--- title: "AI use policy for a small business" description: "Write a small-business AI use policy with approved tasks, data rules, review duties, spend authority, incident reporting, and examples staff can use." canonical: "https://scalewithsearch.com/articles/small-business-written-ai-use-policy" --- ## Site navigation - [Scale With Search](https://scalewithsearch.com/) - Services - Services - [AI systems](https://scalewithsearch.com/ai-systems) - [Site build](https://scalewithsearch.com/work#site-build) - [Whole website fix](https://scalewithsearch.com/work#whole-website-fix) - [Content library with SEO](https://scalewithsearch.com/work#content-library) - [Working session](https://scalewithsearch.com/audit) - Start here - [Send your brief](https://scalewithsearch.com/work#send-your-brief) - [Example scope](https://scalewithsearch.com/work#review-the-example-scope) - [Prices and terms](https://scalewithsearch.com/work#prices-and-terms) - Industries - Real estate - [Real estate agents and teams](https://scalewithsearch.com/for/real-estate) - [Platforms, ownership, and IDX](https://scalewithsearch.com/for/real-estate/real-estate-website-platforms-ownership-idx) - [Search, content, and AI](https://scalewithsearch.com/for/real-estate/real-estate-search-content-ai) - [Inquiries, campaigns, and handoffs](https://scalewithsearch.com/for/real-estate/real-estate-website-inquiries-campaigns-handoffs) - [Buyer, seller, and local pages](https://scalewithsearch.com/for/real-estate/real-estate-buyer-seller-local-resources) - [Rules, privacy, and trust](https://scalewithsearch.com/for/real-estate/real-estate-website-rules-privacy-trust) - Browse by business - [Trades and home services](https://scalewithsearch.com/for/#group-trades) - [Health, wellness, and animal care](https://scalewithsearch.com/for/#group-practices) - [Law, finance, and IT](https://scalewithsearch.com/for/#group-professional) - [Marketing and SEO agencies](https://scalewithsearch.com/for/#group-agencies) - [Shops and manufacturers](https://scalewithsearch.com/for/#group-manufacturing) - [Restaurants, shops, studios, and nonprofits](https://scalewithsearch.com/for/#group-local-services) - Chiropractic practices - [Chiropractic and wellness practices](https://scalewithsearch.com/for/chiropractic-and-wellness-practices) - [Chiropractic and physical therapy clinics](https://scalewithsearch.com/for/chiropractic-and-physical-therapy-clinics) - [All industries](https://scalewithsearch.com/for/) - Resources - Free tools - [AI readiness check](https://scalewithsearch.com/check) - [Free tools](https://scalewithsearch.com/tools/) - [Free Starter Kit](https://scalewithsearch.com/kit/business-memory-starter-kit.zip) - Guides - [AI-native library](https://scalewithsearch.com/ai-native) - [Industry intelligence](https://scalewithsearch.com/intelligence) - [Office job guides](https://scalewithsearch.com/guides/) - [Business memory](https://scalewithsearch.com/articles/business-memory-for-ai-agents-guide) - [Agent governance](https://scalewithsearch.com/articles/ai-agent-governance-guide-small-business) - [Migration and ownership](https://scalewithsearch.com/articles/leaving-vendor-ai-memory-guide) - Articles - [All articles](https://scalewithsearch.com/articles/) - [What changed](https://scalewithsearch.com/changes/) - About - Evidence - [Proof](https://scalewithsearch.com/proof) - Scale With Search - [About](https://scalewithsearch.com/about) - [How it works](https://scalewithsearch.com/how-it-works) # How to write an AI use policy for a small business Write an AI use policy around the work your business permits. Name approved tools and accounts, allowed tasks, data restrictions, review duties, spending authority, and the person who handles a problem. Keep the policy short enough to use during a working day. Put detailed settings and instructions in linked runbooks. Give staff a few concrete examples and a clear way to ask about a task that has not been approved. The clauses below are a starting point for an internal operating policy. Adapt them to your actual