The One-Page AI Acceptable Use Policy I Give Clients (2026): Approved Tools, Three Data Classes, One Sign-Off Rule

TL;DR: Your team is already using AI at work. The question is whether it's on accounts you control. A one-page AI acceptable use policy fixes that with three parts: the approved tool, named in the first line (the business-tier plan you actually pay for, like ChatGPT Business, Claude Team, Microsoft 365 Copilot, or Gemini in Google Workspace); three data classes, green, yellow, and red; and one sign-off rule, where a person approves anything AI-written before it reaches a customer. The full template is below. Copy it, fill in the blanks, and get it signed this week. Prices and vendor terms are as of September 2026.

Why enterprise AI policy templates don't fit a small business

Search for an AI acceptable use policy template and you'll find good documents written for a different company. The pages that rank come from security vendors, a state IT department, a university consultancy, and a legal publisher. They cover risk committees, procurement reviews, and model audits. They're built for an organization with a security team and a legal department.

A 12-person company has neither. What it has is an office manager pasting a customer's paperwork into a free chatbot because it's faster, and an owner who finds out six months later. If a policy takes longer than two minutes to read, nobody follows it. A policy nobody follows is decoration.

So the version I give clients fits on one page and does three jobs. It names the tool, sorts the data, and puts a person in front of anything that leaves the building.

Shadow AI: your team is already using it

Shadow AI is employees using AI tools for work without the company knowing or approving them. Personal ChatGPT accounts. Free browser extensions that read your inbox. AI note-takers someone added to client calls. AI features switched on inside apps you already pay for.

The pages that rank for "shadow AI" are mostly security vendors, and their answer is detection software. For a company of 5 to 50 people, the cheaper fix is boring: pay for the tool. People use personal accounts because the company never gave them a good one. Ban AI without an alternative and the pasting moves to their phones, where you'll never see it.

Here's what the approved alternative costs as of September 2026:

• ChatGPT Business: $20 per user per month billed annually, $25 monthly, 2-user minimum, and no training on your business data by default, per OpenAI. The seat math is on ChatGPT Business pricing.
• Claude Team: $20 per seat per month billed annually, $25 monthly, for teams of 2 to 150.
• Microsoft 365 Copilot Business: $21 per user per month on an annual subscription ($18 for annual subscriptions bought July 1 to December 31, 2026), added to a Microsoft 365 business plan.
• Gemini in Google Workspace: included in the business plans, which run $7, $14, or $22 per user per month with a one-year commitment.

For a 10-person team that's about $200 a month, or nothing extra if the Gemini in your Workspace plan does the job. Compare that to a customer's information sitting in an account that walks out the door with the employee.

The one-page AI acceptable use policy template

Copy everything between the two lines. The blanks are in brackets.

[Company name] AI Acceptable Use Policy

Effective: [date]. Owner: [name]. Next review: [date six months out].

1. Approved tools. Company work goes into [ChatGPT Business / Claude Team / Microsoft 365 Copilot / Gemini in Google Workspace], signed in with the company account we give you. That is the only approved AI tool for company work. Personal AI accounts, free or paid, are for personal use. Want to use a different AI tool, browser extension, or meeting note-taker for work? Ask [owner] first. You'll get an answer within five business days.

2. Three data classes.

• Green: public. Anything already on our website, in our marketing, or that you'd be fine posting publicly. OK in any approved tool.
• Yellow: internal. Drafts, internal documents, meeting notes, our pricing and processes, and customer names and conversations. Approved tools only, signed in to the company account. Never in a personal account.
• Red: restricted. Social Security numbers, bank and card numbers, health information, passwords and API keys, employee HR and payroll records, and anything a contract or NDA says we can't share. Not in any AI tool unless [owner] has approved that specific use in writing.

3. One sign-off rule. AI drafts, a person approves. Nothing AI-written goes to a customer, gets published, gets signed, or moves money until the person sending it has read all of it and would stand behind it as if they wrote it. The only exception is an automated workflow [owner] has approved in writing after it ran cleanly under review. "The AI wrote it" is never the explanation.

4. If something goes wrong. If Red data went into an AI tool, or an AI tool did something it shouldn't have, tell [owner] the same day. Reporting a mistake never gets you in trouble. Hiding one does.

5. When you leave. Your company AI account closes with the rest of your company accounts. Company work stays with the company.

I've read this policy and I'll follow it. Name: ____________ Date: ____________

How to set your three data classes

The template's examples cover most service businesses, but spend ten minutes making them yours. There's one test for every item: if this showed up somewhere it shouldn't, would I have to call a customer, a lawyer, or a regulator? If yes, it's Red. If it would just be embarrassing, it's Yellow. If nobody would care, it's Green.

