Policy template + checklistBusiness 18 min read

AI Acceptable Use Policy Template for Small Teams

A fill in AI policy for small businesses, agencies, NGOs and schools. Answer five questions, fill in your details once and get a full staff policy, a classroom version, a one page summary to sign and an announcement email.

AI Acceptable Use Policy Template for Small Teams

What's inside

  1. 01Who this policy is for
  2. 02Step 1: Decide before you edit
  3. 03Step 2: Fill in your policy
  4. 04Step 3: Roll it out
  5. 05Laws and rules to check
  6. 06Common mistakes to avoid
  7. 07AI prompts to adapt your policy
  8. 08Keep going

Your ticks and answers are saved on this device.

Your team is already using AI. Someone is drafting proposals in ChatGPT, someone else is summarising meetings with a note taker, and a student is checking an essay with Gemini. Without a few clear rules, the risks are quiet but real: a customer list pasted into a free account, a made up statistic in a client report, or a meeting recorded by a bot nobody agreed to.

This kit gives you a plain English AI acceptable use policy you can fill in and adopt this week. It is written for small businesses, agencies, NGOs and schools that do not have a legal or IT department. Answer five short questions first, then fill in the policy once and every version updates: the full staff policy, a classroom version, a one page summary people can sign and an email to announce it.

Please note: this template is a practical starting point, not legal advice. Laws on data and AI differ between countries and are changing quickly. If you handle sensitive data, work in a regulated sector or serve clients abroad, ask a qualified lawyer to review your final policy.

Who this policy is for

  • Small businesses and startups that want staff to use AI confidently without leaking customer or company data.
  • Agencies and freelancers with teams who need clear rules on what to tell clients about AI in their work.
  • NGOs and charities that hold personal data about beneficiaries, donors and volunteers.
  • Schools, tutors and training centres that need rules for both teachers and students.

A good AI policy does three things. It tells people which tools they may use, it draws a firm line around data that must never go into those tools, and it makes a named person responsible for checking anything AI produces before it reaches a customer, a student or the public. Everything else in this template supports those three points.

Step 1: Decide before you edit

Answer these questions with whoever runs the business or school. Your answers are saved on this device, and they will make filling in the policy much faster. If you are unsure, write down what you do today. You can tighten the rules later.

Business or team plans usually give you more control over how your data is stored and used. Name the plan, not just the tool.

Think about the data that would hurt someone, or your business, if it leaked. Be specific to your work.

One named role is better than a committee. It should be someone who can say yes quickly.

Check your client contracts too. Some forbid AI use, and some require you to disclose it.

AI tools change quickly. Every six months is a sensible starting point for a small team.

Step 2: Fill in your policy

Press Fill in on any template below and type your details once. Every template that uses the same detail updates at the same time. Then copy the version you need into a document, read it through and adjust anything that does not fit how your team works.

The full policy is for staff and contractors. The school version replaces it for classrooms. The one page summary is what people actually read, so ask everyone to sign or acknowledge it. The announcement email helps you launch the policy without it feeling like a telling off.

AI policy templates

Showing 4 of 4

Full AI acceptable use policy

Policy

When to use: The main policy for staff, contractors and volunteers. Share it as a document everyone can find.

{org} AI Acceptable Use Policy

Effective from: {effective_date}
Policy owner: {contact}
Next review: {review_date}

1. Purpose

AI tools can help us write, research, plan and create faster. This policy explains how to use them safely, so that we protect the people we work with, keep our work accurate and stay honest about how it was made. It is meant to help you use AI with confidence, not to stop you using it.

2. Who this policy covers

This policy applies to everyone who works for or with {org}, including employees, contractors, interns and volunteers. It covers any AI tool used for {org} work, on any device, whether the account is paid for by {org} or by you personally.

3. Approved tools

You may use the following AI tools for {org} work:
{approved_tools}

Use your work account where one is provided. Do not use a personal account for work that involves internal information.

If you want to use a tool that is not on this list, ask {approver} first. This includes browser extensions, AI meeting note takers, phone apps and features that connect an AI tool to your email, calendar or shared files. New tools are approved when we understand where the data goes, who can see it and whether it is used to train the provider's models.

