Is an AI use policy legally required for a small US business?

There is no single federal law that requires every small business to have one. A written policy is still the simplest way to show you take data protection, accuracy, and honest marketing seriously, and some client contracts, insurers, or industry rules may expect it. Treat this as general information and ask counsel about your sector and state.

How long should an AI use policy be?

For a team of under fifty people, aim for one to two pages plus a short tool register. Long policies copied from large companies tend to go unread. Cover approved tools, data rules, human review, disclosure, ownership, incidents, and training, and link to more detailed procedures only where you really need them.

Should we ban ChatGPT and other public AI tools?

A blanket ban usually pushes people to personal accounts, where you have no visibility or control. A better approach is to approve specific tools with company-managed accounts, set clear rules on what data may go in, and give people a fast way to request new tools. Ban only the uses that create real risk, such as entering restricted data.

Who owns content created with AI tools at work?

Ownership depends on your employment agreements and each tool's terms, and copyright protection depends on human creative input. The U.S. Copyright Office said in January 2025 that prompts alone are not enough for protection. For important assets, have people do substantial creative work, keep drafts, and check vendor terms on output ownership.

How often should we review our AI policy?

Review it at least every six months, and sooner when you adopt a new tool, a vendor changes its data or retention terms, a new law affects your industry or state, or you have an incident. Give each version a number and date, and ask staff to acknowledge major changes.

AI Use Policy Template for Small Teams: What to Include

A small team's AI use policy should fit on two pages and answer seven questions: which tools are approved, what data may go into them, when a person must review the output, when to disclose AI use, who owns what gets created, how to report problems, and what training people need first. Add a named owner and a review date, and you have a policy people will actually follow.

At a glance

Section	The question it answers
Approved tools	Which tools and which accounts can we use for work?
Data rules	What may never go into an AI tool?
Human review	Who checks output before it is used or sent?
Disclosure	When do we tell customers or colleagues AI was involved?
Ownership and IP	Who owns the output, and what must we not paste in?
Incidents	What do we do when something goes wrong?
Training	What must people know before they get access?

This article is general information for US teams, not legal advice. If you work in a regulated field or use AI for decisions about people, have counsel review your final policy.

Why a small team needs a written policy now

Your team is probably using AI already, often through personal accounts. That matters because the same tool can offer very different protections depending on how people sign in. Microsoft, for example, says Copilot Chat used with a work (Microsoft Entra) account is covered by enterprise data protection, with prompts and responses protected by the same contractual terms that apply to email in Exchange and files in SharePoint. A personal account does not carry those terms.

Existing law still applies when AI is involved. When the Federal Trade Commission announced its Operation AI Comply sweep in September 2024, then-Chair Lina Khan said "there is no AI exemption from the laws on the books" (FTC press release). Misleading customers, mishandling personal data, or making false claims is just as risky when a model wrote the words.

For structure, borrow from the NIST AI Risk Management Framework, which is voluntary. Its Generative AI Profile (NIST AI 600-1) names 12 risks. For a small team, the ones that come up weekly are confabulation (confident wrong answers), data privacy, information security, intellectual property, harmful bias, and human-AI configuration, which covers over-reliance. Our plain-English guide to the NIST AI RMF goes deeper.

The seven sections to include

1. Approved tools and accounts

List each approved tool by name and plan, and say which account type is allowed. A practical rule: work data only goes into tools signed in with a company account that your admin controls. Name who approves new tools (one person is enough) and what they check before saying yes:

Does the vendor use your prompts or files to train its models, and can you turn that off?
How long are prompts and outputs retained, and can an admin delete them?
Is there an admin console with access controls and audit logs?
Does the tool connect to email, files, or other systems, and with what permissions?

2. Data rules

Use three plain categories that anyone can apply in seconds.

Category	Examples	Rule
Public	Published marketing copy, public web pages	Any approved tool
Internal	Meeting notes, draft plans, internal procedures	Approved work accounts only
Restricted	Customer personal data, Social Security numbers, health or payment card data, passwords and API keys, client confidential files	Never, unless the owner approves a specific tool in writing

Sector rules can raise the bar. If you are covered by HIPAA, the Department of Health and Human Services explains that a vendor handling protected health information on your behalf is a business associate and needs a written agreement first. Check contracts with your own clients too; many restrict where their data can go.

