AI is becoming part of how small businesses work. People are using ChatGPT to write emails and customer proposals. Teams are using AI tools to generate images, write code, and analyze data. Managers are experimenting with AI to automate routine tasks. It's happening informally, often without formal guidance from leadership.
But AI creates real risks. If an employee puts customer data or financial information into a public AI tool, that data is now in the AI system's training pipeline. If someone uses an AI-generated answer without reviewing it, you might send inaccurate information to a client or make a decision based on flawed analysis. If multiple people are using different AI tools, you have visibility and security gaps. If a contractor uses an AI tool that violates copyright, your company could have liability.
Updated November 2026 for Illinois. The original template below still stands. We added an Illinois addendum with model clauses for the Illinois Human Rights Act’s AI-in-employment notice (HB 3773, in force since January 1, 2026), biometric and voice data under BIPA, recording and transcription consent, confidential data, vendor checks and bilingual distribution, and a free Word download of the whole thing.
These problems aren't theoretical. We're seeing small businesses struggle with AI governance issues monthly. The good news: a simple, practical AI policy prevents most of these problems. This guide includes a template policy you can adapt for your business, plus guidance on what to cover and why.
Why Every Business Using AI Needs a Written Policy
Some business leaders assume they only need an AI policy once the company is large enough to have a formal compliance program. That's backwards. Small businesses need AI policies sooner than enterprises do, because you don't have dedicated security, legal, or compliance teams to catch problems informally.
A written policy does several things:
Protects Data: A policy tells employees what data they can and cannot share with AI tools. It prevents someone from pasting customer lists, financial data, or proprietary code into ChatGPT.
Ensures Quality: A policy requires that AI outputs be reviewed before they're used. This prevents bad information from reaching customers or decisions being made based on flawed analysis.
Manages Liability: A policy establishes rules about copyright and plagiarism. It makes clear that employees are responsible for verifying AI output before using it, which limits your company's liability if something goes wrong.
Creates Visibility: A policy requiring that employees report which AI tools they're using gives you visibility into which tools are in your environment and what risks they pose.
Provides Clear Guidance: Instead of employees guessing about what's okay and what isn't, a policy makes expectations explicit. "You can use ChatGPT for brainstorming; you cannot paste customer data into ChatGPT." Clear rules reduce confusion and risk.
What an AI Acceptable Use Policy Should Cover
Not every policy section applies equally to every business. A healthcare company's AI policy will emphasize patient data protection. A software company's policy will emphasize intellectual property. But all policies should address these core areas:
Scope and Purpose: Who does the policy apply to? Employees? Contractors? Consultants? What is the policy's purpose? To protect company data? To ensure quality? To manage legal risk? Be explicit.
Approved Tools and Platforms: Which AI tools are employees allowed to use? ChatGPT? Gemini? Company-approved tools? What about tools that aren't specifically approved? Is it "ask first" or "not allowed"? Some companies take a whitelist approach (you can only use these tools). Others take a risk-based approach (you can use any tool as long as you follow these rules).
Data Classification and Handling: This is the most critical section for data protection. Classify your data by sensitivity: public, internal, confidential, restricted. Then specify which data can be shared with external AI tools. Generally: public data is fine, internal data should be avoided, and confidential or restricted data is prohibited. Make clear what "sharing" means: pasting into a tool, uploading a file, asking a chatbot about it.
Output Review and Accuracy: AI tools generate plausible-sounding but sometimes inaccurate content. Your policy should require that any AI output used in business decisions or customer-facing materials be reviewed for accuracy by a human. Someone from your company is responsible for verifying that the AI output is correct before it's used.
Employee Responsibilities: What are employees expected to do? Disclose which tools they're using? Report any security incidents? Complete training? Ask permission for certain uses? Be specific about expectations.
Prohibited Uses: What is explicitly not allowed? Creating tools that compete with your company? Sharing confidential information? Using AI to make hiring or firing decisions without human review? Using AI to generate misinformation? List the most important prohibitions for your business.
Incident Reporting and Updates: What should an employee do if they accidentally share sensitive data with an AI tool? If they discover a security breach? If they find an AI tool isn't doing what it claims? How will the policy be updated as new tools and risks emerge?
AI Acceptable Use Policy Template
Below is a template you can customize for your business. Replace bracketed sections [like this] with information specific to your company.