functions, agreements, and applicable requirements before issuing them. ## Start with an inventory and an accountable owner List the AI tools, accounts, and recurring functions already in use. Include individual drafting tools and functions connected to company records. Identify who pays, who manages access, and who reviews outputs. Choose a policy owner and a backup. Give them a way to receive questions and report decisions. Record the approval date, version, next review date, and location of the current policy. NIST's Govern playbook calls for documented responsibilities, communication, and training for people managing AI risks. Use that guidance to assign duties people can carry out. [NIST Govern playbook, checked 2026.10.26](https://airc.nist.gov/airmf-resources/playbook/govern/) The [small-business governance guide](/articles/ai-agent-governance-guide-small-business) covers the wider operating structure. Your use policy should tell an employee what to do within it. ## Clause one: approved tools, accounts, and tasks Use a clause such as: Use AI for company work only through approved accounts and for tasks listed in the approved-use register. Ask the policy owner before starting a new use. Give the register an owner. For each entry, name the function, approved account, permitted users, permitted data, allowed output, and reviewer. Put the status beside the entry so a paused function cannot be mistaken for an active one. Make approvals specific. Preparing a draft from public product information is a different task from analyzing a customer complaint. Approval for the first should not silently cover the second. Provide a route for proposing a new use. Ask for the intended result, source material, account, data class, and review plan. Keep it small enough that staff will use it. ## Clause two: information the task may use Use a clause such as: Give an AI task only the approved information needed for its stated purpose. Keep credentials, payment details, and restricted records out unless a separate approved process explicitly covers them. Define your data classes in plain language. Public material might include published service descriptions. Confidential material might include customer messages or internal plans. Restricted material should have named handling rules and an accountable owner. The FTC's security guidance recommends limiting unnecessary collection and access to personal information. Apply that principle when approving the records a task may read. [FTC Start with Security, checked 2026.10.26](https://www.ftc.gov/business-guidance/resources/start-security-guide-business) Give examples of allowed and excluded fields for each task. Avoid asking an employee to infer a data decision from the tool's brand or the quality of its answers. ## Clause three: human review and external actions Use a clause such as: Treat AI output as a draft until the named reviewer accepts it. Verify factual claims against approved sources. Obtain the required approval before sending, publishing, purchasing, or changing an account. Define what the reviewer checks. A customer reply needs the correct person, current facts, appropriate commitments, and the intended destination. A numerical report needs its source period and totals checked. Put the action boundaries in the connected systems as well as the policy. A draft-only function should have draft-only access. Ask for evidence that a denied action remains denied when a model requests it. Use [the approval matrix](/articles/ai-agent-approval-matrix) to distinguish draft acceptance from permission to act. Assign a backup reviewer so staff know how to handle an absent approver. ## Clause four: spending and changes Use a clause such as: Start paid AI work only within the approved function allowance. The budget owner must approve new paid functions, limit increases, and changes to the paying account. Name the person who receives warnings and the response expected. State what staff should do when a function pauses for budget or account reasons. Provide a manual path for