In many businesses, AI tools are already in use, but nobody talks about it. Someone in sales pastes a proposal text into a chat tool, someone in accounting has a table summarized, a designer generates images, a manager has meeting notes summarized. It is all done with good intentions and to save time; but in most places nobody knows which information entered which tool, who checked the output and whether the brand’s voice was protected.
In this article we explain how to write a one-page AI usage policy for your business: why it is needed, which three sections it should have, how to set up data and output rules and a 10-point template you can copy and adapt. The article is not legal or regulatory advice; in doubtful cases on personal data and contracts we recommend that you apply to your legal adviser.
Why Is a Written AI Policy Needed?
When there is no rule, every employee makes their own. Pasting a customer list into a free tool opened with a personal account, having a contract draft summarized, or sending a figure written by AI to a customer without checking it is usually done not out of bad intent but out of ignorance. And when a problem arises, the answer comes: “nobody told me this was forbidden”.
A written policy does three jobs. It protects data: it sets which information can enter which tool. It protects quality: it accepts that the output can be wrong and defines who is responsible for checking it. It protects the brand: it prevents different people writing in different tones and the brand voice scattering. A fourth benefit can be added: because the team knows what it may do, it uses the tools without hesitation and more efficiently.
The policy should not be a list of prohibitions. The aim is not to block AI; it is to use it safely and repeatably. We described how a policy can be part of a consulting engagement in what AI consulting is.
The Three Parts of the Policy: Data, Output and Responsibility
A one-page policy is both short and functional if it has three sections:
1. Data. Which information can enter which tool? Which information never enters any tool? Which tools are approved?
2. Output. How is text, a figure or an image produced by AI checked? Who approves it? Which steps does it pass through before going to a customer or the public?
3. Responsibility. Who is responsible for the result? Whom do you tell when there is a doubt or an error? How often are the rules reviewed?
These three sections are enough for most businesses. In larger and regulated sectors (such as health, finance and law), additional restrictions and sector-specific rules may be needed.
Data Rules: What Is Entered and What Is Not?
The most important risk in using AI is data. A practical method is to divide information into three colors:
| Level | Example | Rule |
|---|---|---|
| Green | Public information, general ideas and draft production, non-sensitive text you wrote yourself | Free in approved tools |
| Yellow | Anonymized internal information, a draft proposal text, a summary of internal correspondence | Only in tools with a corporate contract or with checked data settings |
| Red | Customers’ personal data, contract texts, passwords and access details, financial statements, health information, trade secrets not yet disclosed | Never entered into any AI tool |
Pay attention to two points when applying this table. First, read the tool’s data settings: in some tools the use of inputs for model training can be the default, in others it can be switched off. Tools with a corporate contract often give clearer assurances. Second, in jobs involving personal data, anonymize the data where possible: remove names and contact details and use only the part the job needs. For obligations under personal data protection legislation, apply to your legal adviser.
Also list which tools are approved. To evaluate the free tools your team has, the article free AI tools for businesses gives a start; for jobs with high data sensitivity, options with a corporate contract should be considered instead of free tools.
Output Rules: Who Checks What, and How?
AI can give a fluent but wrong answer; it can invent figures, dates, regulations and quotations with confidence. That is why the basis of the output rule is human checking.
- Figures, dates and quotations are verified against their source before being published or sent to a customer.
- Content on regulation, law, health and finance is used only as a draft; it is not published without an expert’s check.
- Texts that go to customers are read and owned by the sender; “AI wrote it” is not a defense.
- Image and video outputs are checked for compliance with brand rules, the rights of others and terms of use.
- For critical work, whether AI was used is kept in an internal record; that way it can be traced when a problem arises.
Write who will approve the output as a role: “the person who prepared the text”, “another team member” or “the manager”. Even in small teams a second pair of eyes catches many errors. We described the counterpart of this logic on the ad creative side in AI-assisted ad creative production.
Brand Voice and Shared Templates
If everyone writes with their own prompt, the brand speaks in different voices: one e-mail friendly, one proposal formal, one social media text exaggerated. To prevent this, add a brand voice section to the policy:
- Describe the brand’s tone in three or five sentences (friendly but respectful, short sentences, no exaggeration, for example).
- Write the expressions that must not be used (ranking guarantees, unprovable claims such as “the best”).
- Prepare shared prompt templates for frequent jobs: a proposal draft, a first reply to a customer, a meeting summary, a social media text.
- Keep the templates in a single place everyone can reach and update the ones that work.
Shared templates provide consistency and also help a new employee work productively with the tool from the first day. We covered where AI will help in areas like the first reply to customers in AI-powered customer service chatbots.
A One-Page Policy Template: 10 Points
You can adapt the template below to your business:
- Approved tools. Only the AI tools approved by the business are used. Someone who wants to try a new tool tells the manager first.
- Red data. Customers’ personal data, contract texts, passwords, financial statements, health information and undisclosed trade secrets are never entered into any AI tool.
- Yellow data. Internal information is used anonymized and only in tools whose data settings have been checked.
- No personal accounts. Accounts opened with a personal e-mail are not used for business data; tools are opened with a business account.
- Verification. Figures, dates, regulations and quotations are verified against their source before being published or sent to a customer.
- Human approval. Every piece of content that goes to a customer or the public, even if prepared with AI, is read and owned by the sender.