Two edge cases trip people up. Customer names and email threads are Yellow, not Red, because putting them into an approved business-tier tool is exactly how AI helps with customer email. And health, legal, and financial records stay Red until you've checked your vendor's terms for your industry. For health information that usually means a business associate agreement, which is its own conversation. I covered what that looks like on one platform in is Claude HIPAA compliant.

Why the first line names the tool you pay for

Most templates say "use only company-approved AI tools" and stop there. That sentence does nothing. Nobody knows which tools are approved, so "approved" becomes whatever the employee already has open.

Naming the plan changes behavior. "Company work goes into ChatGPT Business, signed in with your company account" is a sentence someone can follow at 4:45 on a Friday. It also forces the owner to actually buy the plan, which is the real point, because the business tiers are where the data terms live. OpenAI says ChatGPT Business has no training on your business data by default. Google's Workspace privacy hub says your content isn't "used for Generative AI model training outside your domain without permission." A personal account gives you neither promise, and no admin who can shut it off. If you haven't picked the tool yet, best AI for small business picks by what you already run.

The sign-off rule, and why there's only one

Enterprise policies list a dozen review requirements. A small business needs one, and it's the same default I build into AI installs: AI drafts, a person approves, and nothing reaches a customer without a human yes until that workflow has proven itself.

The rule works because it doesn't create a new job. The person who sends the email already owns the email. The rule just makes it clear that AI doesn't change that. It also catches the failure that hurts small businesses most, a confident wrong answer in front of a customer, which is one of the patterns in why AI implementations fail.

If you write grants, the funder may already have a rule of its own. NIH says it will not treat applications substantially developed by AI as the applicant's original work, and NSF encourages you to disclose how AI was used. What that means for a small nonprofit's workflow is in AI grant writing.

Rolling it out in one week

1. Monday: buy the business-tier plan, or confirm your Workspace or Microsoft 365 plan includes the AI you're approving, and set up company accounts.
2. Tuesday: fill in the blanks and adjust the data class examples for your business.
3. Wednesday: 20 minutes with the team. Read it together, answer questions, collect signatures.
4. Thursday: ask everyone to stop using personal AI accounts for work and move anything they need onto the company account.
5. Friday: put the six-month review on the calendar. Vendors change plans and terms often enough that the tool line will need updating.

A policy tells people what not to do. It doesn't show them what to do instead, and a team that only hears "don't" goes back to doing everything by hand. Pair the policy with one real workflow and a 60-minute working session, the way I lay it out in how to train your team on AI.

A customer security questionnaire may ask about AI certifications next. For a company that uses AI tools rather than building them, the honest answer is this policy plus your vendors' own certifications: Anthropic and Microsoft both list ISO/IEC 42001 on their compliance pages. When a certificate is worth paying for is covered in AI governance certification.

What this one page doesn't cover

One page is a floor, not a compliance program. If you're in a regulated industry, handle health or financial records at scale, or have customers who send you security questionnaires, you'll need more, and your lawyer should read the final version. What the one page does is close the gap most small businesses actually have right now: people using AI for work with no approved tool and no rules.

If you operate in Texas, one law already sits under this page. TRAIGA took effect January 1, 2026 with no small-business exemption. For most private companies it is a short list of things you may not build AI to do on purpose, plus a disclosure duty for health care, enforced only by the attorney general after a 60-day chance to fix the problem. The plain-English version is in TRAIGA, the Texas AI law.

If you want to know where your business stands before you write anything, the free AI Readiness Checklist is 30 yes-or-no questions, and you don't need to give an email to answer them. If you want the whole picture, meaning which tool to standardize on, which workflows to start with, and what the rules should be for your team, that's the AI Readiness Assessment: $2,500 flat, a written roadmap in two weeks, and the fee is credited in full against an install within 90 days. It isn't a governance program. If that's what you need, I'm the wrong person, and I'll tell you so.

This policy is one page of a handbook. If nobody in the company owns the handbook, the part-time option and what it costs next to a full-time HR manager (a $149,280 BLS median before benefits) is in fractional HR.

The policy says what's allowed. The Trust Rules say who approves what before it reaches a customer. Free template, plus a 30/60/90 plan. Get the Trust Rules template →

This policy is the part of AI governance your employees read. The rest (who owns AI decisions, the tool inventory, the quarterly check) is the framework around it, and how NIST's four functions and the EU AI Act's dates translate to a company your size is in AI governance framework.

Nonprofits can use this policy as written: swap "customer" for "donor" and "client", and add donor records and case files to the red list. Which AI tools a nonprofit can get free or at $8 a seat, and where they help most, is in AI for nonprofits.