Building an AI Policy for Your Small Business: A Template

Why Your Small Business Needs an AI Policy Now (Even If You Haven't Deployed AI)

Somewhere between 40% and 60% of U.S. small businesses now use AI in their operations — yet almost none have a written policy governing how. That gap is where risk lives, and it's widening every month.

The numbers are striking. The U.S. Chamber of Commerce reports that nearly 60% of small businesses now use AI — more than double the 2023 figure — while the Federal Reserve's 2024 Small Business Credit Survey found roughly 40% using or planning to use it. Either way, adoption has gone mainstream. Written rules have not.

Here's the uncomfortable truth from employment law firm Fisher Phillips: your business needs an AI policy now, even if you've never deployed a single AI tool — because your employees are almost certainly using them anyway. Free platforms like ChatGPT and Gemini sit one browser tab away, and your team is pasting client data, pricing strategies, and draft contracts into them whether or not you know it.

Small business owners feel this tension acutely. One owner surveyed by the Federal Reserve put it plainly: "We have not found a way to integrate AI into our business while keeping the business's intellectual property safe." Another admitted, "I don't know how, and there is nobody to teach me."

The barriers owners cite most are exactly the problems a written policy solves:

• Data privacy (49%) — a policy's confidentiality rules tell employees what may never be typed into an AI tool.
• Not knowing which tools to use (48%) — a policy's approved-tools list makes the decision for everyone.
• Regulatory uncertainty (50%) — a policy with scheduled reviews keeps you ahead of a shifting state-by-state patchwork.

A policy doesn't need to be a legal treatise. It needs to answer three questions: which tools are allowed, what information is off-limits, and who verifies the output. When you later expand into AI agents and agent skills — the kind SkillzBench's free directory is being built to help you vet and test — that same approved-tools section becomes your onboarding gate.

The point isn't to slow AI down. It's to make sure the AI already running through your business runs on your terms.

The 10 Components Every Small Business AI Policy Must Include

Your employees are already using AI whether you've approved it or not — employment law firm Fisher Phillips makes exactly that argument for why every business needs a written policy now, even one that hasn't deployed a single AI tool. The good news is you don't need a 40-page enterprise document; you need ten clear components, adapted to your size.

Fisher Phillips' framework covers purpose and scope first, and this matters more than it sounds. Small businesses use three kinds of AI: tools embedded in software they already run (like billing platforms), free well-known chatbots such as ChatGPT and Google Gemini, and specialized industry programs, according to Federal Reserve research on small business AI use. Your policy must cover all three — including tools you never officially provided.

Data privacy comes next, and it's the barrier owners cite most after cost: 49% worry about it. The rule Fisher Phillips recommends is simple and memorable — treat every input as if it will go viral on the internet, with your name and your company's identity attached. That single sentence prohibits pasting customer data, personal information, or anything confidential into a public chatbot.

Confidentiality and trade-secret protection follows the same logic. One small business owner told Federal Reserve researchers, "We have not found a way to integrate AI into our business while keeping the business's intellectual property safe." A written rule keeping trade secrets and proprietary data out of GenAI platforms also strengthens your legal position if a trade secret ever ends up in litigation.

The remaining components cover the human side of AI risk:

• Anti-discrimination checks — a human must review AI output against your diversity and fairness standards before it goes anywhere.
• Employment-decision restrictions — no hiring, promotion, discipline, or termination decisions aided by AI unless a deployed HR tool is verified as legally compliant.
• Copyright verification — check AI-generated content's sources before publishing it.
• Human verification and disclosure — treat AI as "an idea generator, not as a replacement for content creation," and require employees to disclose when and how much they used it.
• Consequences — spell out discipline up to termination, and require reporting of violations.

Two final pieces protect you legally. Include an NLRA disclaimer so the policy can't be read as restricting employee communications protected by federal labor law — even in non-union workplaces. And build in review: Fisher Phillips recommends multi-disciplinary input, but for a five-person shop, the owner plus one trusted advisor (an attorney, accountant, or IT helper) is a realistic substitute.

As you formalize which AI tools and agent skills employees may use, vetting matters — published research found roughly 26% of community-published agent skills carry at least one vulnerability, which is why SkillzBench is building a free directory that version-pins, security-scans, and license-checks every skill. Join the waitlist to get access when it launches.

Fill-in-the-Blank: Your Small Business AI Policy Template

With nearly 60% of U.S. small businesses now using AI for operations — more than double the 2023 figure, according to U.S. Chamber survey data — a written policy is no longer optional. The good news: you don't need a legal department to write one. Below is a simplified, fill-in-the-blank template adapted from the 10-component workplace AI framework developed by employment law firm Fisher Phillips, scaled down for a team of ten or fewer.