urgent work. Require review before changing a function's model, data destination, connected tools, or external-action permissions. Include trials and fallback routes in that rule. An experiment should have its own bounded approval. Keep the approved configuration linked to the register. Staff should not have to decide whether a settings change is harmless while trying to finish a customer job. ## Clause five: records and corrections Use a clause such as: Save accepted business facts, decisions, and corrections in the designated company record. Keep required run receipts with the output. Follow the function's retention instructions. Name the location and owner of that record. Separate current decisions from draft suggestions. When a reviewer rejects an answer, preserve the correction and the affected source reference. Do not require staff to save every conversation forever. Specify what evidence each function needs and which records it should not copy. The [run receipt guide](/articles/receipt-is-part-of-the-output) gives that evidence a practical structure. Keep customer content out of general training examples unless an approved process permits its use. Link repeated errors to a correction and retest. The function owner should be able to distinguish a corrected draft from a corrected process. Teach reviewers how to report that difference. ## Clause six: mistakes, unexpected access, and incidents Use a clause such as: Stop the affected task when information goes to the wrong destination. Contact the named owner. Report unauthorized actions and access that appears broader than permitted. Give staff the exact reporting channel and backup contact in the issued policy. Ask them to preserve the run identifier, time, and a concise description. Tell them how to avoid copying sensitive material into a wider audience. Assign the response owner to determine containment, evidence handling, and any required notifications. Avoid a blanket instruction to delete everything immediately. Give that owner a process for deciding what must be preserved. Practice a harmless example. Confirm the employee can find the contact and identify the affected function without needing the original builder. ## Clause seven: exceptions and review Use a clause such as: Exceptions require a named approver, written purpose, permitted scope, expiry, and review. An exception does not change other data or action restrictions. Keep a register of approved exceptions beside the policy. Give each one an owner and a clear end condition. Remove expired access through the relevant account controls. Review the policy when approved functions, accounts, data uses, or responsibilities change. Train new staff before granting access. Include access removal in the handoff process when someone changes role or leaves. Keep the current version easy to find. Archive superseded versions with their dates so a reviewer can understand which instructions applied to an earlier run. ## Teach the policy through ordinary work Choose examples drawn from approved tasks, with invented customer details. Ask staff to identify the allowed source, required reviewer, and stopping point. One exercise could involve an incoming request containing an unnecessary private attachment. Another could involve a draft that proposes an unsupported promise. A third could ask what happens when the budget owner is unavailable. Use the answers to improve unclear instructions. If several employees misunderstand the same clause, revise the clause and the example. Keep a record of the change and update the affected runbook. The 10/80/10 method on [the AI systems page](/ai-systems) puts direction before the work and a human check after it. Use the policy to assign those responsibilities. Bring one function and its current rules to [the work scope form](/work). ## Related: Agent Governance - [The Complete Small-Business Guide to AI Agent Governance](/articles/ai-agent-governance-guide-small-business) - [An AI Agent Approval Matrix for Small Teams](/articles/ai-agent-approval-matrix) - [The Receipt Is Part of the Output](/articles/receipt-is-part-of-the-output) ---- ```text .