TL;DR
A small business AI policy is one page: which tools the team may use and on which accounts, what may and may not be pasted into them, who reads anything the machine writes before a customer does, how you tell customers an automated system is talking, and who owns each automation when it breaks. The templates that rank for this search are written for HR departments and run 10 to 20 pages. Ours is written for a 5 to 50 person company with a CRM, a phone system and a group text, and it is a free Word download in the contractor templates pack. No federal law requires a policy yet; the FTC's February 27, 2023 guidance on AI claims and NIST's voluntary AI Risk Management Framework are the two documents worth knowing, and the risk you are actually managing is a customer list pasted into a chatbot and a text that goes out wrong 200 times.
Nobody in a plumbing company reads a twenty-page policy, and the office manager who pasted the customer list into ChatGPT to "clean up the formatting" did not know she was doing anything wrong. That is the whole case for a policy at this size: not compliance theater, but five rules short enough to remember, with a signature line. This post walks through the ten sections of the template, what each one is for, the two government documents that matter, and the thirty-minute rollout. The download is at the end of the templates pack, as a Word file you can edit and a PDF you can print.
What the policy is protecting you from
Three things, in the order we see them.
Data leaving the building
Customer names with addresses, phone numbers, card details, insurance claim documents and employee pay records end up in a chat window because it is the fastest way to reformat them. Consumer AI accounts may use what you paste for training unless the setting is off, and the paste itself is a disclosure you cannot take back. The policy's job is a list of what never goes in, short enough to stick on the monitor.
The machine talking to customers unsupervised
An AI phone agent that quotes a price that is not on the rate card. A follow-up sequence that keeps texting a customer who already paid. Our own missed call text back fired "sorry we missed you" at about 200 callers who had just spoken to the owner, for 17 days, because one callback URL was wrong and nothing was watching; the story is in the missed call text back guide. A policy does not prevent the bug. It makes someone responsible for noticing.
Claims you cannot back up
"AI-powered" on the website, "our AI never misses a call" in an ad. The FTC said in its February 27, 2023 business guidance that it does not treat "artificial intelligence" as harmless puffery, that performance claims need evidence, and that a claim that holds only under narrow conditions is deceptive if the conditions are not disclosed. A one-line rule in the policy stops the marketing problem before it starts.
What the law requires at this size, honestly
As of October 2026 there is no federal law that requires a US small business to have an AI policy. Two documents matter anyway, and both are short enough to read.
- NIST AI Risk Management Framework 1.0, released January 26, 2023, voluntary, with four functions: Govern, Map, Measure, Manage. The generative AI profile followed on July 26, 2024. Nobody expects a roofing company to run the framework, but the template's ten sections map onto those four verbs, so if a commercial customer or an insurer ever asks whether you follow a recognized framework, the answer is yes and here is the page.
- The FTC's AI claims guidance, February 27, 2023, which governs what you say about AI in marketing and applies to a two-person shop the same as a software company.
State law is moving. Colorado passed the first comprehensive state AI act in 2024 and then pushed its effective date to June 30, 2026 while legislators amended it; whether it applies to you depends on what you use AI for and how many people you employ, and the answer changes by the session. The policy template leaves a line for "laws that apply to us" so you fill it in with your state and your lawyer, which brings up the obvious point: this is an operating policy, not legal advice. Our AI consulting work is operational; for the legal side, the template is something to hand your attorney, not a substitute for one.
The ten sections, and what each one is for
The template is numbered the same way. Every section has a filled-in sample for a fictional HVAC and plumbing company so you can see what "done" looks like, then replace it.
1. Purpose and who it covers
Two sentences. Why the policy exists and who signs it: employees, office staff, subcontractors with access to your systems, and the owner. The scope line names the tool categories: chat assistants (ChatGPT, Claude, Gemini, Copilot), AI features inside your CRM or field service software, AI phone agents and receptionists, transcription and note-takers, and anything that writes to a customer automatically.
2. Approved tools and accounts
A table: tool, who may use it, which account. The rule that does the work is that work happens on business accounts under the company email, never personal accounts, with data-sharing and training settings turned off where the tool offers them. The owner or a named person approves any new tool before it touches customer data. If you have not picked the shared platform yet, which AI platform to pay for walks the choice, and Claude for small business is where we land for an office.
3. What may go in, and what never does
The section people actually use, so it is a two-column card. Allowed: public information, your own marketing copy, generic how-to questions, job details with the customer's name and address removed, internal procedures. Never: a customer's name together with their address or phone number, card or bank details, Social Security or driver's license numbers, employee pay and HR records, passwords and API keys, photos of customer documents, insurance claim files, and anything under a non-disclosure agreement. The test the template gives staff: if it would be a problem to email this to a stranger, do not paste it.
| Fine to paste | Never paste |
|---|---|
| Public information about your company or a supplier | A customer's name together with their address or phone number |
| Your own marketing copy, website text, ad drafts | Card numbers, bank details, routing numbers |
| Generic how-to and code questions | Social Security, driver's license or passport numbers |
| Job notes with the customer's identifying details removed | Employee pay, HR files, performance notes |
| Internal procedures and checklists | Passwords, API keys, login links |
| Anonymized numbers for a report | Photos of customer documents, insurance claim files, anything under NDA |
| The test | If you would not email it to a stranger, do not paste it. |
4. Anything a customer reads gets a human first
The rule: a person reads anything AI wrote before it reaches a customer, unless it is a pre-approved template. Pre-approved templates are listed by name in the policy: the missed-call text, the appointment reminder, the review request. Anything else, a quote, a reply to a complaint, a proposal paragraph, is a draft until a named person sends it, and that person owns it.
