Does a small business need an AI policy for its employees?
Usually yes, once more than one person uses AI tools for work. A one-page policy is enough to start: which tools are allowed, what should stay out of them, who checks the output before a customer sees it, which accounts the tools run on, and what to do after a mistake. Write it in plain words and review it when the tools change. Whether a law or contract requires one for your business is a question for an attorney.
The one page, line by line
This table is general advice, not a standard. Most lines already have a longer answer on this site, so each row points to it.
| Policy line | What to write | Where to read more |
|---|---|---|
| Allowed tools | Name the tools staff may use for work, and on which plan. Anything else needs the owner's yes. | This page |
| Keep out | A short list, kept where staff can see it. | The related answer on putting customer information into ChatGPT |
| Who checks | Name who reads what before a customer sees it. | The related answer on whether a person should approve what AI sends |
| Whose accounts | Work tools run on accounts in the business's name, and the owner can reach the logins. | The related answers on connecting AI to your tools and on removing an employee's access |
| What customers are told | Say where the business uses AI. | The related answer on telling customers you use AI |
| After a mistake | Say who to tell and how fast, and how a report will be treated. | This page |
What the FTC's data-security guide adds
The FTC's guide "Protecting Personal Information: A Guide for Business" (October 2016) is about personal information in general, not AI tools, so what follows is applied by analogy. The agency advises restricting employees' ability to download unauthorized software, telling employees about company policies on keeping information secure and confidential (including people who work from home or offsite), and asking every new employee to sign an agreement to follow the company's confidentiality and security standards for sensitive data. It also says to limit access to personal information to employees with a "need to know".
As general advice, a short allowed-tools list can serve a similar purpose for AI tools: no new tool enters the business until someone decides it should. The guide's stated reason for limiting downloads is malware, not AI.
After a mistake
The guide also advises requiring employees to notify you immediately about a potential security breach, with a lost or stolen laptop as its example. As general advice, ask the same of anyone who pastes the wrong thing into a tool: tell the owner the same day, and write down what went in, which tool and when. The guide separately advises disciplinary measures for security policy violations; how a prompt report will be treated is your call, and staff are more likely to report early if they know in advance.
If customer details may have been exposed, the related answer on what to do after a data breach has the FTC's order of response. If a customer got a wrong answer, see the related answer on what to do when an AI assistant gives a customer wrong information.
Keeping it short and followed
This section is general advice, not the FTC's.
- One page, plain words, a few examples of what is fine and what is not.
- Give it to new hires on day one, and put it in the employee handbook if you have one.
- Review it every few months, and when a tool, a plan or a promise to customers changes.
- Before adding discipline terms or changing an employment agreement, ask an employment attorney.
Sources
Related answers
- Is it safe to put customer information into ChatGPT or another AI tool?
- Should a person approve what an AI system sends to customers?
- How does an AI system connect to the tools you already use?
- How do you remove an employee's access to accounts when they leave?
- Do you have to tell customers when you use AI to answer or write to them?
- What should a small business do after a data breach?
- What should you do when your AI assistant gives a customer wrong information?
AI systems and automation
A lot of an owner's week goes to the same tasks: answering the same questions, chasing the same follow-ups, retyping the same details. We build the systems that do that work, so your people can spend their time on customers.