AI Use Policy for Small Businesses: Adoption With Guardrails

Generative AI tools are now part of everyday work: chat assistants, writing and coding helpers, meeting summarizers and AI features built into software you already pay for. Your staff may already be using them, whether or not anyone has written a rule. The practical question is no longer whether people will use AI, but how to use it without leaking data, publishing errors or creating legal problems.

This guide uses the National Institute of Standards and Technology (NIST) AI Risk Management Framework to structure the thinking, then turns it into a short policy a small business can actually adopt.

This area changes quickly. This guide reflects sources available in October 2026, so check for newer versions. It is general information, not legal advice. Rules that touch AI use, including privacy, employment, consumer protection and intellectual property law, vary by state and industry, so involve an attorney before relying on AI for decisions about people or for content you need to own.

What the NIST AI Risk Management Framework Offers

NIST released AI RMF 1.0 on January 26, 2023, for voluntary use. NIST's framework page says it is being revised as part of the White House AI Action Plan, so expect an update. In July 2024, NIST added a Generative AI Profile, NIST AI 600-1, focused on risks that are new or worse with generative AI.

The framework organizes the work into four functions:

• Govern: NIST describes it as cultivating "a culture of risk management" and treats it as cross-cutting, informing everything else.
• Map: establishing the context, meaning what the AI is used for and what could go wrong.
• Measure: analyzing, assessing and monitoring AI risks, including testing systems before and during use.
• Manage: allocating resources to the risks you have mapped and measured, and planning how to respond to incidents.

NIST also lists characteristics of trustworthy AI: valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful bias managed.

For a small business, a reasonable translation is: Govern means naming an owner and writing a policy, Map means listing how AI is used, Measure means checking outputs, and Manage means acting on problems and reviewing regularly.

The Risks That Matter Most for a Small Business

The Generative AI Profile defines 12 risks. Several are directly relevant to everyday business use:

• Confabulation: "the production of confidently stated but erroneous or false content," often called hallucinations.
• Data privacy: leakage or unauthorized use of personal or sensitive information.
• Information security: lower barriers for attackers, including help with phishing and malware.
• Intellectual property: easier copying of protected content and exposure of trade secrets.
• Harmful bias: outputs that amplify existing biases or perform unevenly across groups.
• Human-AI configuration: over-reliance and automation bias, where people trust outputs too readily.

Ownership is a separate concern. In its January 2025 report on copyrightability, the US Copyright Office concluded that copyright "does not extend to purely AI-generated material" and that, with current technology, prompts alone do not provide sufficient human control. If you need to own marketing copy, designs or code, meaningful human authorship matters. Ask an attorney about your situation.

Existing law still applies. When the Federal Trade Commission announced its Operation AI Comply enforcement sweep on September 25, 2024, FTC Chair Lina M. Khan said, "there is no AI exemption from the laws on the books."

Start With an Inventory and an Approved List

One of the outcomes in NIST's Govern function reads: "Mechanisms are in place to inventory AI systems." For a small business, that can be a simple spreadsheet:

• Which AI tools people use, including AI features inside existing software
• Whether they use personal or business accounts
• What kinds of data go into each tool
• Who owns the relationship with each vendor

From there, choose a short list of approved tools, preferably business editions with administrative controls. Before approving one, ask the vendor in writing whether your inputs are used to train its models, how long prompts and files are retained, where data is stored, and whether you can manage accounts centrally and remove departing users. Our guide Vendor Management and SLAs: A Practical Guide for Small Businesses covers how to evaluate vendors more broadly.

Data Rules People Can Remember

Most AI mistakes start with what someone pastes in. A simple three-tier rule works well:

• Allowed: public information, generic drafting and brainstorming that contain no confidential details.
• Approved tools only: internal, non-sensitive business information, used only in tools on the approved list.
• Never, unless a tool is specifically approved for it: customer personal information, health or payment data, passwords and access keys, employee records, confidential client material and trade secrets.

Give examples from your own business so people can apply the rule without guessing.

Human Review and Accountability

Make one principle non-negotiable: a named person is responsible for anything AI helps produce. In practice:

• Check facts, figures, quotes and citations against original sources before anything leaves the building.
• Have code reviewed and tested like any other code.
• Don't let AI make or drive decisions about hiring, firing, pay, credit, pricing for individuals or eligibility. Talk to an attorney before using AI in these areas at all.
• Don't use AI to impersonate real people or make claims about products and services you cannot back up.
• Decide when to tell customers that AI was used, and apply that consistently.

What to Put in the Policy

Keep the policy to one or two pages. A workable outline:

1. Purpose and scope: who it covers and which tools and uses it applies to.
2. Approved tools and how to request a new one.
3. Data rules, using the three tiers above.
4. Review requirements and who is accountable for outputs.
5. Prohibited uses.
6. Intellectual property and confidentiality expectations.
7. Disclosure: when customers or partners should be told AI was used.
8. Security: watching for AI-assisted scams, and never entering credentials into AI tools.
9. Reporting: how to report a mistake or a data leak quickly, without blame.
10. Owner, acknowledgment and review date.

Our guide IT Policies Every Small Business Needs (With Simple Templates) covers acceptable use and incident reporting policies that this one should connect to.

Roll Out in Small Steps

Start with low-risk uses, such as drafting internal documents, summarizing public material or brainstorming. Measure whether they actually save time and catch errors. Expand to customer-facing uses only after the review habits are working. Because tools, vendor terms and rules keep changing, review the policy and approved list at least quarterly at first.

Key takeaways

• Assume staff may already be using AI tools; an inventory and an approved list are the first steps.
• The NIST AI RMF's Govern, Map, Measure and Manage functions scale down to an owner, a list, output checks and regular review.
• Confabulation, data leakage and over-reliance are the everyday risks; clear data rules and human review address most of them.
• Purely AI-generated material is not protected by copyright under current US Copyright Office guidance, and existing consumer protection law applies to AI.
• AI rules and frameworks are changing; review the policy often and involve an attorney for decisions about people.

Sources

• NIST, AI Risk Management Framework
• NIST, AI 100-1, Artificial Intelligence Risk Management Framework (AI RMF 1.0) (January 2023)
• NIST, AI 600-1, Generative Artificial Intelligence Profile (July 2024)
• US Copyright Office, Copyright and Artificial Intelligence, Part 2: Copyrightability (January 2025)
• FTC, FTC Announces Crackdown on Deceptive AI Claims and Schemes (September 25, 2024)