AI Use Policy Template for Small Teams (One Page, Fill-In Fields)

Your team is already using AI tools, and nobody wrote down the rules. Here is a one-page AI use policy you can copy, fill in and send today, plus a tool register and a short rollout plan. It is a template from a non-lawyer, not legal advice. If you handle regulated data, get a professional to read your final version.

The data side of this, what actually should and should not be pasted, has its own post: what not to paste into ChatGPT. This one is the document you hand to the team.

What should a small-team AI use policy cover?

Five things, and nothing that changes weekly:

1. Which tools are approved and on which account type.
2. What data may never go in, and what may go in with changes.
3. Who checks AI output before it reaches a customer or goes public.
4. What staff say to clients about AI use (separate wording, see what to tell clients about AI use).
5. What to do after a mistake.

Cut anything else. A policy that lists model names will be wrong in a month. A policy that bans "AI" in the abstract will be ignored by lunchtime.

The one-page policy (copy and fill in)

Replace every bracket. If you can't fill a bracket, that is a decision your team still has to make, which is useful to find out now.

[COMPANY NAME] AI USE POLICY
Version [1.0] | Owner: [NAME, ROLE] | Effective: [DATE] | Review by: [DATE + 6 MONTHS]

1. SCOPE
Applies to [employees / contractors / interns] using any generative AI tool
(chatbots, coding assistants, meeting recorders, image tools, browser
extensions) for [COMPANY NAME] work.

2. APPROVED TOOLS
Use only the tools in the AI Tool Register ([LINK]), on the account type
listed there. A tool not in the register needs approval from [OWNER] first.
Work content goes through work accounts only, never personal accounts.

3. DATA RULES
RED (never enter into any AI tool unless the register says that exact tool
is approved for it): passwords, API keys, private keys, one-time codes,
payment card numbers, government ID numbers, health records, anything
covered by an NDA, [YOUR OTHER CATEGORIES].
AMBER (enter only after removing names and identifiers, or in a tool the
register approves for amber data): customer and employee details,
contracts, support tickets, internal financials, source code, meeting
recordings.
GREEN (fine in any approved tool): public information, your own drafts,
generic questions.
If unsure, treat it as one tier higher.

4. HUMAN REVIEW
A person reads and takes responsibility for anything AI helped produce
before it is: sent to a customer, published, filed with an authority,
merged into production code, or used for a hiring, pricing or
payment decision. "The AI said so" is not a reason.
Quotes, figures, citations and legal or tax statements are checked against
a primary source.

5. CLIENT AND PUBLIC TRANSPARENCY
We tell clients about AI use as described in [CLIENT DISCLOSURE PAGE/CLAUSE].
Staff do not claim AI-generated work was written, drawn or recorded by hand.
Where a client contract limits AI use, the contract wins.

6. RECORDING AND TRANSCRIPTION
No AI note-taker joins a meeting unless [everyone present has been told /
the host has asked for consent]. Recordings are stored in [LOCATION] and
deleted after [N] days.

7. MISTAKES
If you pasted something you should not have, tell [CONTACT] the same day.
Reporting is not punished. Hiding it is. [CONTACT] decides whether to rotate
credentials, request deletion from the vendor, or tell the affected client.

8. CHANGES
[OWNER] updates the register as tools change. The policy is reviewed every
six months and after any incident.

That is about 400 words. Print it, or pin it where people work.

What goes in the AI tool register?

A table, kept separate, one row per tool. The columns that matter:

The "Training on our data" column is the one people fill in from memory, and it goes stale fastest. Fill it from the vendor's own page and write the date next to it. Here is what I could read on 2026-10-09, with the caveat that vendor pages change:

• Anthropic. Its help page on model training says that for commercial products (Claude for Work, Team, Enterprise, the API, Claude Gov) it does not use inputs or outputs for training by default, with exceptions where you submit feedback such as a thumbs up or down or otherwise opt in. Team and Enterprise owners can disable feedback submission under Organization settings. The page itself says consumer plans (Free, Pro, Max) are covered by a different article, which I did not use here. Read through a summarising fetch, so check the exact wording.
• OpenAI API. The developer docs say data sent to the API is not used for training unless you opt in, and abuse-monitoring logs are kept up to 30 days by default, longer if the law requires it. Zero Data Retention needs OpenAI's approval. This covers the API only. OpenAI's ChatGPT business pages returned HTTP 403 to my fetch tool, so I can't confirm those, and the register row for ChatGPT should be filled from your own admin console.
• Gemini API. Google's terms distinguish unpaid from paid services. For unpaid use, Google may use content to improve products and human reviewers may read inputs and outputs, and the page tells you not to submit sensitive information. For paid use it says it doesn't use prompts or responses to improve products, though it logs them for a limited period for abuse detection. The page I read did not give that period.

Notice what is missing: a comparison of consumer apps across vendors. Settings differ between them and move often, so the register should say "work account only" and leave consumer settings out of the picture.

How do we apply the red, amber and green tiers in practice?

Tiers fail when people can't tell which one they're in. Add three worked examples to your onboarding sheet, written from your own business. Illustrative examples (I made these up as a pattern, replace them):

If people keep placing things in the wrong tier, the tiers are too abstract. Add examples until they stop asking.

Who reviews AI output, and how much?

Section 4 of the template names the events that trigger review: customer-facing, published, filed, merged, or a decision about a person or money. Everything else (your own brainstorming, internal outlines) needs no formal review.

Make the review concrete by naming a checker per work type, in a short table at the bottom of the register:

For the checking itself, see the fact-checking checklist for AI answers and the hallucinations lesson. If your team connects AI to tools that read email or web pages, add a line on prompt injection, since a hostile email can instruct an agent.

How do we roll it out in a week?

Untested plan, but short enough to try:

1. Day 1. Owner fills the brackets. Anything unknowable (legal categories) gets a "ask [professional]" note and a date.
2. Day 2. Build the register from what people actually use. Ask in your team chat: "which AI tools did you use this month, on which account?" Expect surprises.
3. Day 3. Check each vendor's training and retention page, write the date in the register, and change admin settings you control.
4. Day 4. Fifteen-minute team session: read section 3 aloud, do the four-row example table, take questions.
5. Day 5. Send the policy, get a yes from each person, set the review date in the calendar.

Then do the one thing most teams skip. At the six-month review, check whether anyone reported a mistake. If nobody did in six months, it probably means people are afraid to, not that nobody made one.

What this template does not do

• It doesn't tell you what the law requires in your country or sector. Add your real obligations to section 3 after professional advice.
• It doesn't replace contract clauses. If a client contract limits AI use, follow the contract.
• It doesn't stop someone who ignores it. It makes the right move easy and the wrong move visible.

If your data really can't go to a cloud vendor under any plan, skip the register tuning and read the local vs cloud LLM decision guide instead.