AI policy for employees: what a small business should cover

Staff in a small shop already use chat assistants to draft emails, rewrite product descriptions and summarize supplier terms. A short written policy tells them which tools they may use, what they must never type into one, and who checks the result before it leaves the building. Two pages that people read beat twenty pages that nobody opens.

This guide is general information for US businesses, not legal advice. Rules vary by state and by industry, so confirm anything that affects hiring, customer data or payments with a qualified adviser.

Why a small shop needs written rules

Without a written rule, each person decides alone what is safe to paste into a chatbot. One employee shares a customer complaint with the customer's name and phone number. Another asks an assistant to rank job applicants. Neither meant harm, and neither had been told where the line was.

An AI policy for small business keeps those decisions consistent and gives you something to train against. It sits beside your other operating rules, such as who can change prices or see staff records. For the wider picture of where AI helps with daily work and where it adds risk, start with AI for business operations.

What should an AI policy include?

Keep the list short enough that a new hire can read it on the first day. Most small businesses need eight parts:

1. The tools staff may use, and who approves a new one.
2. Information that must never go into an AI tool.
3. A check of every output before it reaches a customer or supplier.
4. When to tell people that AI wrote the text.
5. Decisions that stay with a person, including hiring and discipline.
6. Who answers questions and receives reports of mistakes.
7. Training and a signed acknowledgment.
8. An owner and a review date.

The sections below take each part in turn. If you would rather fill in the blanks, build and print your own with the free AI policy template.

Approved tools and who approves new ones

Name the tools by product and account type. "The business account of our chosen assistant, signed in with a work email" is clearer than "approved AI." Personal accounts and browser extensions often carry different data terms from a business plan, so say whether they are allowed.

Keep an approved AI tools list with four columns. Record the tool, the account it uses, what staff may use it for, and the person who approved it. Give one person, usually the owner or operations manager, the authority to add a tool. Before approving one, read its data and privacy terms, check whether you can turn off training on your inputs, and confirm who in the business can see shared conversations.

A request to add a tool should state the task it would help with. "Draft first versions of social posts" is a reviewable request. "Use it for everything" is not.

Information staff must never paste

This is the clause that prevents the most harm, so write it as a plain list rather than a principle. The table below is a starting point for a retail business.

Card data deserves its own line. PCI DSS, the card industry's security standard, applies to entities that store, process or transmit cardholder data. Pasting a card number into an outside tool sends that data somewhere your card security controls do not reach.

State privacy laws can apply too. According to the California Attorney General, the California Consumer Privacy Act (CCPA) applies to for-profit businesses doing business in California that meet any one of three tests. They have gross annual revenue over $25 million. They buy, sell or share the personal information of 100,000 or more California residents or households. Or they earn half or more of their annual revenue from selling that information. Many small shops fall below those thresholds, but other states have their own laws, and your customers expect care either way.

Tell staff what to do instead. Remove names and numbers, describe the situation in general terms, or ask a manager.

Check output before it reaches anyone outside

An AI assistant can state a wrong price, invent a return policy or misquote a supplier's terms with complete confidence. The policy should require a person to read every customer-facing or supplier-facing draft before it is sent or published, and to check facts against your own records.

Make the check specific. For a product description, the reviewer confirms size, materials, price and care instructions against the product record. For an email reply, the reviewer confirms that any promise about refunds, delivery or stock is one the business will keep.

Marketing claims need the same care. Section 5 of the FTC Act declares unfair or deceptive acts or practices in or affecting commerce unlawful. That applies to what your ads and product pages say, whether a person or a tool drafted them.

Disclosure when AI wrote the text

Decide when customers should be told. A reasonable rule is to disclose when a customer could think they are talking with a person, such as in an automated chat reply. Disclose as well when AI produced an image of a product or a person. Routine help with spelling or tone in a staff-reviewed email usually needs no label.

Write the wording you want staff to use so they do not improvise it. Check whether the platforms you sell on, or the states where you sell, set their own disclosure rules.

Hiring and HR decisions stay with a person

Can you use AI in hiring decisions?

Treat any AI screening or ranking as part of your hiring process, which employment law already covers. The EEOC's page on prohibited practices states that a test required of applicants must be necessary and related to the job. It adds that a neutral practice with a disproportionately negative effect on a protected group can be illegal unless it is job-related and necessary. A tool that filters resumes is one more practice measured against that standard.

The safest rule for a small shop is simple. AI may help write a job ad or organize interview notes, but a person reads every application and makes every hiring, pay, scheduling, discipline and termination decision. Do not paste candidate resumes or staff records into an unapproved tool.

Who to ask and how to report a mistake

Name one person for questions, with a backup when they are away. Staff should know that reporting a mistake early is expected and will not be punished. If someone pasted a customer's details into a tool, the useful response is to find out what was shared, delete it where the tool allows, and decide whether anyone needs to be told.

Training, sign-off and review

Walk new staff through the policy during their first week and ask them to sign an acknowledgment. Add it as a step on your onboarding checklist so it is not skipped. Run a short refresher when you approve a new tool or change a rule.

Set a review date, every six months or sooner after a change in your tools. The NIST AI Risk Management Framework is intended for voluntary use, and its generative AI profile is a useful checklist for the review even at shop scale.

Sample clauses you can adapt

These clauses form a short ai use policy for employees. Edit the names and tools to match your business.

1. Staff may use only the AI tools on the approved list, signed in with a business account.
2. The operations manager approves new tools after reviewing their data terms.
3. Never enter customer personal data, payment card data, staff records, passwords or confidential supplier terms into any AI tool.
4. A person reviews every AI-assisted draft for accuracy before it is sent to a customer or supplier or published.
5. Automated replies and AI-generated images shown to customers are labeled as such.
6. Hiring, pay, scheduling, discipline and termination decisions are made by a person.
7. Questions and mistakes go to the operations manager, or the owner when they are away.
8. Every employee reads and signs this policy during onboarding and after each change.
9. The owner reviews this policy every six months.

The clauses describe acceptable use of AI at work in terms staff can check themselves. If an assistant like ChatGPT is your main tool, the same list works as a chatgpt policy for employees; name the account and plan in clause 1. The ChatGPT guide for small shops covers practical uses inside those limits.

Keep the policy short and enforced

A generative AI workplace policy fails when it reads like a terms-of-service page. Short sentences, named people and a list of forbidden data do more than broad principles. Post the one-page version near the staff area and keep the signed copies with other employment records.

If you are still deciding which tasks to try first, the guide to a first AI trial walks through a low-risk start. Your employee AI guidelines can then grow with the tools you adopt.

Where headoffis fits

headoffis supports the operating side of the policy. Roles control who can see and change customer, staff and supplier records. Onboarding templates turn "read and sign the AI policy" into an assigned task with a date. See the employee permissions matrix for planning that access. headoffis costs US$29 per business per month, including five active people, then US$5 per additional person.

← All posts