AI Policy Template for a Small Team: What to Include in an Acceptable-Use Policy

The short answer

A useful AI policy template for a small business fits on two or three pages and answers five questions: which AI tools staff may use, what data must never go into them, who reviews AI output before it reaches customers, when you tell people AI was involved, and who owns the policy. Write it in plain language, train people on it once, and review it every six months. This is general information, not legal advice.

Why a small team needs an AI policy at all

Your staff are probably already using AI tools, some on personal accounts you have never seen. That is not a reason to ban them. It is a reason to set rules, because the risks are real and mostly avoidable:

• Data leaving the building. A customer list or contract pasted into a free tool may be stored or used in ways you did not agree to.
• Confident mistakes. AI output can be wrong and sound right. If it reaches a customer, it is your mistake, as Air Canada learned (see lessons from the Air Canada chatbot ruling).
• Disclosure duties. Some laws now require you to say when customers are dealing with AI; our guide to chatbot disclosure laws covers where.
• Decisions about people. Hiring, credit and eligibility decisions made by machines carry specific obligations, for example under Quebec's Law 25.

There is also a training angle. Since the EU's Digital Omnibus took effect, Article 4 of the EU AI Act asks providers and deployers to "take measures to support the development of AI literacy of their staff". If you serve EU customers, a short policy plus training is a sensible way to show you have done that.

Borrow from guidance that already exists

You do not need to invent principles. Two Canadian public documents are free, short and practical.

The Treasury Board of Canada Secretariat's Guide on the use of generative AI, written for federal staff, uses the "FASTER" principles: Fair, Accountable, Secure, Transparent, Educated and Relevant. Three of its instructions translate directly to a small business: do not enter sensitive or personal information into tools you do not manage, do not treat generated content as authoritative, and clearly indicate when you have used generative AI to develop content.

The Office of the Privacy Commissioner's principles for generative AI add the privacy layer: use de-identified data in prompts where you can, tell people when a tool is part of a decision about them, check outputs for accuracy, and remember that "accountability for decisions rests with the organization".

The six parts every AI policy template needs

1. Approved tools and accounts

List the AI tools staff may use and insist on business accounts, where you control settings such as whether your data is used for training. Include the AI features inside tools you already pay for, such as your CRM or office suite (we cover those in AI already inside your tools). Explain how someone requests a new tool.

2. Data rules

The simplest scheme is traffic lights. Green: public information and your own marketing copy. Amber: internal but non-personal material, allowed only in approved business tools. Red: customer personal information, health or financial data, passwords, and anything under a confidentiality agreement, which never goes into an AI tool unless that specific tool and use have been approved.

3. Human review

Name who checks AI output before it leaves the business: emails to customers, quotes, published content, code. Make the reviewer responsible for facts, tone and anything that sounds like a promise.

4. Disclosure

Customer-facing bots say they are AI in the first message. Realistic AI-generated images, voices or video of people are labelled. AI-drafted marketing emails are still commercial electronic messages, so consent and unsubscribe rules apply as usual; see our plain-English CASL guide. Decide whether you note AI assistance on published articles; Google does not require it for ordinary pages, but it can build trust.

5. Decisions about people

AI may assist with hiring, credit, pricing or eligibility decisions only with a human making the final call, unless you have deliberately designed a compliant automated process. If you post jobs in Ontario and have 25 or more employees, note that since 1 January 2026 public job postings must say whether AI is used to screen, assess or select applicants, as Osler explains.

6. Ownership, training and incidents

One named owner. A short training session when someone joins and once a year. A simple route for reporting a mistake, such as wrong information sent to a customer or data pasted where it should not be. Review the policy every six months; the tools change faster than most policies.

Template outline you can adapt

1. Purpose and scope: who the policy covers (staff, contractors) and which tools count as AI.
2. Approved tools: table of tool, account type, allowed uses, owner.
3. Data classification: green, amber and red examples specific to your business.
4. Prohibited uses: red data in unapproved tools; impersonating real people; generating fake reviews or testimonials; bypassing security controls.
5. Human review: what must be checked, by whom, before release.
6. Customer disclosure: bot greeting wording; labelling rules for synthetic media.
7. Decisions about people: human sign-off; notices where the law requires them.
8. Vendors: where each tool stores data, and contract checks before connecting business systems.
9. Training and acknowledgement: sign-off on joining and yearly.
10. Incidents and review: how to report problems; owner; next review date.

When AI moves from chat windows into automated workflows that touch your systems, extend section 8. Our guide to connecting AI to business data safely lists the questions to ask vendors.

Key takeaways

• Keep it short: two or three pages people will actually read.
• Data rules and human review prevent most real-world AI problems.
• Build in disclosure and decision rules now; laws are moving that way.
• Name an owner and review the policy every six months.

Frequently asked questions

Do small businesses legally need an AI policy?

Usually there is no law that requires a document called an AI policy. But privacy, consumer protection and employment laws apply to how you use AI, and a written policy is the easiest way to show staff, customers and partners that you manage those risks.

Should we ban ChatGPT and similar tools at work?

A ban tends to push use onto personal accounts you cannot see. Approving specific business accounts, with clear data rules, usually gives you more control than prohibition.

How often should an AI policy be updated?

Review it at least every six months and whenever you adopt a new tool or a relevant law changes. AI products add features quickly, and new laws on disclosure and automated decisions keep arriving.

Sources

1. Guide on the use of generative artificial intelligence — Treasury Board of Canada Secretariat, updated 24 September 2026
2. Principles for responsible, trustworthy and privacy-protective generative AI technologies — Office of the Privacy Commissioner of Canada, 7 December 2023
3. Regulation (EU) 2026/1744 (Digital Omnibus on AI) — EUR-Lex, Official Journal, 24 July 2026
4. AI in hiring: Ontario employers grappling with new job posting disclosure requirement — Osler, 3 February 2026

How Flowmatix can help

We put this into practice for businesses in Toronto and around the world through our AI Agents & AI Solutions, business process automation, digital strategy services. Want to know what it would take for your business? Get a personalised quote in about 3 minutes.