How is this different from a general IT acceptable use policy?

An IT policy governs systems and accounts. An AI policy has to govern what goes into a tool and what comes out of it, which are different questions. The input question is about data leaving your boundary. The output question is about whether somebody may act on what came back, and who is answerable when they do.

Does a small company need a written AI policy?

An unwritten rule is a habit, and it leaves with whoever held it. At small sizes the document can be short, and shortness helps, since the point is that people can recall it. What it cannot be is absent, because the first time somebody new has to make the call there is nothing for them to make it from.

How long should it be?

Short enough to be recalled. Length is a poor proxy for coverage here, and a long policy tends to be one written to survive review rather than to be used. Naming the prohibited data categories, the approved tools, and the person to ask covers most real cases in a page.

Does an AI policy count as legal compliance?

No. A policy is one artifact among several, and whether anything is required of you depends on your role, your jurisdiction and what your systems do. What a policy does reliably is make the rule knowable and the decisions recordable. Whether that satisfies a particular obligation is a question for somebody qualified to answer it about your circumstances.

What is an AI acceptable use policy?

An AI acceptable use policy is the written rule for what AI may be used for at work, what data may go into it, and what is prohibited outright. A usable one names specific tools and specific data categories and says who to ask about an edge case. A policy that only tells people to be careful is one everybody agrees with and nobody can apply.

The categories matter more than the prohibition

The most common AI policy is a paragraph asking people not to put confidential information into AI tools. Everybody agrees with it, and it does not decide a single real case, because the hard question is never whether confidential data is confidential. It is whether this particular thing counts.

A policy earns its place by naming categories. Customer records, unreleased financials, anything covered by a contract with a confidentiality term, personal data about employees. Naming them converts a judgment call made at speed by one person into a lookup. It also makes the policy checkable, which a general instruction to be careful never is.

It has to say what happens at the edge

A policy meets a case it did not anticipate sooner than anyone expects. What separates a policy people follow from one they route around is whether it says what to do then, and whether the answer arrives faster than the work does.

A route for asking, with somebody named at the end of it, is what turns an edge case into a decision that gets recorded. Without one, the person decides alone, and nobody finds out either way. The record of those decisions is also how a policy improves, since each one is a category the next version can name outright.

A policy nobody can recall is a document that protects the file

Publication and adoption are different things, and a policy can be fully published and entirely unknown. The test worth applying is whether the people using AI could state the rule without going to look it up. If they could not, the rule exists for an audit and not for the work.

That is also why the trigger for revisiting it should be a new tool rather than a date. An annual review means the policy is accurate on one day a year. A review triggered by adoption keeps it aligned with what people are actually doing, which is the only condition under which they can be expected to know it.

Common questions

How is this different from a general IT acceptable use policy?: An IT policy governs systems and accounts. An AI policy has to govern what goes into a tool and what comes out of it, which are different questions. The input question is about data leaving your boundary. The output question is about whether somebody may act on what came back, and who is answerable when they do.
Does a small company need a written AI policy?: An unwritten rule is a habit, and it leaves with whoever held it. At small sizes the document can be short, and shortness helps, since the point is that people can recall it. What it cannot be is absent, because the first time somebody new has to make the call there is nothing for them to make it from.
How long should it be?: Short enough to be recalled. Length is a poor proxy for coverage here, and a long policy tends to be one written to survive review rather than to be used. Naming the prohibited data categories, the approved tools, and the person to ask covers most real cases in a page.
Does an AI policy count as legal compliance?: No. A policy is one artifact among several, and whether anything is required of you depends on your role, your jurisdiction and what your systems do. What a policy does reliably is make the rule knowable and the decisions recordable. Whether that satisfies a particular obligation is a question for somebody qualified to answer it about your circumstances.

Find out where you stand

The assessment on this site asks 22 questions about what AI is in use, what rule governs it and who is accountable, and returns a score, a verdict and, where a control is short, the one thing to fix first. It names no framework, and it takes about ten minutes.

It is a self-assessment of what you could show today, not an audit, not a certification, not a conformity assessment and not legal advice.

Run the assessment