A small business AI use policy customer and employee data rules should be easy to understand and apply during everyday work. Employees need to know which tools they can use, what information they may enter, and when a person must check the result. A short, specific policy can give a small team useful guardrails without requiring a full-time AI or compliance lead.
Treat this as a starting point, not a substitute for reviewing your obligations or getting qualified advice for your situation. Your policy should fit the information your business handles, the tools it approves, and the work employees do.
Start with a simple rule for information
Give staff a clear default: public or generic information may be used in approved AI tools. Confidential information requires approval. Identifiable customer or employee information, and regulated or sensitive data, must not be entered unless an authorized reviewer has confirmed both the tool and the specific use.
Make the categories concrete so employees do not have to guess:
- Public or generic: information already intended for public use, or a general request that contains no private business details. For example, an employee might ask an approved tool to suggest a clearer structure for a generic announcement.
- Confidential business information: internal plans, nonpublic financial details, contracts, credentials, security information, or documents containing business-sensitive material. Do not enter these unless the policy owner approves the tool and use.
- Identifiable customer or employee information: names linked to account details, contact information, support conversations, employee records, applicant information, or other details that could identify a person. Keep these out of AI tools unless an authorized reviewer explicitly approves the use and safeguards.
- Regulated or highly sensitive information: information subject to special handling requirements, such as health-related records. Treat it as prohibited by default unless the business has confirmed that the specific tool, account settings, and use are appropriate.
These categories can support a broader approach to securing sensitive business data. The key is to set a conservative default and identify who can make exceptions.
Approve tools by account and use, not by name
List the AI tools employees may use for work and specify that they must use company-approved accounts. Personal accounts should not be used for work data, even when the task seems routine. A tool’s brand or a general description of its business plan is not enough to establish that a particular use is suitable.
Before approving a tool, assign someone to review how the relevant product and account handle submitted data. Check its data-use, retention, access, and deletion terms, along with available privacy and security settings. Consider what information employees will enter and whether the tool is suitable for that particular task. Record the approved purpose and any limits so employees have guidance they can follow.
Name a policy owner who maintains the approved-tool list and handles requests for exceptions. Ask the owner to revisit the decision when product terms, account settings, or the intended use changes. The NIST Generative Artificial Intelligence Profile offers a risk-management framework that can help inform this review.
Set careful rules for customer data
Customer information should not be copied into a chatbot or another AI service just to save time. The policy should prohibit entering identifiable customer records, private communications, account credentials, payment details, or confidential files into unapproved tools. It should also prevent employees from uploading entire documents or conversations when only a general question is needed.
If an approved task can be completed without personal information, remove the identifying details first. Replace names and account references with generic descriptions, and remove details such as addresses, contact information, unique case facts, and file attachments that could point back to a person. Simply deleting a name may not be enough if other details still make the customer recognizable. When unsure, leave the data out and ask the policy owner.
For approved use cases involving customer data, define exactly what is permitted, who authorized it, and what safeguards apply. Keep the policy aligned with your business’s existing privacy and security practices. A related IT compliance planning resource can help frame the wider process, but the right requirements depend on your business and the data involved.
Protect employee and applicant information
Employee data deserves its own rule. Do not put personnel files, performance notes, leave details, compensation information, or applicant records into an AI tool unless the business has approved the specific tool and purpose. Keep access limited to people who have a legitimate work need, and avoid using personal accounts for these tasks.
Set a default against using AI to make or materially influence decisions about hiring, performance, pay, discipline, or leave without management oversight and appropriate legal review. A human should remain accountable for consequential decisions, not simply accept an AI recommendation. The EEOC’s small-business guidance on employment decisions is a useful reference when considering this topic. For questions about your obligations, seek advice from a qualified professional.
Require human review before work goes out
AI-generated material can sound confident while containing mistakes, unsupported statements, or information that should not be shared. Require an employee to review any AI-assisted content before it is sent to a customer, used in a business decision, or published externally.
Tell reviewers to check whether the response is accurate, appropriate for the audience, and free of confidential or personal information. They should confirm important facts against trusted business records and remove content that is misleading or outside the approved purpose. For sensitive communications or work affecting an individual, require review by the responsible manager or another designated person.
Make employee education part of the policy, too. Explain the rules with practical examples and tell staff where to raise questions. Clear cybersecurity guidance for employees can reinforce the habits that help protect information across everyday tools.
Explain what to do after accidental sharing
Employees should not be left to figure out a data mistake on their own. Give them a named contact, such as the person responsible for IT or security, and tell them to report an accidental disclosure promptly. The policy can set out these first steps:
- Stop using the tool for the information involved. Do not add more data or try to cover up the mistake.
- Notify the named contact promptly and describe what was entered, which tool and account were used, and when it happened, as far as the employee knows.
- Preserve relevant details, such as the tool, account, and conversation information, without sharing the sensitive content more widely.
- Follow the business’s existing security and incident-response process. The responsible person should determine what further steps are appropriate.
Make clear that reporting a mistake quickly helps the business respond. Do not promise that information can always be removed from a tool. The policy owner should assess the specific service and follow the organization’s response procedures.
Frequently asked questions
Can employees put customer information into ChatGPT or another AI tool?
Only if the business has approved the specific tool, account, and use. Otherwise, employees should keep identifiable customer information out and ask the policy owner before proceeding.
Are business AI accounts safe for confidential information?
A business account is not automatically appropriate for every kind of data. Review the account’s settings and terms for data use, retention, access, and deletion, then approve only defined use cases.
How should a small business anonymize customer data?
Remove names and other details that could identify the person, including contact information, account references, unique case facts, and attachments. If the person could still be recognized, do not enter the information.
What should someone do after sharing sensitive data by mistake?
Stop using the tool for that information, promptly notify the named contact, preserve relevant details, and follow the business’s security and incident-response process.
Where can a small business get help putting a policy in place?
Start by assigning a policy owner and reviewing the AI tools and data your team uses. For a practical discussion about IT and managed AI services, contact Zevonix at (386) 260-0777.