An AI use policy for small teams, with a template

November 10, 2026 · 5 min read

An AI acceptable use policy for a small team fits on one page: which tools are approved, what data never goes in, who checks the output, how to report a mistake, and when the policy is reviewed. Australia’s National AI Centre published a template in April 2026; the one below follows its six checks and adds what the UK’s NCSC, the ICAEW, and NIST recommend.

An AI use policy for a small team

Write down five things before anyone uses AI for client work: the approved tools, the data that never goes in, who checks the output, how to report a mistake, and when you will review the rules. That is the practical end of the rules for using AI at work, and it is what Australia’s National AI Centre asks in its guide to creating an AI policy: permitted and prohibited uses, who approves riskier ones, what data staff can put into tools, when to supervise, how to report problems, and a review date.

A small team does not need a long document. It needs rules that everyone has read, that match the tools people actually use, and that make it easy to admit a mistake.

Why bother

People use AI tools whether or not there is a policy. The UK’s NCSC calls this shadow AI: data given to a consumer service may be stored, kept, or used to improve it, outside the business’s control. Its advice is not to ban AI but to reduce the risk, with approved tools that meet people’s needs and a culture where they can say what they use. Regulators of professions expect the same: the ICAEW says it expects accountancy firms to have generative AI policies, reviewed regularly, with training for staff.

What the policy should cover

Section	What to write
Scope	Who it covers (staff, contractors) and which tools, including AI built into other software
Owner	One named person who approves tools and answers questions; everyone stays responsible for their own work
Approved tools	The list, and the rule that client work uses business accounts only
Uses	What is fine (drafts, summaries, ideas) and what needs approval (anything that decides about a person)
Data	What never goes in, what goes only into approved business tools, and what is fine anywhere
Checking	A person reviews every output before it is used or sent; facts, figures, and quotes are checked at the source
Clients	When clients are told, and where consent is needed under your professional rules
Reporting	Who to tell about a mistake, a leak, or a strange result, without blame
Training	At onboarding and whenever a tool changes
Register and review	A list of tools with their owner and approval date, and the next review date

These sections follow the National AI Centre’s six checks, the governance function of the NIST AI Risk Management Framework, which includes an inventory of AI systems, roles, and training, and Canada’s Cyber Centre, which recommends a plan and a usage policy for generative AI.

A sample policy you can copy

Adapt the names, tools, and dates. This is a starting point, not legal advice.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
AI USE POLICY - [Business name] - version 1, [date]

1. Scope. This policy covers everyone who works for [Business name],
   including contractors, and every AI tool we use, including AI
   features inside other software.
2. Owner. [Name] approves AI tools, keeps the list below, and answers
   questions. Each of us remains responsible for our own work.
3. Approved tools. [Tool, plan, account type]. Client work only on
   business accounts with model training turned off.
4. Uses. Fine: drafts, summaries, research, ideas, formatting.
   Ask [Name] first: anything that decides about a person, such as
   hiring or pricing for a specific client.
5. Data. Never: health data, passwords, bank and card details,
   ID numbers, privileged or NDA-protected material.
   Approved business tools only: client documents and personal data.
   Anywhere: public information and our own text without client details.
6. Checking. A person reads every output before it is used or sent.
   Facts, figures, quotes, and references are checked at the source.
7. Clients. We tell clients how we use AI when [our rules/contract]
   require it, and ask for consent when needed.
8. Mistakes. If you paste something you should not have, or see a
   wrong or strange result, tell [Name] the same day. No blame.
9. Training. Everyone reads this policy and tries the approved tools
   in their first week.
10. Review. Next review: [date, six months from now] or when we add
   a new tool.

Making it stick

Go through the policy in a 30-minute team meeting rather than sending it by email, and ask each person which tools they already use. Add those you approve to the list, and explain why the others are not on it. Review it twice a year: tools, plans, and data settings change faster than most policies.

Three mistakes to avoid

Banning AI outright. The NCSC’s point about shadow AI is that people then use it anyway, on personal accounts you cannot see.
Copying a long corporate policy. Nobody in a team of five reads 12 pages; one page that matches your tools works better.
Forgetting AI inside other software. The National AI Centre’s register includes AI built into tools you already use, such as customer relationship or HR software.

The data rule in detail

Section 5 is the hardest to get right. Our page on client information and AI explains the reasoning behind the three levels.

Business accounts and what they reveal

Requiring business accounts also gives the administrator access to conversations. See what an employer can see in AI accounts, and tell your team.