|########||. .|########||. .|########||. |##||. .||##|. |##||. .||##|. |##||. .||##|. |#|. .|#|. |#|. .|#|. |#|. .|#|. |#| |#| |#| |#| |#| |#| .#| |#. .#| |#. .#| |#. .#. .#| .#. .#| .#. .#| |#. .#| |#. .#| |#. .#| |# ...... #| |# ...... #| |# ...... #| .# ||#########| #| .# ||#########| #| .# ||#########| #| .#. |######||######|. .#. .#. |######||######|. .#. .#. |######||######|. .#. #. .##|###|##|#|######| .# #. .##|###|##|#|######| .# #. .##|###|##|#|######| .# || |##|#||||||||||||#||#| || || |##|#||||||||||||#||#| || || |##|#||||||||||||#||#| || # |#||||||||||||||||||||#| #. # |#||||||||||||||||||||#| #. # |#||||||||||||||||||||#| #. || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || # .#||||||||||||||||||||||||#| # # .#||||||||||||||||||||||||#| # # .#||||||||||||||||||||||||#| # || ....|||#||||||##|#|||#|#||##||||....|. || || ....|||#||||||##|#|||#|#||##||||....|. || || ....|||#||||||##|#|||#|#||##||||....|. || #. . ....|# ....#||| ||| .#||| ....#. .# #. . ....|# ....#||| ||| .#||| ....#. .# #. . ....|# ....#||| ||| .#||| ....#. .# # . ||||#| .#####|| . .#| .#||| ||||# #. # . ||||#| .#####|| . .#| .#||| ||||# #. # . ||||#| .#####|| . .#| .#||| ||||# #. .| ||||| #. |#|||||. || #. |#||. .||||| || .| ||||| #. |#|||||. || #. |#||. .||||| || .| ||||| #. |#|||||. || #. |#||. .||||| || || |.... #. ....|#. |. ...|. ....|| || || |.... #. ....|#. |. ...|. ....|| || || |.... #. ....|#. |. ...|. ....|| || #. .||||||##||||||##||####|||||||#||||||#| .# #. .||||||##||||||##||####|||||||#||||||#| .# #. .||||||##||||||##||####|||||||#||||||#| .# # .||####|###########################|. # # .||####|###########################|. # # .||####|###########################|. # # .#||||||.#.|| # |. ..# #| #|||||#| # # .#||||||.#.|| # |. ..# #| #|||||#| # # .#||||||.#.|| # |. ..# #| #|||||#| # # .#|||||| .. |# ## |#| ...#|#|||#| # # .#|||||| .. |# ## |#| ...#|#|||#| # # .#|||||| .. |# ## |#| ...#|#|||#| # # .#|||#|# .# .#| #| ##|.#..#|||||#| # # .#|||#|# .# .#| #| ##|.#..#|||||#| # # .#|||#|# .# .#| #| ##|.#..#|||||#| # # .#||||||############|######|||||#| # # .#||||||############|######|||||#| # # .#||||||############|######|||||#| # # |...||#||||||#||||#|#||||||#|||||#||| |.| # # |...||#||||||#||||#|#||||||#|||||#||| |.| # # |...||#||||||#||||#|#||||||#|||||#||| |.| # #. .. ||||# .|||##|. |#| .|| || .|||#. #| # .# #. .. ||||# .|||##|. |#| .|| || .|||#. #| # .# #. .. ||||# .|||##|. |#| .|| || .|||#. #| # .# || | ...|| ...##| | #| .|. |. ##### .. .| || || | ...|| ...##| | #| .|. |. ##### .. .| || || | ...|| ...##| | #| .|. |. ##### .. .| || || ||||| || ||||#| . |. |. |#. ||||| |#| || || || ||||| || ||||#| . |. |. |#. ||||| |#| || || || ||||| || ||||#| . |. |. |#. ||||| |#| || || .# |.....#|....|#.||||.|||##.|#|....||.#||.#. #. .# |.....#|....|#.||||.|||##.|#|....||.#||.#. #. .# |.....#|....|#.||||.|||##.|#|....||.#||.#. #. #.|||||||#############################| ||| .# #.|||||||#############################| ||| .# #.|||||||#############################| ||| .# || ##||#||#||||||#||#||#||#||##. || || ##||#||#||||||#||#||#||#||##. || || ##||#||#||||||#||#||#||#||##. || # .#|||||||||#||#|||||||||||#| # # .#|||||||||#||#|||||||||||#| # # .#|||||||||#||#|||||||||||#| # || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || .# |#||||||||||||||||||||#| #. .# |#||||||||||||||||||||#| #. .# |#||||||||||||||||||||#| #. || |#||||||||||||||||||#| || || |#||||||||||||||||||#| || || |#||||||||||||||||||#| || #. .######|#|#########| .# #. .######|#|#########| .# #. .######|#|#########| .# .#. |#####||||#####| .#. .#. |#####||||#####| .#. .#. |#####||||#####| .#. |# ||########|| #. |# ||########|| #. |# ||########|| #. |# ...... #| |# ...... #| |# ...... #| |#. .#| |#. .#| |#. .#| |#. .#. |#. .#. |#. .#. .#| |#. .#| |#. .#| |#. |#| |#| |#| |#| |#| |#| .|#|. .|#|. .|#|. .|#|. .|#|. .|#|. |##||. .||##| |##||. .||##| |##||. .||##| .||########||. .||########||. .||########||. Scale With Search 2026 [scalewithsearch.com](https://scalewithsearch.com) ```