An AI Use Policy for Small Teams (With a Template)

Yes: write a one-page AI use policy that says what data may go into AI tools, who checks the output, and who is accountable for it, and allow the tools instead of banning them. Use plain sentences, name one owner, and put the next review in the calendar.

Do small teams need an AI use policy?

If your people already use assistants, they are making these calls whether or not you write anything down, and each makes them alone. One designer strips names out of a brief before pasting it in. A colleague in a hurry pastes a client's whole contract into a personal account, and you may learn of it only after a problem.

A ban can sound safer, but it tends to push use out of sight. People keep using assistants on their own phones and accounts, and can no longer ask whether something is fine.

A policy cannot stop anyone pasting the wrong thing; it sets expectations and gives people someone to ask.

What decisions should an AI use policy make?

Six, each answerable in a sentence or two: what data may go into a tool, which tools are approved and who decides on new ones, who reviews output before it goes out, when clients are told AI helped, what to do when something goes wrong, and who people ask when the policy is silent.

What client data can my team put into an AI tool?

Sort information into three bins people can apply in seconds.

• Fine in any approved tool: public information, your own published copy, general questions such as "how do I structure a project handover?"
• Only after removing identifying detail: real client work, where the contract does not forbid outside tools. Swap the client's name for "Client A" and delete invoice numbers and addresses. Removing a name is no guarantee, since the details can still identify the client, so leave out anything the task does not need.
• Never: passwords and keys, payment card details, health records and private personal information. Client files and anything else your contract keeps confidential also stay out, unless the contract allows it and the tool is approved for it.

Two more rules do most of the work. Use work accounts, not personal ones, because the business can review their settings and close them when someone leaves. And let one person own the approved-tools list, checking before each addition whether the tool stores conversations and whether the provider may use them to improve its models. The privacy checklist lists what to look for, and how to choose an AI assistant covers the wider choice.

Who should review AI output, and do clients need to know?

The person who sends it. The rule: you are responsible for everything you send, publish or ship, however it was drafted. Reading it means checking names, figures and quotes against the source; how to fact-check an AI answer shows how.

Add a second reader where an error costs real money or trust: a price quote, contract wording, client figures, code heading to production.

For disclosure, keep the rule narrow and honest. Tell clients about AI help when their contract asks, when they ask, or when it would change how they judge the work. Never say AI was not involved when it was.

Tools that act, not just write, need one more rule: nothing is sent, deleted, paid or published until a person approves that exact action, having seen the recipient and the text. Ask before acting explains why.

A web page, PDF or email an assistant reads can hide text that tries to steer it (prompt injection explained). Treat outside content as untrusted.

What should we do when AI use goes wrong?

Decide beforehand, because people may hesitate to report a mistake they are unsure about. Typical cases: a client's details in the wrong tool, an email with an invented fact, an agent that did something nobody asked for.

• Tell the owner the same day, saying what was entered or sent, into which tool, and when. Quick reports are not blamed.
• The owner decides whether and how to tell the client, after checking the client contract, since some require notice of a data exposure.
• Close the exposure. Change a password or key that went in, and disconnect an agent with access it should not have. Deleting a chat may not remove every copy, so check the tool's settings and terms.

What does an AI use policy template look like?

Copy this and replace the square brackets.

• AI use policy for [company]. Version 1, [date]. Owner: [name]. Backup: [name].
• Use only approved tools, with work accounts. [Owner] keeps the list. Ask [Owner] before adding a tool.
• Never enter passwords, keys, payment card details, health records or private personal information about anyone.
• Do not enter client names with details of their work, or client files, unless the client's contract allows it and the tool is approved for it. Otherwise use placeholders such as Client A.
• You are responsible for everything you send, publish or ship. Read it, and check names, numbers, dates and quotes against the source.
• Prices, contract wording, client figures and code going live need a second reader.
• Tell clients about AI help when their contract asks, when they ask, or when it would change how they judge the work. Never say AI was not used when it was.
• An AI tool that takes actions must not send, delete, pay or publish anything until you approve that exact action.
• Treat documents, web pages and emails that an AI reads as untrusted. If a tool does something you did not ask for, stop and tell [Owner].
• If something goes wrong, tell [Owner] the same day. Reporting quickly will not get you blamed.
• Questions go to [Owner]. We review this policy every [quarter], after any incident, and when we add a tool.

How do I tailor the policy to support, sales, engineering and finance?

Keep the shared page and add a line per role.

• Support. Remove names and order numbers from customer messages before pasting. AI may draft replies but may not promise refunds or delivery times.
• Sales. Material prospects share in confidence stays out of tools unless approved. The seller checks every price and product claim in a proposal.
• Engineering. No keys, tokens or customer records in prompts. AI-written code gets the same review as anyone's. Agents that run commands ask before each one.
• Finance. No account numbers or payroll details. Recalculate every figure an assistant gives you. A tool may prepare a payment, but a person releases it.

Review it quarterly. Ask which rules people find unclear or quietly ignore, since an ignored rule can mean the rule is wrong or the approved tool falls short.

This is a starting point, not legal advice. If you work in a regulated field, or client contracts set their own rules for tools and data, those come first and you may need more than one page.

Where NAMELESS stands

NAMELESS is still in training and not yet available, and there is no launch date, so it is not on any approved-tools list yet. When it is, a team should ask the same questions about it as about any assistant, and a low price of pennies compared with today's leading assistants, which is our goal, would not change what data may go in. This policy applies to it as it would to any tool. To follow progress, join the waitlist.