If people in your office use AI tools for work, it helps to write down the rules. Without them, each person decides alone what's fine to paste into a chatbot.
A policy for a small office doesn't need to be long. Some call it an AI acceptable use policy. Keep it to one page so people can check it when they're unsure.
Who it covers
Say that it covers everyone who does work for the business, part-timers and contractors included. It covers work done on a personal phone too.
The tools you've approved
List the AI accounts the business set up and manages. Pick business plans whose terms say your data isn't used to train the vendor's models, and read those terms before anyone signs up.
Then say plainly that personal and free accounts aren't for work. Neither is an individual plan the business happens to pay for. An AI feature that turns up inside software you already use counts as a new tool too.
What it's for
Name the kinds of work AI is for in your office, like first drafts of letters and notes from meetings. If a tool records calls or meetings, check the consent rules that apply before anyone turns it on.
What never goes in
Keep this part to a short list in plain words. Here's a starting list.
- Passwords and account numbers
- Social Security numbers and other ID numbers
- Health or financial details about a client
- Staff personnel records
- Anything a client asked you to keep confidential
Your office may have a tool set up and approved for records like tax forms or patient charts, with any agreement your industry requires already signed. If so, the policy names that tool and what it's cleared for. Everything on this list stays out of every other tool.
If someone isn't sure whether something belongs on the list, they ask before they paste it.
Accounts and access
Everyone signs in with a work email and two-step sign-in, and nobody shares a login. When someone leaves, their access comes off the same day.
Who checks the work
AI drafts can be wrong and still sound sure of themselves. Write down that a person reads every draft before it goes to anyone outside the office. Name who signs off on the drafts that carry the most weight, like anything with a price or a deadline in it.
Decide whether you'll tell clients when AI helped with something they receive, and write the answer down.
Who answers questions
Pick one person who answers questions about the policy and approves new tools. In a small office that might be the owner or the office manager. When someone finds a new AI tool they want to use, they check with that person first.
Mistakes
If something on the never list goes in by mistake, the person who did it tells that one person right away. Some industries treat that as a possible breach, and the owner needs to know in time to deal with it.
If your industry has its own rules
Some offices answer to rules about client information, and those rules reach AI tools too. A dental office under HIPAA needs a signed Business Associate Agreement before protected health information goes to an AI vendor. A tax preparer under the FTC Safeguards Rule needs a written information security program that covers every system touching taxpayer data, AI tools included.
Your policy should point to those rules instead of restating them.
Put a date on it
AI tools change quickly, and so do the vendors' terms. Date the policy and read it again every few months. Ask the people who use AI every day what's working and what the policy didn't cover. Have everyone sign that they've read the current version.
A one-page outline you can copy
- Who it covers. Everyone who works for the business, contractors included, on any device.
- Approved tools. The AI accounts the business set up, by name.
- What it's for. The kinds of work AI is for here, like first drafts and meeting notes.
- What never goes in. The short list above, adjusted for your office, with any tool approved for sensitive records named.
- Accounts and access. Work email and two-step sign-in for everyone. No shared logins, and access removed when someone leaves.
- Checking the work. Who reads AI drafts before they leave the office, and who signs off on what.
- Questions and new tools. The one person to ask.
- Mistakes. Tell that person right away.
- Industry rules. Which ones apply, if any, with a pointer to each.
- Review date. When you'll read it again, and a line for each person to sign.
This outline isn't legal or tax advice. If your office answers to rules like these, have your attorney or compliance advisor read your policy before you use it.
If you'd like help
You can write this yourself. If you'd like someone to look at how AI is already being used in your office, our Tech Assessment covers that. We look at how work moves through your office, how your team uses its tools and AI, and where your data's at risk. Then you get a written plan.
Free tech assessment for up to five local businesses through December 15.
Book a free strategy call. You can also call or text (203) 865-6002.