Template and guide · 8 minute read
An AI usage policy for a small business, in two pages
Field testedWhat to put in it, why consumer AI tools are the real risk, and how a regulated firm rolls out Copilot without the examiner flinching.
By Jim Lennon, Account Manager · July 2026
Consumer AI tools send whatever you paste out of the building. Enterprise editions keep it in your tenant. The policy has to say which is which.
An AI policy in two pages Gold Star survey"Per usual your response time is quick, and the determination of the issue and response had us back up and running in a very reasonable amount of time."
Andrew, trucking companyMore from the survey wallWhy two pages
Staff will read two pages. They will not read twenty, and a policy nobody reads protects nobody. The point is to answer the questions people actually have: which tools can I use, what can I paste into them, and who do I ask.
The five sections
- Approved tools. Name them. Copilot in the company Microsoft 365 tenant, for example. Anything not listed is not approved.
- Prohibited data. Client names, account numbers, health or financial details, anything under a confidentiality agreement, source documents. Never into a consumer tool, and only into an approved tool under the company account.
- Logging and review. What is logged, who reviews it, how often.
- Training. Twenty minutes, once, with a refresher yearly. Recorded.
- Exceptions. Who can approve one and how to ask.
Why consumer tools are the real risk
A free chatbot on a personal account sends whatever is pasted into it out of the building, with no record and no way to get it back. Enterprise editions keep data inside the company's tenant under the same retention and access rules as email. That distinction is the whole game, and the policy has to spell it out.
Rolling it out in a regulated firm
Policy first, agreed with the compliance officer. Then the platform: enterprise editions, monitoring that logs access, retention rules that match the record-keeping requirements. Then a small pilot on real tasks, measured. Then the rest of the firm. We have done this for an advisory firm as part of a wider move off an on-premises server, and the regulator's only question was whether they could show how. They could.
Proof it works
The stories where we did this, and what the clients said afterwards.
AI policy and SEC compliance for a financial services firm
Office operations · AutomationOne department, one system, no more sticky notes
Sunk cost is real. A backup server you bought last year deserves a plan before it goes in a dumpster because a move made it convenient.
Server or cloud, honestly TechnologyMulti-factor on email but not on the remote gateway is a locked front door with the back door open. Do all of them.
Multi-factor everywhereQuestions this guide gets asked
Can our staff use ChatGPT?
With an enterprise account and this policy, possibly. On a personal account with client data, no, and the policy should say so in plain words.
The full answerDo we need a policy if we are not regulated?
Yes. The risk is client data leaving the building; regulation only changes who asks about it afterwards.
The full answer
"Thanks for the hard work. I was kept informed with regular updates until the concern was resolved."
Jeff, insurance brokerageMore from the survey wall- A technician who knows your setup takes every request. Not a dispatcher, not a queue.
- Every closed ticket is surveyed and a partner reads every response.
- 99.5% of surveys come back positive.
- Family-owned since 2005. 21 years in the same corner of Wisconsin, not going anywhere.
"Service is excellent, quick to respond and quick to complete. Thank you!"
Cheri, small businessTalk to a partner, not a sales script.
Tell us what is going on. A partner will call you back the same business day, look at what you have, and tell you honestly whether we are the right fit. No pricing pressure, no pitch deck.