TEMPLATE: AI ACCEPTABLE USE POLICY FOR [COMPANY NAME]
Purpose: This policy guides the appropriate use of artificial intelligence (AI) and AI-powered tools at [Company Name]. The policy aims to foster innovation and efficiency while protecting company data, ensuring accuracy, and managing legal and operational risks.
Scope: This policy applies to all employees, contractors, and consultants of [Company Name]. It covers any use of AI tools, whether company-provided or personal, during work hours or for work purposes.
1. APPROVED AI TOOLS AND PLATFORMS
[Company Name] approves the following AI tools for business use:
- [List company-approved tools: e.g., ChatGPT (GPT-4), Microsoft Copilot, Gemini Pro, etc.]
- Other tools may be used if they comply with all sections of this policy
- Before adopting a new AI tool, consult with [IT Manager / Compliance / Security team]
2. DATA CLASSIFICATION AND HANDLING RULES
All company data is classified into one of four categories:
- Public: Information that has been publicly released or is not sensitive (marketing materials, published research, general company information)
- Internal: Non-sensitive business information not intended for public release (internal processes, organizational structures, general business plans)
- Confidential: Sensitive business information that could harm the company if disclosed (customer lists, financial data, pricing, unreleased products, trade secrets)
- Restricted: The most sensitive data requiring protection by law or contract (customer personal information, payment data, health records, social security numbers)
Allowable Uses by Data Classification:
- Public data: May be shared with external AI tools
- Internal data: Use company-approved, internal-only AI tools (not public-facing tools)
- Confidential data: Do not share with external AI tools; use only internal tools if your company has them
- Restricted data: Strictly prohibited from sharing with any external AI tool. Do not paste, upload, or mention specific restricted data to AI tools
3. APPROVED USE CASES
AI tools are approved for these categories of work:
- Brainstorming and ideation (with no confidential information)
- Writing assistance and editing (with human review)
- Content summarization of public information
- Code generation (with security and functionality review)
- Data analysis and visualization (using non-confidential data)
- Customer support and FAQ assistance (using company-approved information)
- Research on public topics
- Documentation and technical writing assistance
4. OUTPUT REVIEW AND ACCURACY REQUIREMENTS
All AI-generated content used for business purposes must be reviewed by a qualified employee before use. The reviewer is responsible for:
- Verifying factual accuracy (checking facts against reliable sources)
- Ensuring the output aligns with company messaging and policies
- Confirming no confidential information was inadvertently generated
- Testing code for security vulnerabilities and correctness
- Making any necessary edits for clarity and tone
- Adding attribution if the AI tool is used to assist with customer-facing content
AI-generated content cannot be used in customer communications, contracts, financial documents, or any public-facing material without documented human review and sign-off.
5. EMPLOYEE RESPONSIBILITIES
Every employee using AI tools is responsible for:
- Complying with all data classification rules (never sharing confidential or restricted data)
- Reviewing all AI outputs for accuracy before use
- Being transparent about AI use in any deliverable or communication (disclosing when AI was used to assist)
- Reporting any security incidents, data breaches, or unexpected behavior to [IT Manager / Security team] immediately
- Completing [AI training / compliance training] by [date]
- Asking for clarification if unsure whether a use case is allowed
6. PROHIBITED USES
The following uses of AI tools are strictly prohibited:
- Sharing customer personal data, payment information, or protected health information with any external AI tool
- Sharing employee personal data (social security numbers, performance reviews, salary information)
- Sharing proprietary code, product specifications, or unreleased product information with external tools
- Using AI to generate misleading, fraudulent, or deceptive content
- Using AI to circumvent security controls or create unauthorized access
- Using AI to make employment decisions (hiring, firing, promotion) without human review and judgment
- Using AI tools that require you to violate intellectual property rights or third-party terms of service
- Using AI to generate content that harasses, discriminates, or demeans employees or customers
- Using any unapproved AI tool for confidential or restricted data
7. INTELLECTUAL PROPERTY AND COPYRIGHT
Be aware of copyright and intellectual property considerations:
- AI-generated content may be based on copyrighted material. You are responsible for ensuring compliance with copyright law.
- If you use AI-generated content in customer-facing materials, verify that it is original and does not infringe on third-party IP
- Content generated with AI and used in [Company Name] work products is considered company property
- When in doubt about IP implications, consult with [Legal / Management] before using AI-generated content
8. INCIDENT REPORTING
If you accidentally share confidential data with an AI tool, discover a security issue, or suspect misuse, report it immediately to [IT Manager / Security team] by:
- Email: [contact information]
- Phone: [contact information]
- In-person: [location/person]
Provide details about what happened, what data may have been affected, and when you discovered it. Reporting incidents promptly helps us mitigate risk and improve policies.
