one of the most important parts of the policy. Name the information categories staff should not place into an unapproved AI service. Examples can include customer personal data, employee records, passwords, payment information, confidential contracts, unpublished financial results, trade secrets, source code, medical information and material supplied under a non-disclosure agreement.

Do not rely on a vague instruction to avoid sensitive data. Give examples from your own business. A design studio might prohibit uploading client logos before launch, raw customer research, private campaign plans and licensed stock assets. A manufacturer might focus on drawings, formulas, supplier pricing and production records.

Where personal information is involved, the relevant privacy rules depend on the people, locations and activities involved. The European Commission explains that the General Data Protection Regulation applies to the processing of personal data in its scope, while its business guidance outlines issues organisations should review. Treat these links as starting points and obtain region-specific advice where needed.

4. Human review and responsibility

Make it clear that the person using an AI tool remains responsible for the work. AI output can be incomplete, incorrect, biased, outdated or presented with more confidence than the evidence supports. Staff should not treat a fluent answer as a verified answer.

Describe the level of checking expected before output is used. For internal brainstorming, a quick sense-check may be enough. For customer-facing material, financial figures, safety information, employment decisions or professional advice, the policy may require a named reviewer, source checking and approval through the normal business process.

It is also useful to identify decisions that should not be handed to an AI system without appropriate oversight. The NIST AI Risk Management Framework is a voluntary resource that organisations can use to organise AI risk considerations. Its Govern, Map, Measure and Manage functions can help a business think about accountability without copying an enterprise framework word for word.

5. Accuracy, sources and disclosure

Your policy should explain how staff verify facts, quotations, calculations and references produced by AI. A sensible rule is that important claims must be checked against reliable source material before being published, sent to a customer or used to make a decision.

Set expectations for disclosure as well. Not every spelling correction needs an AI label, but customers or colleagues may need to know when AI materially created content, interacted with them, influenced a recommendation or produced a synthetic image, voice or video. The right approach depends on context, audience expectations and regional rules.

For US-facing activities, the Federal Trade Commission's AI resources provide official material on deceptive claims, privacy and consumer protection. The FTC has repeatedly framed existing consumer protection principles as applying to AI-related conduct, so a policy should not assume that using a new technology removes ordinary expectations around truthful claims and fair treatment.

6. Intellectual property and creative work

Cover both what staff put into a tool and what they take out. The input side includes copyrighted documents, photographs, designs, code, music, confidential briefs and third-party assets. Staff should know when they need permission before uploading material and when a licence or customer agreement limits its use.

The output side is more complicated because ownership, protectability and permitted commercial use can differ by tool, contract and jurisdiction. Your policy does not need to settle every legal question. It should require staff to review the tool's terms, keep records of significant prompts and source material where appropriate, and escalate work intended for commercial publication or client delivery when ownership is unclear.

For a creative business, include a rule against presenting generated work as fully original human work when that description would be misleading. Also require checks for logos, recognisable characters, copied passages and close imitation of another creator's distinctive work.

7. Fairness and decisions about people

AI used in hiring, performance management, lending, insurance, healthcare, education or access to services can affect people in significant ways. If your business uses AI to rank, recommend, score or filter people, the policy should require a higher level of review than it does for drafting an internal email.

Include a process for testing whether the system produces unfair or inconsistent outcomes, documenting the information used, allowing human review and giving staff a route to raise concerns. The policy should also identify uses that are prohibited by the business, even if a tool technically offers the feature.

Businesses operating in or serving the European Union should review the official EU AI Act overview. The European Commission notes that the Act uses a risk-based structure, includes prohibited practices and introduces obligations that apply on different dates. Its AI literacy guidance also explains the training concept for providers and deployers in scope.

8. Security, access and vendor checks

Connect AI use to your existing security rules. Require business accounts where available, strong authentication, appropriate access controls and prompt removal of access when a worker leaves. Staff should not share passwords or connect an AI service to business email, cloud storage or customer systems without approval.

Before approving a tool, review where data is processed, whether prompts or files are retained, whether customer data is used to train models, what administrative controls are available, how deletion works and what the vendor says about security incidents. Record the answers rather than relying on a sales page.

Your policy should name the person or role responsible for vendor review. In a small business this may be the owner, operations manager or external IT provider. The process can be simple, but somebody needs to make the decision and keep the evidence.

