How to write an AI policy for a small team, plus a one-page template

Updated October 20, 2026 · by Ashtin Dowler · 7 min read

An AI policy for a small team can fit on one page. It answers five questions: which AI tools people already use, what information is fine, needs a check, or is off limits, which tools and accounts are approved, when a person has to review AI work before it goes out, and who owns the policy. Write it in plain language, name one owner, and review it every three months. A copyable template is further down this page.

Questions to ask when drafting an AI policy

Use these as the outline for your first draft. The template below answers each one in a sentence or two.

Does a small team really need an AI policy?

If anyone on your team uses AI for work, yes, and they almost certainly do. In Microsoft and LinkedIn's 2024 Work Trend Index, 78% of AI users said they bring their own AI tools to work, and at small and midsize companies it was 80%. The same survey found 52% of people who use AI at work are reluctant to admit using it for their most important tasks.

That second number is the real reason to write a policy. When there are no rules, people don't stop using AI. They just stop mentioning it. A policy makes it normal to say which tools you use and what you put into them.

It's showing up in small businesses specifically, too. In Pax8's October 2026 survey of 1,150 businesses with 5 to 499 employees, 35% of those using AI had found tools, workflows or agents running without approval in the last six months.

A small team doesn't need a 20-page document or a committee. It needs one page that people actually read, and one person who keeps it current.

Step 1: Ask what people already use

Start with a short, no-blame question in your team chat: "Which AI tools do you use for work, and what do you use them for?" Make it clear nobody is in trouble. If asking gets people in trouble, you'll get the polite list, not the real one.

Write down every tool, what it's used for, and whether it's a work or a personal account. This list becomes the first section of your policy.

Step 2: Sort your information into three piles

This is the part people actually need day to day. Instead of a long list of rules, give everyone three piles:

• Fine. Public information, and your own drafts, notes and ideas.
• Ask first. Client names and details, internal numbers, and anything someone shared with you in confidence.
• Never. Passwords and logins, personal data about customers or staff, and files covered by an NDA.

Adjust the piles to your business. An agency might move client strategy documents into "ask first". A team that handles health or financial records will have a longer "never" pile, and should check what its industry rules require.

Step 3: Pick the tools and use work accounts

Name the AI tools that are approved for work. Then ask people to use company accounts rather than personal ones. Work done in a personal account leaves with the person, and you have no say over its settings.

Check each tool's data settings before people start. Some AI tools can use what you type to improve their models unless that setting is turned off, and the defaults often differ between personal and business plans. For ChatGPT specifically, our guide to ChatGPT connectors covers how training settings work on each plan.

Step 4: Decide when a person checks the work

AI can draft almost anything. The policy should say when a person reads it before it goes out. A simple rule that works for most small teams: a person checks anything going to a client, anything with a number in it, and anything legal. Internal brainstorms and first drafts can skip it.

Add one sentence that settles the question of responsibility: you own what you send, whoever drafted it.

Step 5: Name an owner and set a review date

Pick one person to own the policy. They keep the tool list current and answer "is this OK?" questions. On a small team this is often the founder, an ops lead or whoever already looks after the software budget.

Set a review every three months, because the tools change that fast. And include a line for mistakes: if something goes into a tool that shouldn't have, tell the owner the same day. You want to hear about it early, so make that easy.

A one-page AI policy template you can copy

Copy this into a doc, fill in the brackets, and share it with your team. It's meant to be edited, so change anything that doesn't fit how you work.

Mistakes to avoid

• Banning AI outright. It rarely stops people. It just moves the work to personal accounts where you can't see it.
• Writing it too long. If it doesn't fit on a page, people won't read it. Put the detail in a separate FAQ if you need one.
• Writing it once. A policy that names last year's tools tells people it doesn't really matter.
• Making it about punishment. If the only thing the policy says about mistakes is what happens to you, nobody will report one.

How AgentOS fits

Steps 2 and 3 are the hard part to keep up with. People end up pasting client files and background into whichever AI tool is open, because that's the only way to give it context.

AgentOS gives your AI tools that context without the pasting. You connect your email, chat, files, calendar and CRM once, and ChatGPT, Claude and your own agents work from the same company knowledge. You choose what each AI tool can see, and anything that goes out, like an email to a client, waits for a person to approve it. So part of the policy becomes a setting instead of something everyone has to remember.

To see what your team is spending across AI tools, try the AI spend calculator. For the bigger idea, read what a context layer is.

Questions people ask

Sources

• Microsoft and LinkedIn: 2024 Work Trend Index
• Pax8: small businesses are building AI faster than they can govern it (October 2026)

AgentOS is built by Devcore. Found something out of date on this page? Tell us at tryagentos.net and we'll fix it.