9. POLICY UPDATES AND REVIEW
This policy will be reviewed and updated [quarterly / semi-annually / annually] or as needed in response to new tools, risks, or regulations. All employees will be notified of updates.
10. ACKNOWLEDGMENT
All employees must acknowledge receipt of and agreement with this policy. Acknowledgment will be documented in [HR system / training platform / email].
Illinois Addendum: Model Clauses for Illinois Employers
Updated November 2026. The ten sections above work anywhere in the United States. If you have even one employee in Illinois, add the clauses below. Each one starts with the law in plain words and then gives model language you can paste into the template, numbered to continue from Section 10. They are model language, not legal advice; have your employment counsel review them before you adopt them.
11. AI IN EMPLOYMENT DECISIONS (Illinois Human Rights Act)
The law in plain words: Since January 1, 2026, the Illinois Human Rights Act (775 ILCS 5/2-102(L), added by HB 3773, Public Act 103-0804) bars employers with one or more Illinois employees from using AI that has the effect of discriminating on the basis of a protected class, bars the use of ZIP codes as a proxy for a protected class, and requires notice to employees when AI is used for recruitment, hiring, promotion, renewal of employment, selection for training or apprenticeship, discharge, discipline, tenure, or the terms, privileges or conditions of employment. The state's implementing rules were proposed in May 2026 and withdrawn in June 2026, so there is no official notice form; our Illinois AI-in-employment notice kit has a tool inventory, a model notice and a posting checklist.
Model clause: [Company Name] may use AI tools to assist with recruitment, hiring, promotion, renewal of employment, selection for training, discipline, discharge, or the terms and conditions of employment only if: (a) the tool is listed in the company's AI tool inventory maintained by [HR contact]; (b) notice of its use has been given to affected employees and applicants in the form required by the Illinois Human Rights Act, in the handbook, in job postings, on [intranet / website] and on the premises; (c) the tool does not use ZIP codes, home addresses, commute distance or neighborhood as an input, filter or ranking factor; and (d) a named person reviews, and is responsible for, every decision the tool informs, and records the human reason for the decision. Employees and managers may not use personal AI accounts, or any tool not on the inventory, for these purposes, including pasting résumés, applications or employee records into a chatbot to rank or score people. Any employee or applicant who believes an AI tool has treated them unfairly, or who needs a reasonable accommodation in connection with an AI tool, may contact [HR contact] and will not face retaliation. Notices, inventories and related records are kept for at least four years.
12. BIOMETRIC AND VOICE DATA (Illinois Biometric Information Privacy Act)
The law in plain words: BIPA (740 ILCS 14) has applied since 2008 to any private business in Illinois that collects biometric identifiers such as fingerprints, face geometry, retina or iris scans or voiceprints. It requires written notice and a signed written release before collection (an electronic signature counts since the August 2024 amendment), a published retention and destruction schedule, and it bans selling or profiting from the data. Statutory damages are $1,000 per negligent and $5,000 per intentional or reckless violation, now generally once per person per collection method rather than per scan. AI features that recognize faces or voices are collection. Our BIPA compliance guide covers the details.
Model clause: No AI tool may be used to collect, create or store biometric identifiers or biometric information, including fingerprints, hand or face geometry, retina or iris scans or voiceprints, about employees, applicants, customers or visitors unless [Company Name] has first: (a) informed the person in writing of what is collected, for what purpose and for how long; (b) obtained a signed written release (an electronic signature is acceptable); (c) published a retention and destruction schedule and configured the tool to follow it; and (d) confirmed in writing that the vendor does not sell, lease, trade or otherwise profit from the data and protects it at least as carefully as we protect other confidential information. Turning on a voice- or face-recognition feature in a tool we already use counts as new collection and requires the same steps first. [Policy owner] keeps the list of approved biometric uses and the signed releases.
