A free template from Suncoast AI Lab. Fill in the blanks, cut what doesn't fit, and share it with your team. This is general information, not legal advice. If you handle health, financial or children's data, check your obligations with a lawyer or your IT provider.
Why this matters: in SHRM's Navigating AI in the Workplace 2026 survey (Mar to Apr 2026), only 36% of small organizations using AI had an AI use policy.
Effective date: ____________ Policy owner: ____________ Review again on: ____________
1. Why we have this policy
We use AI tools to save time on drafts, summaries and admin. We also hold information our customers and staff trust us to protect. This page says which tools we use, what never goes into them, and who checks the work.
2. Approved tools
Use only the tools below, signed in with your company account. Personal accounts are not allowed for work.
| Tool | Plan | Who has access | Training on our data turned off? (checked by, date) |
|---|---|---|---|
| ____________ | ____________ | ____________ | Yes / No, ________ |
| ____________ | ____________ | ____________ | Yes / No, ________ |
Want a new tool? Ask ____________ first. We check its data terms before anyone uses it.
3. What never goes into an AI tool
- Card numbers, bank account numbers, Social Security numbers
- Passwords, login codes, or security answers
- Health or medical details about anyone
- ____________ (add your own: client contracts, HR files, pricing you haven't published)
If you aren't sure, leave it out or remove names and numbers first. The FTC's advice for businesses is to keep only the personal information you need and to limit access to people who need it for their job (FTC, Protecting Personal Information).
4. A person reviews before anything reaches a customer
AI can draft. A person on our team reads and approves every email, text, quote, post or document before a customer sees it. AI can state wrong facts with confidence, so check names, prices, dates and anything with legal or money risk against the source.
Reviewer for customer-facing work: ____________
5. Accounts and offboarding
- Every AI account is a company account, set up by ____________.
- When someone leaves or changes roles, ____________ removes their access the same day, along with their other logins. (The FTC recommends ending a departing worker's passwords and access as part of the check-out routine.)
- We review who has access every ____________ (for example, every quarter).
6. Who to ask, and what to report
- Questions about this policy: ____________ (name, email or phone)
- Pasted something you shouldn't have? Tell ____________ right away. No blame. We'd rather know early.
7. Sign-off
I've read this policy and will follow it.
Name: ____________ Signature: ____________ Date: ____________
Going further: NIST's AI Risk Management Framework is a free, voluntary guide to managing AI risk (NIST AI RMF). Sources checked Oct 19, 2026. Want help setting this up with your team? Book a free 20-minute call: https://calendar.app.google/Zu5z1452ETQMycZr5. Suncoast AI Lab