- What Is an AI Acceptable Use Policy?
- Why SMEs Need One in 2026
- What an AI Acceptable Use Policy Should Cover
- How to Write Your Policy Without Overcomplicating It
- Connecting Your Policy to Your Broader AI Readiness
- Common Mistakes to Avoid
- A Simple Template Structure
- Frequently Asked Questions
An AI acceptable use policy tells your team exactly what they can and cannot do with AI tools at work. Without one, you're relying on individual judgment — and across a team of ten, twenty, or fifty people, that judgment will vary wildly.
This guide explains what an AI acceptable use policy is, why your business needs one now, and how to write a practical version that doesn't require a lawyer or a consultant to understand.
What Is an AI Acceptable Use Policy?
An AI acceptable use policy (AUP) is a written document that sets out the rules governing how employees may use AI tools in their work. It covers which tools are permitted, what data can be entered into them, how outputs should be treated, and who is responsible when something goes wrong.
Think of it as the AI equivalent of your existing IT or internet use policy — except AI tools introduce risks your old policies never anticipated. Confidential data leaving your systems through a chatbot prompt. AI-generated content published without review. A business decision made on the back of a hallucinated fact.
A good policy addresses all of that in plain language your team can actually follow.
Why SMEs Need One in 2026
Many small business owners assume AI governance is an enterprise concern. It isn't. If anyone on your team is using ChatGPT, Copilot, Gemini, or any other AI assistant for work tasks, you already have an AI use situation. The only question is whether it's managed or unmanaged.
The risks of leaving it unmanaged are concrete:
- Data exposure. Employees may paste customer records, financial data, or confidential contracts into a public AI tool without realising the input could be used to train the model or stored on external servers.
- Accuracy risk. AI tools produce confident-sounding output that is sometimes wrong. If your team treats that output as fact, errors reach clients, reports, and decisions.
- Liability gaps. If an AI tool produces discriminatory output, misleading advice, or copyright-infringing content, your business may carry the liability — unless your policy establishes clear accountability.
- Regulatory exposure. The EU AI Act is now in effect and places obligations on businesses that deploy or use AI systems in certain ways. Even SMEs operating in or selling to the EU need to understand where they sit.
None of these risks require a sophisticated AI deployment to materialise. A single employee using a free chatbot to draft a client email is enough.
What an AI Acceptable Use Policy Should Cover
A policy doesn't need to be long. It needs to be clear. Here are the core sections every SME policy should include.
Permitted and Prohibited Tools
List the AI tools your business has approved for use. Anything not on the list requires prior approval. This prevents shadow AI use — employees quietly adopting new tools without IT or management awareness.
Be specific. "Generative AI tools" is vague. "ChatGPT (free and Plus tiers), Microsoft Copilot in M365, and Canva AI features" is actionable.
Data Classification Rules
Define what data employees may and may not enter into AI tools. A simple three-tier approach works well for most SMEs:
- Green (permitted): Publicly available information, anonymised data, internal drafts with no client identifiers.
- Amber (restricted): Internal business information that isn't confidential but shouldn't be shared externally without review.
- Red (prohibited): Customer personal data, financial records, health information, passwords, legal documents, and anything covered by a non-disclosure agreement.
Make the red list explicit. Employees shouldn't have to guess.
Output Review Requirements
State clearly that AI-generated output must be reviewed by a human before it's used, published, sent to a client, or relied on for a decision. Specify who is responsible for that review in different contexts — a manager for client-facing content, the relevant department head for operational decisions.
Attribution and Disclosure
Decide whether your business requires disclosure when AI has been used to produce work. Some clients expect it. Some industries require it. Your policy should reflect your position, not leave it to individual discretion.
Accountability and Reporting
Name who owns AI governance in your business. For most SMEs, this will be the owner-operator or a nominated manager rather than a dedicated compliance function. Include a process for reporting concerns, errors, or suspected policy breaches.
How to Write Your Policy Without Overcomplicating It
The biggest mistake SMEs make is treating this as a legal document rather than an operational one. Your team needs to read it, understand it, and follow it — which means plain language, short sentences, and a format that fits on two pages.
A practical drafting approach:
- Start with your current reality. List the AI tools your team is already using. Your policy needs to address what's happening now, not just what you plan to do.
- Identify your highest-risk scenarios. Where is confidential data most likely to be mishandled? Where would an AI error cause the most damage? Write rules that address those scenarios first.
- Get input from your team. People follow rules they helped shape. A short conversation about how your team is already using AI will surface risks you haven't considered and build buy-in for the policy.
- Set a review date. AI tools are changing fast. A policy written today may be incomplete in twelve months. Build in a scheduled review — at minimum, annually.
