A useful AI acceptable-use policy for employees should answer practical questions at the moment someone is about to use a chatbot or other AI tool: Is this tool approved? What information can I enter? Who checks the result? What do I do if I make a mistake?
If the rules are hard to find or full of vague warnings, employees may work around them or make assumptions. Keep the policy short enough to use, explain it with job-specific examples, and give staff a simple way to ask for help. For a broader look at protecting business information, see these data protection considerations for small businesses.
Start with a clear purpose and a few boundaries
Describe why the business permits AI use. For example, employees may be able to use approved tools to draft general material, organize non-sensitive notes, or brainstorm ideas. Explain that AI is an assistant, not the person accountable for a decision, customer communication, or finished work.
Then state the core rule in plain language: use only tools on the company’s approved list, and do not enter confidential or personal information unless the specific tool and task have been approved for that information. Avoid relying on a broad phrase such as “use good judgment.” Add examples so people know what the rule means in daily work.
- Potentially suitable for approved tools: public-facing material, generic drafting prompts, or fictional examples that contain no real customer or business details.
- Restricted unless specifically approved: customer or client records, employee information, financial details, health information, confidential client materials, passwords, access tokens, and internal business plans.
- Never share: login credentials or other secrets that would let someone access a business account or system.
Make clear that removing a person’s name may not be enough to protect privacy if other details could identify them. When a task can be completed with a fictional or thoroughly anonymized example, use that instead of real records.
Make tool approval easy to understand
A ban on “unapproved AI” is incomplete if employees cannot tell what is approved or how to request a tool. Assign an owner, such as a designated manager or IT contact, and publish a current approved-tool list in a place employees already use. Include the tool’s permitted business purpose and any limits on the information that may be entered.
Before approving a tool, the reviewer should understand the proposed use, the types of information involved, and the provider’s relevant privacy and security terms. Ask the provider whether prompts and uploaded files are stored, how long they are retained, whether they are used to improve or train models, and what controls are available. Also check who can access business data, how it can be removed, and whether the tool fits the business’s existing security practices.
Record the decision and its boundaries. An approval for drafting public marketing copy should not automatically allow the same tool to process customer files. Give employees a clear route to request a review when a new tool or use case comes up. A practical IT planning discussion for small companies can help connect tool choices to business needs and existing safeguards.
Give employees task-specific guidance
General rules become more useful when staff can picture how to apply them. Include a few examples that match actual jobs in the business, and explain what to do instead when a task involves restricted information.
- Drafting: An employee can ask an approved tool to help outline a general announcement. They should not paste an unreleased business plan or confidential customer correspondence into the prompt.
- Summarizing: Use only a tool approved for the information in the source material. If it is not approved for customer records, use a synthetic example or summarize the material without exposing identifying details.
- Research and recommendations: Treat AI output as a starting point. Check important facts against reliable source material and ask the appropriate person to review recommendations before acting on them.
- Customer or client work: Do not use identifiable information unless the business has specifically approved that tool and use. If the work is subject to professional, contractual, or industry requirements, have the responsible lead confirm the safeguards first.
For healthcare work involving protected health information, do not enable a use until the designated privacy or compliance lead has confirmed the applicable safeguards, including whether a business associate agreement is required. For Florida law firms, have responsible counsel review proposed use with client confidentiality in mind; the Florida Bar’s Ethics Opinion 24-1 is a relevant reference.
Require a human to check AI-generated work
Employees should know they are responsible for what they submit, publish, or send, even when AI helped prepare it. Require a review that matches the risk of the task. At a minimum, the reviewer should check that the facts are supported, the content answers the real question, confidential information has not slipped into the output, and the final work is appropriate for its audience.
For important decisions or customer-facing material, identify who is authorized to approve the final result. The policy should also say when AI output must not be used without specialist review. The NIST Generative AI Profile can provide additional context for organizations assessing generative AI risks.
Include a calm response to accidental disclosure
Employees should report a mistake promptly, without trying to quietly fix it or deciding on their own that it is harmless. Make the contact easy to find, name a backup contact, and explain that early reporting helps the business assess what happened.
- Stop entering information into the tool. Do not submit more prompts containing the same data.
- Notify the named internal contact as soon as possible, using the business’s stated reporting channel.
- Record what information was shared, which tool and account were used, and when it happened. Preserve relevant details securely, following the business’s instructions.
- Let the designated response lead assess the provider’s retention and deletion options, who may have access, and any further response or notification steps.
Do not promise employees that a provider can erase information unless that has been verified. Florida businesses can have the appropriate staff assess applicable responsibilities using resources such as Florida Statutes Section 501.171. The policy should direct staff to report concerns, not make legal conclusions themselves.
Help the policy become a habit
Introduce the rules in plain language and make the approved-tool list and reporting contact easy to locate. Use examples drawn from employees’ actual tasks, invite questions, and explain how staff can suggest a new tool. Review the policy when the business changes tools, workflows, or the kinds of information employees handle.
A short policy people can find and follow is more useful than a long document that leaves everyday decisions unclear. If you are shaping AI rules alongside broader security practices, review these cybersecurity considerations for small businesses.
Frequently asked questions
Can employees use AI with customer or client information?
Only when the business has specifically approved the tool and use for that type of information, and the required safeguards are in place. Otherwise, use a fictional or anonymized example that does not expose the customer or client.
How can a business check whether a provider uses prompts for training?
Review the provider’s terms and settings, and ask directly how prompts and uploaded files are stored, retained, accessed, and used. Record the answer and confirm that the approved configuration matches the business’s intended use.
What should an employee do after sharing sensitive information?
Stop submitting information, report the incident promptly through the designated channel, and provide the details needed for review. The assigned response lead should assess next steps.
How should employees verify AI-generated work?
Check important facts against reliable sources, confirm the work fits the task and audience, and review it for privacy issues. Follow any additional approval requirements for sensitive or high-impact work.
Conclusion
Build the policy around clear tool approvals, concrete data examples, human review, and a straightforward incident-reporting path. Make it easy to find and revisit as your business’s use of AI changes. For a practical next step, contact Daytona IT Support to discuss your business technology needs.