13. RECORDING AND TRANSCRIPTION CONSENT (and AI in clinical practices)
The law in plain words: Illinois is an all-party-consent state: under the Illinois eavesdropping statute (720 ILCS 5/14-2) recording a private conversation, in person or by phone, requires the consent of everyone in it. AI meeting assistants, call recorders and voice agents record. Clinical practices have an additional law: the Wellness and Oversight for Psychological Resources Act (HB 1806, Public Act 104-0054, signed August 1, 2025 and effective immediately) prohibits using AI to provide therapy or psychotherapy or to make therapeutic decisions, while allowing licensed professionals to use AI for administrative support and, with the client's informed, written and revocable consent, for supplementary support such as recording or transcribing a session. The Illinois Department of Financial and Professional Regulation enforces it, with fines of up to $10,000 per violation. We describe it narrowly here; counsel for your license type should confirm how it applies to you.
Model clause: Before any AI tool records, transcribes or summarizes a call, meeting, video session or voicemail, the employee operating it must tell every participant at the start that an AI tool is recording, and obtain their agreement; if anyone declines, the tool is turned off for that conversation. Where [Company Name] uses an automated voice agent or call recorder, the announcement is built into the greeting. Transcripts and summaries are stored only in [approved system], are shared only with people who attended or need them for their work, and are deleted after [period]. [For clinical and behavioral-health practices, add:] AI tools may be used for scheduling, billing, documentation support and other administrative work. They may not communicate with clients about their care, make or recommend treatment decisions, or attempt to detect a client's emotional or mental state. An AI tool may record or transcribe a therapy session only after the client has given informed, written, revocable consent that names the tool and explains how the recording and transcript are used, stored and deleted, and only under the supervision of the licensed clinician responsible for the client.
14. CONFIDENTIAL AND CLIENT DATA: WHAT MAY NEVER GO INTO A PUBLIC AI TOOL
Why a separate list: The data classification rules in Section 2 ask people to judge sensitivity. Most incidents happen because someone did not think of a specific item as "restricted." A plain list removes the judgment call.
Model clause: Regardless of how it is classified, the following may never be typed, pasted, uploaded, dictated or shown by screen-share into any AI tool that is not on the approved list with a business agreement that keeps our data out of model training: (a) a person's name combined with their Social Security number, date of birth, driver's license or passport number, home address or ZIP code; (b) health, medical, counseling, disability or insurance information about anyone; (c) payment card numbers, bank account details, payroll and tax records; (d) passwords, API keys, access codes and security configurations; (e) customer, patient, client or student lists and their contact details; (f) contracts, case files, matters and any document covered by attorney-client privilege or a non-disclosure agreement; (g) employee performance, discipline, salary, medical or immigration records; (h) unreleased financial results, pricing, bids, source code and product plans. Before using an approved tool on work that touches these categories, remove or replace the identifying details (for example "[Client A]", "[Employee 1]"). When in doubt, ask [contact] first; an answer takes minutes and a breach takes months.
15. VENDOR AND DATA-RESIDENCY CHECKS
Why it matters in Illinois: Illinois law firms are consistent that the employer, not the vendor, carries the liability under the Human Rights Act and BIPA. The withdrawn Illinois AI notice rules would also have required you to name each tool's developer and vendor and describe what data it processes, which you can only do if you asked.
Model clause: Before an AI tool or an AI feature inside an existing tool is approved, [Policy owner] records written answers to the following and keeps them with the tool inventory: (1) Does the vendor train its models on our prompts, files or outputs, and is that turned off under our plan? (2) Where is our data stored and processed (country and region), and can we choose a United States region? (3) How long are prompts, files and outputs retained, and can we delete them on demand? (4) Will the vendor sign a data processing agreement and, where relevant, a HIPAA business associate agreement or a written BIPA data-handling undertaking? (5) Does the tool collect or create any biometric identifier, and does the vendor sell or share personal data? (6) What independent security assurance can the vendor show (for example a current SOC 2 report)? (7) Will the vendor give us a plain-language description of the tool's purpose and the categories of data it processes that we can use in our Illinois employment notice? (8) Can we export our data and confirm deletion when we leave? A tool that cannot answer these questions is not approved. Approved tools are re-checked annually and whenever the vendor changes its terms, and the check is dated and filed.
16. BILINGUAL DISTRIBUTION AND ACKNOWLEDGMENT
Why: The withdrawn Illinois AI notice rules would have required notices "in the languages commonly spoken by the employer's workforce," and a policy nobody can read is not a policy. In Chicago that most often means Spanish and Polish; ask your team rather than assume.
Model clause: This policy and the Illinois AI employment notice are provided in English and in [Spanish / Polish / other languages commonly spoken by our workforce]. Translations are prepared by [a qualified human translator] and reviewed by a bilingual manager before distribution; machine translation may be used for a first draft but never for the final text. Where versions differ, the [English] version controls. Every employee acknowledges the policy in the language of their choice within [30] days of hire and at each re-issue, and the signed acknowledgments and every version of the policy and notice are kept for at least four years.