1. Purpose and Scope

"This policy governs how ______ (business name) employees may use artificial intelligence in any work capacity, whether or not the tool was provided by the business." That last clause matters: Fisher Phillips stresses that scope must cover public tools like ChatGPT, Gemini, Bing, DALL-E, and Midjourney even if your company provides none — because employees are almost certainly using them anyway. Small businesses report using three categories of AI, so name all of them:

• AI embedded in software you already use, such as billing or accounting platforms
• Free, well-known platforms such as ChatGPT or Google Gemini
• Industry-specific AI programs relevant to your trade

2. Data Privacy and Confidentiality

This section answers the two concerns small business owners cite most. Data privacy is a barrier for 49% of owners, and one owner told researchers, "We have not found a way to integrate AI into our business while keeping the business's intellectual property safe." Your fill-in line: "Employees may not enter customer information, trade secrets, financial records, or anything related to ______ (list your confidential material) into an AI platform." Then add the viral rule: treat every prompt as if it will appear online with your company's name attached.

3. Verification and Disclosure

Adopt Fisher Phillips' core principle as your house rule: use AI as an idea generator, not a content replacement. Fill in: "All AI output must be reviewed and verified by a human before use, and employees must disclose when and how they used AI in ______ (client deliverables, published content, etc.)." This matters because AI can produce confident but wrong answers, and 46% of owners cite employees' lack of digital skills as a barrier — so build verification into policy rather than assuming expertise.

4. Employment Decisions

One sentence: "No hiring, promotion, discipline, or termination decision may be made using AI output." Keep it absolute; it's the safest posture for a small team.

5. Review Process

Enterprise frameworks call for multi-disciplinary stakeholder committees. You don't need one. Fill in: "This policy will be reviewed every __ (six months is a reasonable default) by _ (the owner) and ___ (one advisor — your accountant, attorney, or IT contact)." That two-person review replaces the committee, which matters given that firms with 10 or fewer employees lag well behind larger firms in AI investment and resources.

6. Consequences

State plainly: violations may result in discipline up to termination, and employees must report misuse they observe.

When you reach the tool-approval step in Section 1, it helps to vet what employees plug into their agents. SkillzBench is building a free directory of agent skills — version-pinned, security-scanned, and license-checked — so businesses can evaluate what they allow with actual evidence rather than guesswork; the waitlist is open now. A one-page policy, filled in this afternoon, puts you ahead of most of the market.

Making the Template Stick: Training, Tool Approvals, and Review Schedule

A policy that sits in a drawer protects no one. The real work begins after the document is signed — training your team, deciding which tools are actually allowed, and committing to a review rhythm that keeps the policy from going stale.

Training comes first, and it matters more than most owners expect. In a Bipartisan Policy Center poll, 46% of small business owners cited employees' lack of digital skills as a barrier to AI adoption. Training closes that gap while reinforcing the policy itself: walk staff through the data-privacy rules, the "treat every prompt as if it will go viral" standard, the human-verification requirement for AI output, and the disclosure rule for when AI was used. Keep sessions short and practical — a one-hour walkthrough with real examples beats a fifty-page manual nobody reads.

Next, formalize your tool approval process. Small businesses typically juggle three categories of AI: features embedded in existing software, free public platforms like ChatGPT or Gemini, and industry-specific programs. Your policy should name which are approved, which require sign-off, and which are off-limits — and it should cover tools you never provided, since employment law firm Fisher Phillips notes employees almost certainly use them anyway. When your team starts using AI agents, the same vetting logic applies to agent skills: SkillzBench, currently in pre-launch with its waitlist open, is building a free directory of agent skills that are version-pinned, license-checked, and security-scanned — a practical reference point for deciding what's safe to load into an agent.

Then set a review schedule. Regulatory anxiety is widespread: majorities of small businesses in nearly every state worry a patchwork of state-level tech rules will raise compliance costs, ranging from 46% in North Carolina to 86% in Hawaii. Because the legal landscape and the tools themselves change fast, revisit the policy at least every six months. For a small team, the owner plus one outside advisor — an attorney, accountant, or IT consultant — is enough to handle the review.

Finally, enforce consistently. Fisher Phillips recommends spelling out consequences for violations, up to termination, and requiring employees to report misuse. A policy enforced for some employees and ignored for others is worse than no policy, because it signals the rules are optional.

• Train every employee on the policy, not just managers
• Maintain an approved-tools list covering embedded, free, and specialized AI
• Vet agent skills and extensions before they're connected to agents
• Review the policy every six months or after major legal changes
• Apply consequences uniformly and document violations

Governance isn't glamorous, but it's what turns a one-time template into a living safeguard for your business.