- Keep it short. Two to four pages is enough for most SMEs. If it runs longer, move the detail into a separate appendix and keep the main document focused on the rules people need to remember.
Connecting Your Policy to Your Broader AI Readiness
An AI acceptable use policy is one piece of a larger picture. It addresses governance, but governance sits alongside strategy, data infrastructure, team capability, and digital foundations. A business that writes a strong policy but has no broader adoption plan is still operating reactively.
Understanding where your business actually stands across all of those dimensions is the right starting point. The AI Ready Score assessment covers 53 to 61 questions across 8 business dimensions — including governance — and produces a personalised report with a risk profile and a 90-day roadmap. It's free to complete and takes less time than drafting a policy from scratch. If you're not sure whether governance is your biggest gap or whether something else needs attention first, that's a useful place to start.
Common Mistakes to Avoid
Writing the policy and filing it away. A policy no one has read doesn't protect you. Distribute it, walk your team through it, and confirm they've seen it.
Being too vague to be useful. Phrases like "use AI responsibly" or "exercise good judgment" are not policies — they're aspirations. Your policy needs specific rules that leave no room for interpretation on the high-risk items.
Ignoring free consumer tools. Many SME owners focus on enterprise AI deployments and overlook the fact that the biggest data exposure risk is often a team member using a free consumer chatbot on a work task. Your policy must cover free tools explicitly.
Not updating it. A policy that was accurate in early 2026 may not reflect the tools your team is using by the end of the year. Set a calendar reminder.
Treating it as separate from your AI strategy. Your acceptable use policy should reflect where your business is heading with AI, not just where it stands today. If you're planning to adopt AI tools in new areas, your policy should anticipate that and set expectations in advance.
A Simple Template Structure
Starting from zero? Here's a structure you can adapt:
- Purpose — one paragraph explaining why the policy exists
- Scope — who it applies to (all staff, contractors, and any third parties with access to your systems)
- Approved tools — the current approved list with a process for requesting additions
- Data classification rules — the green/amber/red framework or equivalent
- Output review requirements — who reviews what before it's used
- Attribution and disclosure — your position on disclosing AI use
- Prohibited uses — a clear list of things that are never permitted
- Accountability — who owns this policy and who to contact with questions
- Breach and reporting — what happens if the policy isn't followed
- Review date — when this policy will next be reviewed and by whom
You don't need to fill every section with paragraphs. Bullet points and short statements work well. The goal is clarity, not length.
Frequently Asked Questions
What is an AI acceptable use policy?
An AI acceptable use policy is a written document that sets rules for how employees may use AI tools at work. It typically covers which tools are approved, what data can be entered into them, how outputs must be reviewed, and who is accountable when problems arise.
Does my small business legally need an AI acceptable use policy?
There's no universal legal requirement for SMEs to have a standalone AI acceptable use policy, but businesses operating in or selling to the EU may have obligations under the EU AI Act. Beyond legal compliance, a policy protects you from data exposure, accuracy errors, and liability gaps that arise when AI use is unmanaged.
How long should an AI acceptable use policy be?
For most SMEs, two to four pages is sufficient. The priority is clarity and specificity, not length. A short policy your team reads and follows is worth more than a comprehensive document no one opens.
What data should employees never enter into AI tools?
At minimum: customer personal data, financial records, health information, passwords, confidential contracts, and anything covered by a non-disclosure agreement. Your policy should state this explicitly rather than leaving it to individual judgment.
How often should I update my AI acceptable use policy?
At least once a year, and whenever your business adopts a significant new AI tool or a relevant regulation changes. The AI landscape is moving quickly, and a policy that was accurate at the start of 2026 may need updating before the year is out.
Who should own the AI acceptable use policy in a small business?
In most SMEs, this will be the owner-operator or a nominated senior manager. You don't need a dedicated compliance function — you need a named person who is responsible for maintaining the policy, handling questions, and reviewing it on schedule.
How does an AI acceptable use policy relate to AI readiness more broadly?
A policy addresses governance, which is one dimension of AI readiness. A business also needs to assess its data infrastructure, team capability, digital foundations, and strategic direction. If you're not sure which area needs the most attention, a structured assessment gives you a clearer picture before you invest time in any single area.
Writing an AI acceptable use policy is one of the most practical steps an SME can take right now. It doesn't require a consultant, a legal team, or a large budget — just clarity about what your team is doing with AI and a willingness to put that in writing.
Start with the tools your team is already using, define the data rules that matter most, and get it in front of your people. That's more useful than a perfect policy sitting in a drawer.
0 Comments