4. What information you may share with AI tools

We sort information into three groups.

Public: information that is already published or meant for anyone, such as our website copy, published reports and public job adverts. You may use this with any approved tool.

Internal: everyday working information that is not secret but is not public, such as draft plans, internal process notes and anonymised data. You may use this only with approved tools on a work account, with the privacy settings described in section 8.

Never share: information that could harm a person or {org} if it leaked. Do not paste, upload, dictate or connect any of the following to an AI tool, unless {approver} has approved that specific tool and use in writing:
- passwords, API keys, access codes and security answers
- personal data about customers, clients, students, beneficiaries or donors, such as names linked to phone numbers, home addresses, email addresses or dates of birth
- identity and financial numbers, such as NIN, BVN, passport numbers, card numbers and bank account details
- health, disability, religion and other sensitive personal information
- staff records, including salaries, appraisals, disciplinary matters and medical notes
- client documents covered by a confidentiality agreement, and unreleased financial results
- {sector_data}

If you are not sure which group something belongs to, treat it as Never share and ask {contact}. Removing names is not always enough, because a person can often be identified from other details.

5. Accuracy and human review

AI tools can produce confident answers that are wrong, including invented facts, figures, quotes, sources and links. You are responsible for anything you send, publish or submit, whether or not AI helped you write it.

Before AI assisted work leaves {org}, a person must:
- check every fact, number, date, name and quotation against a reliable source
- open and read every source or link the AI gives you
- read the whole piece for tone, and make sure it sounds like {org}
- get a qualified person to review anything legal, financial, medical or safety related

Never let an AI tool send emails, post content or make payments on its own unless {approver} has approved that automation and a person checks it regularly.

6. Being open about AI use

{disclosure_rule}

Always follow the client's contract if it says something different. Never present AI images, video or audio of a real person as genuine. Do not clone anyone's voice or create their likeness without their clear permission.

7. Ownership and copyright

Work you create with AI for {org} belongs to {org} in the same way as your other work, as far as the law allows. Copyright rules for AI output differ between countries and are still developing, so:
- do not paste someone else's copyrighted work into an AI tool to rewrite it as our own
- check the terms of each tool before using its output in paid client work
- keep a note of which important pieces were made with AI help

8. Accounts, privacy settings and security

- Use a strong, unique password and turn on two step verification for every AI account.
- Where a tool offers a setting that lets the provider use your conversations to train its models, turn that setting off for work accounts.
- Do not share AI accounts or logins between people.
- Do not record a meeting or let an AI note taker join without telling everyone in the meeting first, and stop if anyone objects.
- Delete chats that contain internal information when you no longer need them, where the tool allows it.

9. Fairness and decisions about people

AI must not make final decisions about people. This includes hiring, promotion, pay, grading, discipline, lending, eligibility for services and admission. AI may help organise information, but a person must make and explain the decision. Watch for bias in AI output, for example assumptions about gender, age, ethnicity, religion, accent or disability, and correct it.

10. Reporting problems

Report any of the following to {contact_email} as soon as possible, and within 24 hours:
- you shared Never share information with an AI tool by mistake
- AI produced something harmful, offensive or misleading that reached a client or the public
- you notice an AI tool behaving unexpectedly, such as connecting to accounts it should not
- you are asked to use AI in a way that seems to break this policy

We will treat honest, prompt reports as a chance to fix the problem, not as a reason for blame.

11. Training

Everyone covered by this policy must read it and complete our short AI training {training_deadline}. We will share updates when tools or rules change.

12. Breaking this policy

Breaking this policy may lead to loss of access to AI tools and, for serious or repeated breaches, action under our usual disciplinary process. Hiding a breach is treated more seriously than reporting one.

13. Review

{contact} reviews this policy at least every six months and whenever we adopt a major new tool. The next review is due on {review_date}. Questions go to {contact_email}.

School and classroom AI policy

School

When to use: For schools, tutorial centres and training programmes. Use it with the staff policy for teachers.

