Roughly 65% of US employees use AI tools their employer has not approved, and 71% of those have pasted sensitive company data into them (CIO). In May 2026 a German appeals court held a company liable for what its customer-facing chatbot said (Library of Congress). And since 2 August 2026, the EU AI Act's transparency obligations apply to any business whose AI interacts with EU users. If your company has no written AI policy, it has one anyway. It is whatever each employee decided on their own.
We build AI systems for small and mid-sized companies, and the first document we ask for is the AI policy, because it determines what we are allowed to connect the system to. Most clients do not have one. This post explains why that became a real liability in 2026 rather than a nice-to-have, sets out the ten clauses a usable policy needs, and gives you an acceptable use template short enough that people will read it. It does not attempt a full enterprise AI governance framework with committees and model registries; a 40-person company does not need that, and pretending otherwise is why most policies never get adopted.
What is an AI governance policy?
An AI governance policy is a short written document that states which AI tools employees may use, what data may go into them, who is accountable for AI-driven decisions and outputs, and how the company checks that those rules are followed. For a small or mid-sized business it is typically two to four pages, owned by one named person, and reviewed twice a year. Its purpose is not to slow AI adoption down. It is to make adoption safe enough that the company can say yes more often, with evidence that it did so responsibly if a regulator, customer, or court asks.
Why 2026 changed the answer from "later" to "now"
Four things happened in the last twelve months that moved AI governance from a large-enterprise concern to a small-business one.
- Shadow AI is highest in small companies. Firms with 11 to 50 employees show the highest density of unsanctioned AI use, because there is no IT function to notice and no policy to point to (EdCon). The data leaking into consumer chatbots is customer records, contracts, and source code.
- Courts now attach liability to AI output. The Hamm appeals court decision treats a chatbot's statements as the operator's statements. US commentary has followed the same logic since the Air Canada case. If your AI tells a customer something wrong, "the AI said it" is no longer a defense.
- Regulation has real dates. The EU AI Act's Article 50 transparency rules took effect on 2 August 2026, even though the Digital Omnibus deferred the high-risk obligations to December 2027 (Cloud Security Alliance). US state laws are layering on top: California's SB 942 became operative on 2 August 2026 and Colorado's replacement automated-decision law takes effect 1 January 2027 (Epstein Becker Green).
- Employees are quietly resisting. A 2026 survey found 29% of workers admit to sabotaging their company's AI rollout in some way, rising to 44% among Gen Z (Fortune). A policy that explains what AI will and will not be used for, including for evaluating staff, is the cheapest way to lower that number.
The ten clauses an SMB AI policy needs
| # | Clause | What it settles | Why it matters in 2026 |
|---|---|---|---|
| 1 | Approved tools list | Which AI products may be used, on which accounts, for which purposes | Ends shadow AI by giving people a sanctioned option |
| 2 | Data classification rules | What may never be entered into an AI tool (customer PII, credentials, unreleased financials, source code under NDA) | 71% of shadow AI users have pasted sensitive data |
| 3 | Human accountability | Every AI-assisted output has a named human owner who is responsible for it | Courts treat AI statements as the company's statements |
| 4 | Disclosure to customers | When and how customers are told they are interacting with AI or reading AI-generated content | EU AI Act Article 50, in force since 2 August 2026; California SB 942 |
| 5 | Decisions about people | AI may inform but not solely decide hiring, firing, pay, credit, or access decisions; a human reviews | State automated-decision laws; also reduces staff resistance |
| 6 | AI inventory | A simple register of every AI system in use, its purpose, data, owner, and vendor | Over half of organizations cannot list their AI systems; regulators will ask |
| 7 | Vendor requirements | Minimum terms: no training on company data, data location, deletion, security posture | Your policy is only as strong as your vendors' terms |
| 8 | Agent permissions | Any AI that takes actions gets least-privilege access and human approval on irreversible actions | The difference between a wrong answer and a wrong refund |
| 9 | Incident handling | What to do when AI leaks data, gives harmful output, or takes a wrong action; who is told | Speed of response determines liability exposure |
| 10 | Review cadence and owner | Named owner, review every six months, training on adoption and for new joiners | A policy nobody owns is a policy nobody follows |
AI acceptable use policy template
This is the plain-language version we hand to clients as a starting point. Replace the bracketed items, delete what does not apply, and keep it under three pages. It is a template, not legal advice; have counsel review it against the jurisdictions you sell into.
1. Purpose and scope
This policy applies to all employees and contractors of [Company] and covers any use of AI tools, including chat assistants, coding assistants, content generators, and AI features inside other software, for company work or with company data.
2. Approved tools
You may use the tools listed in [link to register] on company-provisioned accounts. Personal accounts on consumer AI services may not be used for company work. To request a new tool, contact [owner]; requests are normally answered within five working days.
3. Data you may not enter into any AI tool
Customer or employee personal data; passwords, keys, or access tokens; unreleased financial results; contracts or documents covered by an NDA; source code marked confidential; and any data a customer has told us not to share. If unsure, ask [owner] first.
4. You own what you ship
AI output is a draft. The person who sends, publishes, commits, or acts on it is responsible for its accuracy and appropriateness, exactly as if they had written it. Review AI output before it leaves the company.
5. Telling customers
Where a customer interacts with an AI system, such as a chatbot or voice agent, it is identified as AI at the start of the interaction and a route to a human is always available. AI-generated images, audio, or video used publicly are labeled as such.
6. Decisions about people
AI tools may help gather and summarize information, but decisions about hiring, performance, pay, discipline, or access are made and recorded by a named person. Staff may ask how AI was used in a decision about them.