5. Phone agents and automated texts
If you run an AI receptionist or phone agent, four lines: it works from an approved script, it does not quote prices beyond the rate card you gave it, it says it is an automated assistant when a caller asks, and it hands off to a human on a defined list of triggers (an emergency, an angry caller, a request for a person). The AI receptionist guide covers what the products can and cannot be told to do.
6. Accuracy and who owns the answer
AI output is checked against the source for anything with a number or a code in it: prices, building codes, permit requirements, warranty terms, insurance language. The person who sends it is responsible for it. The template says this in one sentence because that is how long it needs to be.
7. Telling customers the truth about it
Two rules. Customers who ask whether they are talking to a person get a straight answer. And marketing claims about AI are true and provable, which is the FTC line above in plain words: no "AI-powered" on a website that uses a chat widget, no "never misses a call" unless you can show it.
8. Security
Multi-factor authentication on every AI and CRM account. No shared logins. No company credentials pasted anywhere. And one line that did not exist in policies three years ago: a voice on the phone asking to change a payment account or wire money is verified by calling back a known number, because cloned voices are now cheap. That one line is the single most valuable sentence in the document for a company that pays suppliers.
9. Records
Customer messages drafted or sent with AI stay in the CRM like any other message, and the existing retention rule applies. Nothing customer-facing lives only in a chat window's history.
10. Who owns it, and the monthly test
Every automation has a named owner. Each one gets tested once a month from a phone that is not in the CRM, and the result goes in a shared note. When something breaks, the owner is told that day, not when a customer complains. This is the section that would have caught our 17-day text-back bug on day one, and it is the section every HR-written template leaves out, because HR departments do not run the phone system.
Then a signature block with a name and a date, plus one line that says the signer has read the paste rules. The whole thing prints on two pages, with the paste card on its own page for the wall.
Download the policy as a Word file
All ten sections written out for a sample company, the paste card, the signature block, plus the invoice, estimate, agreement and business plan templates in the same pack. One email, every file.
Rolling it out in thirty minutes
- Fill in the tool table and the approved template list. That is the only part that needs the owner.
- Read the paste card out loud at the next office meeting. Ask for one example of something each person has pasted this month. Somebody will name the customer list.
- Turn off training and data-sharing settings on each business account, together, on a screen share. Five minutes per tool.
- Name the owner of each automation on the list in section 10 and put the monthly test on a calendar.
- Collect signatures. Add the policy to the new-hire checklist so it is not a one-time event.
If the honest answer to step one is that there is no tool table because nobody has picked a platform, start with the AI readiness scorecard; the policy is the Risk area of that assessment, and a company that scores under 40 overall should fix the customer list before it writes rules about chatbots. The readiness assessment guide explains the order.
Three to skip
Banning AI. The office will use it anyway, on personal accounts, where you cannot see the settings. A policy that says "approved tools, business accounts, these rules" gets followed; a ban gets routed around.
A twenty-page policy. The templates written for enterprises cover algorithmic bias review boards and model governance. None of that applies to a company whose most advanced AI is a text-back and a chat assistant. Length is how a policy stops being read.
A policy with no owner. Section 10 is the one that matters, and it is the one most templates do not have. If nobody is named, the policy is a document; if someone is, it is a habit.
Want the policy and the tools set up together?
The AI and Automation Coaching Sprint is four live sessions, $1,000, with your team: the platform decision, the settings, the policy, and the first two automations you build yourselves. For a done-for-you version, start with a strategy call.
Frequently asked questions
Does a small business need an AI policy?
No law requires one as of October 2026, but any business where staff use AI tools with customer data should have the one-page version: approved tools and accounts, what never gets pasted, human review of customer-facing output, a disclosure rule, and a named owner for each automation. The cost is thirty minutes; the alternative is finding out what was pasted after the fact.
What should an AI policy for employees include?
Purpose and scope, approved tools and accounts, what may and may not be entered into AI tools, human review of anything customers read, rules for phone agents and automated texts, accuracy and ownership, disclosure to customers, security including payment-change verification, records, and a named owner with a monthly test. The free template covers all ten with a filled-in sample.
Is this AI policy template legal advice?
No. It is an operating policy written by an automation agency for companies under 50 people. The section on laws that apply to you is left for your state and your attorney, and the template is something to hand them rather than a substitute.
What does the FTC say about AI claims?
In business guidance published February 27, 2023, the FTC said it does not treat "artificial intelligence" as puffery: performance claims need evidence, comparisons to a non-AI version need data, and claims that hold only under limited conditions are deceptive if the limits are not disclosed. The policy's disclosure section turns that into one rule for your marketing.
What is the NIST AI Risk Management Framework, and do I need to follow it?
A voluntary framework released January 26, 2023 with four functions: Govern, Map, Measure and Manage. A small business does not need to implement it, but the template's sections map onto those functions, so a commercial customer or insurer who asks about a recognized framework gets a straight answer.
Can employees use ChatGPT on personal accounts for work?
The template says no. Work happens on business accounts under the company email with training and data-sharing settings off, so the owner can see what is in use and switch it off when someone leaves. A personal account is invisible to the business and keeps the data when the employee goes.