{org} AI Use Policy for Students and Teachers

Effective from: {effective_date}
Policy owner: {contact}
Next review: {review_date}

1. Why we have this policy

AI tools can help students understand difficult topics, practise and get feedback. Used badly, they can replace the thinking that learning depends on. This policy explains when AI helps learning at {org} and when it does not.

2. Approved tools

Students and teachers may use these AI tools for school work:
{approved_tools}

Each AI tool sets its own minimum age in its terms of use. Students must only use tools they are old enough to use, and younger students should only use AI with a teacher present.

3. How students may use AI

Unless a teacher says otherwise for a task, students MAY use AI to:
- explain a topic in simpler words, or with a new example
- quiz themselves and practise for tests
- get feedback on a draft they wrote themselves
- check their grammar and spelling
- brainstorm ideas before starting their own work

Students MAY NOT use AI to:
- write all or most of an assignment, essay or project they hand in as their own
- answer questions in a test or exam, unless the teacher allows it
- invent sources, quotes, data or references
- create images, audio or video of another student or teacher

4. Every task has an AI level

Teachers will mark each assignment with one of these levels:
- No AI: the work must be entirely your own.
- AI for planning: you may use AI for ideas and feedback, but every sentence you submit must be yours.
- AI allowed: you may use AI as the task explains, and you must say how you used it.

If a task has no level, ask your teacher before using AI.

5. Saying how you used AI

When you use AI on any assessed work, add a short note at the end, for example: "I used Gemini to explain photosynthesis and to check my spelling. All the writing is my own." Using AI without saying so, where a note is required, is treated as academic dishonesty.

6. Keeping personal information safe

Students and teachers must never put the following into an AI tool: full names with other personal details, home addresses, phone numbers, photos of students, grades, medical or special needs information, or {sector_data}.

7. Rules for teachers

Teachers may use approved AI tools to plan lessons, create practice questions and draft feedback. Teachers must:
- check all AI generated material for accuracy before giving it to students
- never paste student work that contains personal details into an AI tool
- make the final decision on every mark and every report, without relying on AI
- not rely on AI detection tools alone to accuse a student, because these tools can be wrong; talk to the student and look at their drafts first
- tell students and parents when AI was used to create learning materials or feedback, following this rule: {disclosure_rule}

8. Problems and questions

Report any problem, such as personal information shared by mistake or harmful content, to {contact_email}. Questions about this policy go to {contact}. This policy will be reviewed by {review_date}.

One page summary to sign

Summary

When to use: The short version people will actually read. Ask everyone to sign it or reply to confirm.

{org} AI Rules: One Page Summary

1. Use only approved tools: {approved_tools}. Ask {approver} before trying anything new, including extensions and meeting note takers.

2. Never put these into AI: passwords and keys; personal details of customers, students or staff; NIN, BVN, bank and card numbers; health information; confidential client documents; {sector_data}.

3. Check everything. AI can invent facts, figures and sources. You are responsible for what you send or publish.

4. Be open. {disclosure_rule}

5. People decide about people. AI never makes the final call on hiring, pay, grades, discipline or eligibility.

6. Keep accounts safe. Use two step verification, do not share logins and turn off training on your chats where the tool allows it.

7. Report mistakes fast. Email {contact_email} within 24 hours. Honest reports are welcome.

Full policy: {policy_link}
Policy owner: {contact}

I have read and understood the {org} AI Acceptable Use Policy.

Name: ______________________________
Signature: __________________________
Date: _______________________________

Announcement email to staff

Announcement

When to use: Send this when the policy starts, so it lands as help rather than a warning.

Subject: Our new AI rules, and a short briefing on {session_time}

Hi everyone,

Many of us now use AI tools to write, research and plan, and that is a good thing. To make sure we use them safely, we have put together a short AI policy for {org}. It starts on {effective_date}.

The short version:
- We have approved these tools: {approved_tools}.
- Some information must never go into an AI tool, such as customer personal details, passwords and confidential client documents.
- A person checks everything AI helps us produce before it goes out.
- If something goes wrong, tell {contact_email} quickly. Honest mistakes reported early are easy to fix.