7. AI that takes actions
Any AI system that can send messages, change records, move money, or access other systems is registered with [owner], is given the minimum access its task needs, and requires a person to approve actions that cannot be undone.
8. Reporting problems
If an AI tool exposes data, produces harmful output, or takes a wrong action, report it to [owner or channel] the same day. Reporting is never penalized. [Owner] records the incident, contains it, and decides whether customers or regulators must be informed.
9. Training and review
Everyone reads this policy on joining and confirms it annually. [Owner] reviews the policy and the tool register every six months and after any incident.
10. Consequences
Breaches are handled under the normal disciplinary process. Accidental breaches that are reported promptly are treated as learning events, not misconduct.
How to write and adopt the policy in five steps
- Inventory what is already in use. Ask every team lead which AI tools their people use for work, including personal accounts. Expect the list to be three times longer than you think. Put it in a spreadsheet with purpose, data touched, and owner.
- Choose the approved set and provision it. Pick one or two business-grade tools with no-training and data-location terms, and buy seats. A policy that bans consumer tools without offering a sanctioned alternative is a policy that will be ignored.
- Adapt the template. Fill in the brackets, remove clauses that do not apply, add anything your industry requires (for example, HIPAA constraints if you handle health data). Keep it under three pages.
- Have counsel check disclosure and decisions clauses. Clauses 5 and 6 are where jurisdiction matters. EU customers, California residents, and Colorado residents each trigger specific obligations.
- Roll it out with a 20-minute session and a named owner. Explain what the policy allows, not only what it forbids. Collect acknowledgments. Put the review date in the calendar.
Where the policy meets the systems you build
Clauses 7 and 8 are the ones that shape engineering work. When we scope an AI system for a client, the policy tells us which data the agent may touch, whether it may act without approval, and how incidents are escalated. The technical controls behind clause 7 are in our AI agent security checklist. For companies selling into Europe, the obligations behind clause 5 are detailed in our guide to EU AI Act compliance for SaaS. And if enterprise customers are already sending security questionnaires, the AI policy becomes an exhibit in your SOC 2 program; auditors increasingly ask for it.
The policy also has a commercial upside that clients underestimate. A two-page AI policy with an inventory and a named owner answers the AI section of most enterprise vendor questionnaires in one attachment. Companies without one lose weeks in procurement. If you are earlier in the journey and still deciding what to automate first, start with AI automation for small business, and treat the policy as the first deliverable rather than the last.
Frequently asked questions
Does a small business really need an AI governance policy?
Yes, if employees use AI tools at all, which in 2026 means yes. Shadow AI use is highest in companies with 11 to 50 staff, courts now hold companies liable for AI output, and the EU AI Act's transparency rules apply regardless of company size. A two-page policy with an approved tools list and data rules removes most of the exposure.
What is the difference between an AI governance policy and an AI acceptable use policy?
An acceptable use policy tells employees what they may and may not do with AI tools. A governance policy adds accountability, an inventory of AI systems, vendor requirements, customer disclosure rules, and incident handling. For an SMB the two are usually one document; the template above covers both.
Which AI regulations apply to a small business in 2026?
The EU AI Act's Article 50 transparency obligations apply since 2 August 2026 to any business whose AI interacts with EU users; the high-risk obligations were deferred to December 2027. In the US, California's SB 942 disclosure rules became operative in August 2026 and Colorado's automated-decision law takes effect in January 2027, with other states following. Sector rules such as HIPAA and GDPR apply to the data regardless of the AI.
Should the policy ban consumer AI tools?
Ban personal accounts for company work, and provide a business-grade alternative with no-training and data-location terms. Bans without alternatives drive usage underground; the goal is to move the 65% of unsanctioned use onto tools the company controls.
Who should own the AI policy in a company without a compliance team?
One named senior person, usually the COO, CTO, or head of operations, with authority to approve tools and handle incidents. Ownership matters more than title. A policy without an owner is not reviewed, not enforced, and not believed.
Key takeaways
- 65% of employees use unapproved AI tools and most have entered sensitive data. Without a policy, your AI governance is whatever each employee decided.
- Courts now attach liability to AI output, and the EU AI Act's transparency rules have applied since 2 August 2026. "Later" is no longer available.
- An SMB policy needs ten clauses in under three pages: approved tools, data rules, human accountability, disclosure, decisions about people, inventory, vendor terms, agent permissions, incidents, and ownership.
- Provide a sanctioned tool before banning the unsanctioned ones, or the policy will be ignored.
- Clauses on agent permissions and disclosure directly shape any AI system you build, so write the policy before the build, not after.
- A short policy with an inventory and a named owner also shortens enterprise procurement by answering the AI questionnaire in one attachment.
Get the policy and the system to match
If you are planning an AI build and do not yet have a policy, tell us what you are trying to automate. We will send you the editable version of the template above, adapted to the data and jurisdictions in your brief, and a note on which clauses will constrain the design. It is part of how our AI development practice scopes work, and it is free, because a client with a policy is a client whose project ships.
Sources
- CIO: Unsanctioned AI tool use among employees
- EdCon: Shadow IT and shadow AI in small business, 2026
- Library of Congress: German court rules chatbot operators liable for AI hallucinations
- Cloud Security Alliance: EU AI Act Digital Omnibus deadline changes
- Epstein Becker Green: 2026 US state AI legislation wrap-up
- Fortune: Workers admit to sabotaging company AI rollouts
- NIST AI Risk Management Framework