That is the whole Illinois addendum. The sixteen sections together, with an acknowledgment form, are in the Word download below.
How to Roll Out Your AI Policy
A policy only works if people know about it and understand it. Here's how to introduce it effectively:
Communicate the Why: Don't just announce a new policy. Explain why it matters. Talk about the real risks (data breaches, IP violations, accuracy issues) and how the policy protects the company and employees.
Deliver Training: Offer a brief training session (30 minutes is enough) covering policy highlights, the data classification system, and what to do if you're unsure about a use case. Make it interactive so people can ask questions.
Get Sign-Off: Have all employees sign or electronically acknowledge the policy. This ensures everyone has understood it.
Start with Awareness, Not Enforcement: In the first month, focus on awareness and clarification. Answer questions. Help people understand what data classification means for their work. Don't immediately penalize honest mistakes. Once people understand the policy, then move to consistent enforcement.
Review and Iterate: After 30 days, gather feedback. Did people find the policy clear? Are there common questions or confusion points? Update the policy based on real-world feedback.
Make Champions: Identify employees who are comfortable with AI and want to help others. Make them go-to resources for questions about policy and best practices.
Customizing This Template for Your Business
The template above is a starting point. You'll want to customize it based on your business:
If you handle healthcare data, emphasize patient data protection and HIPAA compliance. If you're a professional services firm, emphasize confidentiality and IP. If you're a software company, focus on code security and trade secret protection. If you work with sensitive customer data, emphasize restricted data handling. If you have employees in Illinois, add the Illinois addendum above.
Also consider your company's AI maturity and culture. If most employees are already using AI tools informally, you might lead with "here's how to use AI safely" rather than "here's what's not allowed." If you're earlier in adoption, you might start with a shorter, simpler policy and expand it over time.
Common Questions About AI Policy
Should we ban AI entirely?
Most small businesses shouldn't. AI tools can genuinely improve productivity. The goal is safe, appropriate use, not prohibition.
What if we don't have the infrastructure for internal-only AI tools?
That's okay. You can still use external tools safely as long as you follow data classification rules—public and internal data only, no confidential or restricted data.
Do we need legal review of this policy?
For most small businesses, the general sections are practical and reasonable as they stand. If you're in a heavily regulated industry (healthcare, finance, law), if you're concerned about specific liability, or if you adopt the Illinois addendum, which tracks specific Illinois statutes, have an employment lawyer review it.
How do we handle vendors and contractors?
The policy applies to anyone working with your company. Make it a requirement in vendor agreements and contractor agreements that they comply with your AI policy if they're using AI on your behalf.
Does Illinois require small businesses to have an AI policy?
No Illinois law requires a general AI acceptable use policy. But since January 1, 2026, the Illinois Human Rights Act requires employers with one or more Illinois employees to notify employees when AI is used in hiring and other employment decisions, and bars discriminatory AI and ZIP-code proxies; BIPA has required written consent before collecting biometric data since 2008; and Illinois is an all-party-consent state for recording conversations. A written policy is the simplest way to show how your business meets those duties.
Does this template cover the Illinois HB 3773 notice requirement?
Section 11 of the Illinois addendum gives the policy clause: approved tools only, notice given, no ZIP-code proxies, human review. The notice itself is a separate document that goes in the handbook, job postings, your website and on the premises. Our Illinois AI-in-employment notice kit has a model notice, a tool inventory table and a posting checklist you can copy.
Is the Word download really free?
Yes. The .docx contains the full sixteen-section policy, the Illinois addendum and a one-page acknowledgment form, with bracketed fill-ins. There is no email gate and no sign-up. It is model language from 312 IT Consulting, not legal advice, so have counsel review it before you adopt it.
Your AI Governance Journey
An AI acceptable use policy is a foundation, not a complete solution. As your company uses more AI, you may eventually want more sophisticated governance—tools to monitor AI usage, formal vendor evaluation processes, or compliance audits. But for now, a clear, practical policy that you actually use and enforce is more valuable than a lengthy policy document that sits in a drawer.
If you need help developing, rolling out, or refining an AI policy for your business, 312 IT Consulting offers AI governance and training support. We can help you customize a policy, train your team, and establish processes that actually work for your business. Let's discuss your AI governance needs.