Why you need one before you need one
Your team is probably already using AI, on personal accounts, for work. That's not a disaster, but it means customer details, pricing and private documents may be going into tools with settings you've never checked. A one-page policy turns guesswork into a simple rule everyone knows. It also makes training easier, because you're teaching one approved way of working.
The one-page template
[Business name] AI use policy · Effective [date] · Owner: [name]
1. Approved tools. Staff may use [tool and plan, e.g. our company ChatGPT Business / Claude Team / Gemini account] for work. Do not use personal AI accounts for business information.
2. Never paste (red list). Customer payment details, Social Security or ID numbers, passwords and access codes, health information, employee records, and anything a client has told us is confidential.
3. Ask first (yellow list). Customer names with job details, contracts, financial reports, pricing and supplier terms.
4. Fine to use (green list). Our public information, general questions, drafts of marketing copy, templates with no personal details.
5. Human check. A person must read and approve anything AI drafts before it goes to a customer, is posted publicly, or is used for pricing, hiring, legal or money decisions.
6. Be honest. Don't present AI output as something it isn't. No AI-written reviews or testimonials, ever.
7. When unsure, ask [name]. Report mistakes quickly. That's how we improve this policy, and nobody gets in trouble for asking.
Review date: [every 6 months]
The red, yellow and green data list
| Red: never | Yellow: ask first | Green: fine |
|---|---|---|
| Card and bank details | Customer names with job details | Your website and public info |
| ID and Social Security numbers | Contracts and agreements | General how-to questions |
| Passwords, alarm and access codes | Financial reports | Marketing drafts |
| Health and medical information | Pricing and supplier terms | Templates with no personal data |
| Employee HR records | Internal emails | Rewriting your own notes |
Adjust the columns for your business. A law firm moves almost all client material into red, unless it's in a tool reviewed for that use. A coffee shop may have very little in red beyond payment details and staff records.
Is ChatGPT safe for business use?
It depends on three things: which plan you use, how its settings are configured, and what you put into it. Business and team plans from the major vendors come with different data terms and admin controls than individual plans. Read the terms for the exact plan you buy. Settings such as whether chats are used for model training vary by plan, so check them. And the red list matters more than the brand: the safest information is information you never pasted. For a comparison of plans, see ChatGPT vs. Claude vs. Gemini.
Extra steps for regulated businesses
- Health practices: if a tool will handle protected health information, HIPAA generally requires a business associate agreement with the vendor. HHS publishes sample BAA provisions. No BAA means no patient information.
- Law firms: the ABA's Formal Opinion 512 covers competence, confidentiality, communication with clients and fees when lawyers use generative AI. Check your state bar's guidance too.
- Financial, insurance and mortgage businesses: check your regulator's and carrier's rules on customer data before using any AI tool with client files.
- Anyone wanting a fuller framework: NIST's free AI Risk Management Framework is the standard US reference, though most small businesses won't need more than this page.
Rolling it out in 15 minutes
- Fill in the template and the data list.
- Set up the approved tool on a business account if you can.
- Walk the team through it, with three examples from your own business.
- Pin it where people work, and add it to new-hire onboarding.
- Review it in six months, or sooner if you add a tool.
Your business's AI plan recommends tools with your data risks in mind, and flags where your industry needs extra care. That way the policy and the tools are decided together.