Fazley RabbiAn AI use policy is a short written agreement about how your team uses tools like ChatGPT, Gemini or Claude at work: which tools are allowed, what information must never be pasted into them, which work needs a human check, and who to ask when unsure. For a small business it does not need to be a legal document. One or two pages in plain language, which everyone reads and signs, is enough to prevent most of the problems that come from staff experimenting on their own.
Why a small team needs one
Your staff are probably already using AI, whether you have said yes or not. A sales executive drafts replies in ChatGPT on her phone. An accounts assistant pastes a supplier's bill into a chatbot to summarise it. None of this is bad in itself. The risk is that each person makes up their own rules. One person pastes customer phone numbers into a free tool; another sends an AI-written quotation without checking the prices. A policy turns private habits into a shared standard, so you keep the time savings without the surprises.
What to put in it
Keep each section short. You can write the whole thing in an afternoon.
1. Purpose and scope
One or two sentences: why the policy exists and who it covers (staff, interns, and freelancers who handle your data).
2. Approved tools
List the tools people may use for work, and which accounts. A business account that you control is better than personal free accounts, because you can see who has access and remove it when someone leaves. Each tool's own terms explain how it treats the data you enter. These differ between products and plans, and they change, so read the current version on the provider's website rather than relying on what someone remembers.
3. Information that stays out
This is the most important section. Write a plain list, for example:
- customer names together with phone numbers or addresses
- bKash, Nagad or bank account details, and passwords of any kind
- staff salaries, medical or personal records
- supplier price lists and contracts you have agreed to keep confidential
- anything a customer or partner shared with you in confidence
If staff need AI help with such material, they should remove names and numbers first, or use a tool you have set up specifically for that job.
4. Work that needs a human check
AI drafts can be confidently wrong. Decide which outputs must always be reviewed by a named person before they go out: prices and quotations, anything sent to a customer in your company's name, legal or financial wording, and any decision about a person, such as hiring or a complaint. A simple rule works well: AI can draft, a person decides and sends.
5. Being open about AI use
Decide when you tell customers that AI was involved, for example when a chat assistant answers messages on your Facebook page. Honesty here protects trust.
6. Who to ask, and what to do after a mistake
Name one person who answers "can I use AI for this?" questions. Also say what to do if someone pastes the wrong thing or an AI error reaches a customer: report it quickly, without fear of blame, so it can be fixed.
A one-page outline you can adapt
| Section | One-line example |
|---|---|
| Purpose | "We use AI to save time on drafts, not to replace judgement." |
| Approved tools | "Company accounts of [tool names] only." |
| Keep out | "No customer contact details, payment details or passwords." |
| Human check | "Quotations, customer emails and anything legal are checked by the manager." |
| Openness | "Our page assistant says it is automated and offers a person." |
| Questions and mistakes | "Ask [name]. Report mistakes the same day." |
Rolling it out without fuss
- Write a draft yourself, or ask one interested staff member to help.
- Discuss it in a short team meeting. Ask people how they already use AI; you will learn which rules matter most.
- Give each person a copy in Bangla or English, whichever they read more comfortably, and ask them to sign it.
- Show a few good examples: a well-checked customer reply, a prompt with names removed.
- Review it every few months, and whenever you add a new tool or process.
A policy that sits in a drawer does nothing. Mention it when you onboard new staff and when you start any new automation project.
Common questions
Do we need a lawyer? For a basic internal guideline, usually not. If you handle sensitive data such as health records, or you work with foreign buyers whose contracts include data terms, ask a lawyer to review the policy against your contracts and the laws that apply to you.
Should we ban AI instead? A ban is hard to enforce and pushes use out of sight. Clear rules for safe use usually work better.
What about AI built into our own systems? The same principles apply. When I build an automation, I write down which data it touches and where a person approves the result, so the policy and the system say the same thing.
Your next step
Write the "information that stays out" list today, share it with your team, and build the rest of the policy around it. For more on the data side, read AI and data privacy for businesses, and see how a human review step fits into daily work. If you want an assistant that answers staff questions from your own documents within these rules, see a company knowledge AI assistant, or explore AI and workflow automation.