- Brand voice. Shared templates and tone rules are used; output that breaks the brand voice or contains unprovable claims is corrected.
- Work not to be done. Hiring or firing decisions, legal, medical and financial advice, and binding commitments on the customer’s behalf are not left to AI.
- Record and notice. For critical work, AI use is kept in an internal record; if there is an error or a data doubt, the manager is told at once.
- Review. The policy is updated at least every six months and whenever a new tool or a new risk appears.
Instead of copying the template as it is, change it for your own sector: in regulated fields such as health, finance or law, additional points and an expert’s check are needed. A policy that runs past one page is read by nobody; it matters that it stays short and clear.
For Which Work Should AI Not Be Used?
AI is not suitable for every job. In your policy you need to leave some jobs explicitly to human decision:
- Hiring and firing decisions. Decisions that directly affect people should not be left to AI; at most it can help collect information.
- Legal, medical and financial advice. In these fields AI output does not replace an expert’s assessment.
- Binding commitments to a customer. Commitments such as price, delivery time or contract terms are approved by a human.
- Sensitive customer correspondence. Complaints, objections and communication in a crisis should be handled carefully and by a human.
- Reports whose accuracy is critical. The figures in management and official reports are taken from the source system, not from AI.
This distinction is not hostility to AI; it clarifies the safe area of use. You can find the general place of AI in marketing in AI marketing, and the new questions brought by autonomous agents in what agentic AI is.
Pilot and Measurement: Do Not Roll Out a Policy Untested
Writing a policy on paper is easy; to see whether it works, run a small pilot. A typical flow is:
- Inventory: Write in a table which tools are used in the team, which jobs take time and which data is sensitive.
- Pilot: Choose the two most repetitive and least risky jobs (a meeting summary and a first-reply draft, for example), set up an AI-assisted flow and try it for two weeks.
- Policy and training: Work what you learned from the pilot into the policy; present it to the team in a half-hour session.
- Measurement and decision: Measure the pilot’s effect on time and quality; decide which jobs to roll out, change or drop.
A few simple indicators are enough for measurement: the time to complete the job, the number of errors that needed correction and the first response time to customers. We described how to measure first response time in how to measure and shorten the first response time to incoming requests, and how to plan the team’s weekly load in a 5-hour weekly digital marketing routine for SMEs. Promising a fixed saving would not be right; the gain varies with the business, the job and the tool.
Common Mistakes
- Making the policy only a list of prohibitions. Prohibitions push the team away from tools and increase hidden use; the safe area of use also needs to be shown.
- Writing the policy and not explaining it to the team. A document that is not read is not a rule; it should be supported by a short training and examples.
- Depending on a single tool. For critical jobs, an alternative tool and a manual backup plan should be left.
- Not checking output. Publishing without checking information where accuracy is critical, such as figures and regulation, is the most common mistake.
- Working with personal accounts. Personal accounts for business data are risky for both security and continuity of access.
- Not updating the policy. Tools and their settings change constantly; a policy written years ago is out of date.
- Trying to leave everything to AI. It is healthier to start with the most repetitive and least risky jobs and roll out what works.
What Does Soft Ajans Do in AI Consulting?
In our AI consulting service we determine where, with which tools and under which rules AI will be used in your business. We start with an opportunity and process analysis, compare ready tools for the chosen jobs by need, budget and data state, and put prompt templates and check steps into writing. We clarify which information can enter which tool, who will check the output and for which jobs AI will not be used, and turn this into a one-page usage policy that everyone on the team can reach; we give your team a short training and measure the result of the pilot together.
We do not give magic results or a guarantee of savings; developing custom software or an AI model, in-house software integration and infrastructure setup are also outside our scope. Consulting is not always needed either: if your team is small, you have a few repetitive tasks and you do not work with customer data, trying a tool yourself for a few weeks is often enough; in that case we say so openly. If how your brand is mentioned in AI answers matters to you, see our GEO consulting page, and for AI-assisted workflows in digital marketing, our digital marketing service. To see the state of your digital assets, you can request a free pre-analysis.
Frequently Asked Questions
Does a small business need a written AI policy?
Often a short page is enough, but having it in writing matters. If you work with customer data or if more than one person uses different tools, a policy reduces mistakes and the risk of data leaks. Even in a one-person business it is useful to write down which information never enters any tool.
What information should employees not enter into tools like ChatGPT?
Customers’ personal data, contract texts, passwords and access details, financial statements, health information and undisclosed trade secrets should not be entered. In doubtful cases the information should be anonymized or not given to the tool at all. For personal data protection legislation, apply to your legal adviser.
What is the difference between a tool with a corporate contract and a free tool?
Tools with a corporate contract generally offer clearer assurances and settings on data use, storage and access. In free tools whether inputs are used in model development varies with the tool and the setting. If you work with sensitive data, read the tool’s terms and consider corporate options if needed.
Who should check AI output?
The person who prepared the text does the first check; figures, dates, regulations and quotations are verified against their source. In content that goes to customers or the public, it is a good habit for a second person to take a look. Responsibility lies with the person who sends the content.
How often should I update the policy?
At least every six months and whenever a new tool, a new setting or a new risk appears. Because tools and data terms change quickly, the policy needs to be a living document.
Is it mandatory to get consulting for an AI usage policy?
No. You can adapt the template yourself. Consulting becomes meaningful if your data sensitivity is high, if several teams use different tools or if you want to support the policy with measurement and training.
