Some of your employees probably use AI at work already. Picture it: one person pastes a customer’s complaint, name and all, into a free chatbot to draft a reply. Another asks it to rewrite a quote. If nobody says what’s allowed, each person guesses. A short AI policy for employees replaces that guessing with clear rules, and you can write one in an afternoon.
In a 2025 Pew Research Center report on workers and AI chatbots, half of workers who aren’t self-employed said their employer neither encourages nor discourages chatbots at work. Here’s what a good policy covers, plus a template to copy.
Why a One-Page AI Policy Works Better Than a Thick Handbook
An AI policy only helps if your employees read it and remember it. A twelve-page document gets signed and forgotten. A single plain page can hang by the time clock or sit pinned in your team chat.
NIST’s AI Risk Management Framework is a voluntary guide, and its core asks for clear policies, staff training and defined human oversight. NIST built it for organizations of all sizes. So borrow the thinking, skip the jargon and keep each rule to a sentence or two.
The Seven Parts of an AI Policy for Employees
1. Approved Tools and Business Accounts
First, list the AI tools your team may use for work, and on which plan. Then require company accounts for all work, with one login per person. Work done on a personal login sits in an account you don’t control and leaves with the employee.
Also list AI built into apps you already use, like email tools and AI note-takers. Note-takers record calls, so check recording consent first. Anything unlisted needs your approval.
Your plan also changes what happens to your data. OpenAI says on its business data page that it doesn’t train its models on ChatGPT Business, Enterprise or Edu data by default. On personal plans, its help center says it may train on your content unless you turn off “Improve the model for everyone” in Data controls. So keep customer and company details on a business plan, where the rules below still apply. Our guide to ChatGPT for small business covers the choice.
2. Data That Never Goes Into AI Tools
This rule prevents the worst mistakes, so make it specific. Instead of vague wording like “be careful with sensitive data,” sort your information into three groups:
- Fine to use: anything already public, like your service list, posted hours and website copy.
- Only without names: customer emails, private feedback and job notes. First, replace names with “Customer A” and remove anything else that identifies the person.
- Never: Social Security, card and bank numbers, passwords and door codes, health or patient information (even without names), employee records, and anything under a confidentiality agreement.
The U.S. Small Business Administration gives similar advice: keep sensitive and proprietary information out of AI tools. When in doubt, treat the data as off-limits.
3. Human Review and Limits on Hiring Decisions
AI writes with confidence even when it’s wrong. That’s why a person must read every draft before it goes to a customer, a vendor or your website. The reviewer checks facts, prices, dates, promises and tone. Also, name who reviews what. For example, the office manager approves emails, and the owner approves anything with a price.
Some decisions need more than a quick review. New Jersey’s Division on Civil Rights says the state’s Law Against Discrimination covers discrimination caused by AI and other automated tools. Its guidance names resume review, hiring decisions and performance reviews as examples. So keep AI out of screening applicants or rating staff.
4. Telling Customers When They’re Dealing With AI
If a chatbot answers questions on your website or an AI assistant picks up your phone, customers should know. Some state laws also address it. California, for example, bars using an online bot that pretends to be human to sell to people there. Under that law, a business isn’t liable if it clearly and conspicuously discloses the bot.
Your policy can keep it simple: say it’s an AI assistant, and always offer a way to reach a person. Phone calls also bring consent and recording rules, and our overview of the rules for AI phone calls walks through them. None of this is legal advice, so have a lawyer review your wording.
5. Who Owns Prompts and Outputs
State that prompts, instructions and outputs created for work belong to the business. Then keep them in shared company workspaces, not personal chats. A shared ChatGPT project works well for this, and a team prompt library saves everyone time. Our ready-to-adapt prompts for business owners make a good starting set.
Ownership of the content itself is less simple. The U.S. Copyright Office says AI output gets copyright protection only where a person made enough of the creative choices. Prompts alone don’t count. If a design or piece of writing matters to your brand, have a person do real creative work on it. Also check that nothing copies someone else’s trademark or content.
6. Training Before Access
Nobody should get an AI login before a short walkthrough. Thirty minutes is enough: read the policy together, show one good use and one bad one, then answer questions. Afterward, employees sign the acknowledgment line at the bottom of the AI policy.
Then add one scam lesson. The FBI warns that criminals use generative AI to make fraud faster and more convincing. So check urgent payment or data requests by calling a number you look up yourself.
7. A Regular Review Date
AI tools change quickly. OpenAI, for instance, plans to retire custom GPTs, so any policy that names them will need an update. Put a review on the calendar every three months, and revisit it when you add a tool, change plans or catch a mistake.
A One-Page AI Policy Template You Can Copy
Swap in your own details where you see brackets.
[Business name] AI Use Policy, effective [date], policy owner: [name]
- Purpose: We use AI tools to draft, summarize and organize work faster. People stay responsible for every result.
- Approved tools: [tool and plan]. Ask [name] before adding any other AI app, extension or note-taker. Use your own company login for work on any device, never a personal or shared one.
- Good uses: first drafts of emails and posts, meeting summaries, checklists and brainstorming.
- Off-limits uses: screening applicants, rating staff, setting prices, faking reviews or testimonials, or legal, medical and financial decisions.
- Never paste: Social Security, card or bank numbers, passwords or door codes, health or patient details (even without names), employee records or confidential files.
- Customer details: replace names with “Customer A” and remove anything else that identifies the person before pasting.
- Human review: [name] checks facts, numbers, promises and tone before anything goes to a customer, vendor or our website, and [owner] approves any price.
- Disclosure: when customers chat or talk with an AI assistant, we tell them and offer a person.
- Ownership: prompts, instructions and outputs made for work belong to [business name] and stay in shared workspaces.
- Scam check: verify urgent payment or data requests by calling a known number.
- Training: everyone completes AI training before getting access, and again after major updates.
- Mistakes: report an AI error or data slip to [name] the same day.
- Leaving the team: [name] removes AI access on the employee’s last day.
- Breaking the rules: handled like any other policy violation under [handbook section].
- Review: [name] updates this policy every [three] months and whenever tools or plans change.
- Acknowledgment: I have read this policy and will follow it. [Signature, name, date]
Common Questions About an AI Policy for Employees
Do I need a lawyer to write an AI policy?
Not to draft it. This guide is general information, not legal advice. Still, have an employment attorney review the final version, especially the rules on hiring, disclosure and ownership.
What if employees use AI on their own phones anyway?
Make the approved path easier than the workaround. Help them sign in with their own company login on their phone, with shared prompts ready to go. Whatever the device, work data goes only into company accounts.
Does a small team really need a written policy?
Yes. Census researchers found that workers sometimes use AI even when their company hasn’t formally adopted it. So even a three-person office should write down what stays out of AI tools and who checks the work.
Turn Your AI Policy Into a Working Setup
A written AI policy lets your employees use these tools with confidence instead of guessing. Samaroo Solutions works out of northern New Jersey, helping businesses statewide put AI to work with clear rules. Through our AI services, we can set up the pieces your one-page policy calls for: business accounts, a shared ChatGPT project and a clear review step. Tell us how your team uses AI today, and we’ll help you decide where to start.
