What to Include in an AI Usage Policy for Your SME

Many SME employees are already using AI tools at work, often before the business has agreed how they should be used. An AI usage policy does not need to be long or legalistic. A clear one-page document gives staff the confidence to use AI productively while protecting business and customer information.

1. Approved tools

List the AI tools staff may use for work, and state that personal or free accounts should not be used with company information. Where possible, favour tools provided through business accounts you already manage, so access can be controlled and removed when staff leave.

2. Information that must never be entered

• Customer and employee personal data.
• Financial records, pricing and payroll information.
• Contracts, legal documents and commercially sensitive proposals.
• Passwords, system credentials and internal security details.

Linking this section to your existing obligations under the Personal Data Protection Act (PDPA) helps staff understand why it matters.

3. Acceptable uses

Give practical examples of where AI is encouraged, such as drafting emails, summarising non-confidential documents, brainstorming ideas and preparing first drafts of marketing content. Examples are more useful to staff than abstract rules.

4. Responsibility for AI output

AI-generated content can be inaccurate or incomplete. The policy should state that the person using the tool remains accountable for checking facts, figures and tone before anything is shared with customers or used to make decisions.

5. Ownership and requests for new tools

Name one person responsible for the policy and for approving new tools. This prevents teams from signing up for overlapping subscriptions and gives staff a clear route to request tools that would genuinely help their work.

6. Review cadence

AI tools and their terms of use change quickly. Review the policy every six to twelve months, and whenever a significant new tool is adopted.

Common mistakes to avoid

• Writing a policy so restrictive that staff quietly ignore it.
• Banning AI entirely, which tends to push usage onto unmanaged personal accounts.
• Publishing the policy without explaining it to staff.
• Never revisiting the approved tools list.

The takeaway: A good AI usage policy is short, specific and practical. It tells staff what they can use, what they must protect and who to ask — turning AI from an unmanaged risk into a governed productivity tool.