You can read the full policy here: {policy_link}

We will go through it together on {session_time}. It will take about 30 minutes, and you are welcome to bring questions or tools you would like us to approve. Please read the one page summary and confirm you have read it {training_deadline}.

Thank you for helping us use AI well.

{sender_name}

Step 3: Roll it out

A policy only works if people know it exists and understand why it matters. Most small teams can roll this out in two weeks. Tick each step when it is done; your progress is saved on this device.

Rollout checklist

0 of 15 done

Before launch

Launch week

After launch

Laws and rules to check

Your AI policy sits on top of the laws that already apply to the personal data you handle. These are the main ones to look at, depending on where you work and who your clients are. This is a short orientation, not a full legal summary, so check the current official guidance for your situation.

  • Nigeria Data Protection Act 2023. This law sets the rules for handling the personal data of people in Nigeria, and it established the Nigeria Data Protection Commission (NDPC) as the regulator. If you paste personal data into an AI tool, that is still processing personal data, so you need a lawful reason for it and appropriate safeguards. The NDPC publishes guidance and updates on its official website.
  • The EU General Data Protection Regulation (GDPR). If you offer services to people in the European Union or monitor their behaviour, the GDPR may apply to you even if your business is based elsewhere. Many international clients will expect you to follow it.
  • The EU AI Act. This law entered into force in 2024, and its duties apply in stages. It sorts AI uses by risk, and uses such as recruitment and education can fall into the higher risk groups. If you serve EU clients or use AI in hiring or assessment, read the official guidance or take advice.
  • Local and sector rules. Other countries have their own data protection laws, and regulators for areas such as banking, health and education may publish their own AI or data guidance. Check the rules for every country you work in.

Two habits keep most small teams on the right side of these laws: keep personal data out of AI tools unless you have checked the tool and have a clear reason, and make sure a person makes every important decision about another person.

Common mistakes to avoid

  • Banning AI outright. People keep using it on personal accounts, where you have no control at all. Approving a few good tools works better.
  • Writing rules nobody can follow. "Never use AI for client work" sounds safe but is rarely realistic. Clear limits on data and checking are easier to live with.
  • Forgetting free accounts. Free plans often have different data terms from business plans. Read them before you approve a tool.
  • Trusting AI detectors. Detection tools can wrongly flag human writing, especially from people writing in a second language. Never punish someone on a detector score alone.
  • Setting and forgetting. AI tools add features every month. A policy nobody reviews goes out of date quickly.

AI prompts to adapt your policy

Paste your filled in policy into an approved AI tool, then use these prompts. Remove any confidential details first, and always read the result carefully before you adopt it.

Adapt the policy to my industry

Use this to add rules that fit your sector, such as health, finance, legal or education.

I run [type of organisation] in [country] with [number] staff. We work with [describe your customers or students] and handle [types of data].

Below is our draft AI acceptable use policy. Suggest changes that make it fit our industry. For each suggestion, say which section it belongs in, write the new wording in plain English and explain the risk it addresses in one sentence. Point out anything that should be checked by a lawyer, and do not invent specific laws, fines or article numbers.

[Paste your policy here]

Turn the policy into a staff FAQ

Use this to create a friendly question and answer page for your team.

Turn the AI policy below into a staff FAQ with 12 to 15 questions. Write the questions the way a busy employee would ask them, for example "Can I use ChatGPT to reply to a customer?" Answer each in two or three plain sentences, based only on what the policy says. If the policy does not answer a question clearly, list it separately at the end so we can fix the gap.

[Paste your policy here]

Review our current practice against the policy

Use this to find gaps between what the policy says and what your team really does.

Here is our AI acceptable use policy, followed by a description of how our team currently uses AI tools.

Compare the two. List each place where our current practice does not match the policy, rank them from highest to lowest risk, and suggest one practical fix for each that a small team could do within a week. Then list any risks in our current practice that the policy does not cover at all.

Policy:
[Paste your policy here]

How we use AI today:
[Describe the tools, who uses them and what for]

Keep going

Share

Newsletter

Get new free resources every two weeks

Join 500+ people getting AI tips, prompts, and templates.