9. Records, incidents and escalation

Explain what records should be kept for important AI uses. This may include the tool used, purpose, person responsible, date, source material, significant prompts, review steps and final decision. You do not need to archive every casual prompt, but higher-impact work should be traceable.

Give staff a simple incident process. They should know what to do if confidential information is entered into the wrong tool, generated content is sent without review, an AI account is compromised, a customer complains, or an output appears discriminatory or unsafe. The first step is usually to stop further use, preserve relevant records and report the issue to the named contact.

Make the reporting culture practical rather than punitive. Staff are more likely to report mistakes early when the policy distinguishes an honest error from deliberate misuse. Early reporting gives the business more options to contain the problem.

10. Training, ownership and policy review

Name a policy owner and explain what that person is responsible for. Typical duties include maintaining the approved-tool list, reviewing exceptions, coordinating incidents, arranging training and scheduling updates.

Training should match the work people do. A short session using examples from the business is usually more useful than a long technical course. Staff need to recognise restricted information, know when output needs checking, understand the approval route and practise reporting a mistake.

Set a review schedule, such as every six or twelve months, and trigger an earlier review when the business adopts a major new tool, changes a high-impact process, receives a complaint or sees a significant regulatory development. Version control helps staff know which policy applies.

A practical AI policy checklist

• State the policy purpose and the business outcomes it supports.
• Define who, which systems and which types of work are covered.
• List approved tools and permitted uses.
• Create a clear approval process for new tools and exceptions.
• Name information that must not be entered into unapproved services.
• Set different controls for low-risk and high-impact uses.
• Require human review and assign responsibility for final work.
• Explain how facts, calculations, sources and references are checked.
• Set expectations for telling people when AI materially shaped an interaction or output.
• Address copyright, confidential material, licences and ownership questions.
• Add safeguards for hiring, scoring, ranking or other decisions about people.
• Connect AI use to passwords, access, integrations and security controls.
• Define the vendor review questions the business will record.
• State what records are kept for important uses.
• Create an incident reporting and escalation process.
• Name the policy owner and approval roles.
• Provide role-based staff training.
• Set a regular review date and event-based review triggers.
• Include a route for staff to ask questions without fear of getting in trouble.
• Have the draft reviewed for the regions and industries in which the business operates.

How to turn the checklist into a working policy

1. Map current use. Ask each team what AI features or services they use and for which tasks.
2. Choose your boundaries. Decide what is allowed, restricted, approval-only and prohibited.
3. Write examples. Replace generic language with situations staff recognise from daily work.
4. Assign owners. Give each approval, review and incident step to a named role.
5. Test the policy. Give staff three realistic scenarios and see whether the document leads them to the right action.
6. Train and publish. Explain the rules in a short session, store the policy somewhere easy to find and collect acknowledgement where appropriate.
7. Review what happens. Track questions, exceptions and incidents so the next version fixes unclear sections.

A policy should be detailed enough to guide a decision but short enough that staff will use it. Put supporting material, such as the approved-tool register or vendor assessment questions, in separate documents that can be updated without rewriting the entire policy.

Frequently asked questions

Related reading: our AI governance by region.

Free tools: AI Privacy Risk Scorer to score your current AI tool setup against data-privacy best practice | AI Policy Generator to generate a customised AI policy for your business.

What is the most important thing to include in an AI policy?

The most important element is a clear boundary between acceptable and unacceptable use. Staff should be able to tell which tools are approved, which information is restricted and when a human must review the result.

Does a small business really need an AI policy?

A small business can benefit from one as soon as staff use AI for business work or handle business information in an AI service. The policy can be short, but it should still cover data, approvals, review and accountability.

Should an AI policy ban free AI tools?

Not automatically, but free accounts often provide fewer administrative, contractual and data controls than business plans. A practical policy assesses the tool and the task, then limits free services to approved low-risk uses where appropriate.

Who should own the AI policy?

Choose a role with enough authority to approve tools, coordinate incidents and update the rules. In a small business this is often the owner, operations manager, privacy lead or senior manager working with an external IT or legal adviser.

How often should an AI policy be updated?

Review it on a regular schedule, commonly every six or twelve months, and sooner after a major tool change, incident, new high-impact use or relevant regulatory development. The approved-tool list may need more frequent updates than the main policy.