3. Human review

Treat every AI output as a draft. The person who sends or publishes it owns it, exactly as if they had written it. Spell out what reviewers check: facts, figures, names, dates, quotes, links, and citations. Ask for a second reviewer when output goes to customers, contains legal, financial, or medical statements, or feeds a decision about a person such as hiring.

Agents that read email or browse the web need an extra rule: no sending, buying, deleting, or sharing without a person approving the action. Hidden instructions in a web page or email can hijack an agent, a risk explained in our prompt injection guide.

4. Disclosure

Decide when you tell people AI was involved. Sensible defaults for a small business:

Customer-facing chatbots say they are automated and offer a route to a person.
Do not present AI-generated images of people or events as real photographs.
Do not overstate what your own product's AI can do. The FTC's 2024 sweep targeted exactly this kind of exaggerated claim.
Internally, flag AI-drafted sections in shared documents when the reader would reasonably want to know.

5. Ownership and intellectual property

The U.S. Copyright Office concluded in January 2025 that AI outputs can be protected by copyright "only where a human author has determined sufficient expressive elements," and that prompts alone are not enough (Copyright Office, Part 2 report). Creative arrangement or modification of output by a person can be protected.

The practical rules that follow:

For assets you need to own, such as a logo, a product name, or flagship copy, have people do substantial creative work and keep the drafts.
Do not paste in material you have no right to use, such as a competitor's paid report or a client's confidential file.
Check each tool's terms on who owns outputs and whether the vendor offers any intellectual property protection.
Review AI-generated code for license and security issues before it ships.

6. Incidents

Define what counts: restricted data entered into the wrong tool, wrong AI output sent to a customer, an agent taking an action nobody approved, or a voice or video deepfake used to request a payment. Give one reporting channel and a same-day expectation, and make it blame-free so people report early. The response steps are short: contain, assess what data or people were affected, notify whoever must be told, fix the cause, and update the policy. If personal data may be involved, check whether state breach notification laws apply.

7. Training

Nobody gets access before a short session on the policy, safe prompting, and how to verify output. Refresh it when tools change or after an incident. The most useful habit to teach is discernment: checking whether an answer is right, not just whether it sounds right. The AI Fluency framework is a good structure for that training.

A one-page sample outline

Copy this structure and fill in the brackets.

Purpose and scope. This policy covers all staff and contractors using AI tools for [Company] work.
Owner. [Name, role] owns this policy. Version [1.0], approved [date], next review [date].
Approved tools. [Tool, plan, account type]. Request new tools from [owner].
Data rules. Public: any approved tool. Internal: work accounts only. Restricted: never, unless approved in writing.
Review. AI output is a draft. The sender is accountable. Second review for [customer-facing, legal, financial, HR] content.
Agents. No sending, purchasing, deleting, or sharing without human approval.
Disclosure. [Your rules for chatbots, images, marketing claims, internal drafts].
Ownership. Human creative work on key assets; no unlicensed inputs; code reviewed before release.
Incidents. Report to [channel] the same day. No blame for prompt reporting.
Training. Required before access; refreshed [every six months or on major tool changes].
Acknowledgment. I have read and will follow this policy. [Signature, date].

Keep it current

AI tools change faster than most policies. Set a fixed review every six months, and review early when you adopt a new tool, a vendor changes its terms, a new law affects your state or industry, or you have an incident. Keep a simple AI tool register alongside the policy, with the tool, its owner, the data category allowed, and the date it was last reviewed.

Common mistakes to avoid:

Banning everything. People switch to personal accounts and you lose visibility.
Copying a large company's policy. Twenty pages nobody reads protects nobody.
No named owner. Questions go unanswered and the document goes stale.
Burying it. Pin the policy where people work, such as your Teams or Slack channel, and link it from onboarding.

How CertTulen Academy can help

A policy works when people have the skills to follow it. CertTulen Academy's live, MCT-led sessions build those skills with hands-on practice. AI Fluency: Framework and Foundations builds the everyday habits behind the review and training sections above, such as deciding what to delegate and checking output before it is used. Work Smarter with AI is a shorter, practical option for everyday tool use. For a private session built around your own policy, contact us for a batch that suits your time zone.