AI Policy Template for Small Business (Free Download) 2026

The insurance clock is ticking

Since January 2026, insurers have been attaching Verisk's CG 40 47 AI Technology Exclusion to commercial general liability policies. If your business uses AI without a documented governance policy, your next claim could be denied outright. A written AI policy is the single fastest thing you can do to protect your coverage.

Why Every Small Business Needs an AI Policy in 2026

Let's be direct: if your business has more than one employee, AI is already part of your operations. A 2026 Salesforce survey found that 92% of small businesses use at least one AI tool. Most use several — from ChatGPT for drafting emails to AI-powered accounting software to image generators for social media.

The problem is not the tools themselves. The problem is what happens when something goes wrong — an AI hallucinates false information in a client deliverable, an employee feeds confidential customer data into a free chatbot, or an AI-generated marketing image triggers a copyright claim — and you have no documented rules governing how AI should be used.

Here are the four reasons a written AI policy has become non-negotiable:

Insurance carriers are excluding AI liability

Verisk's CG 40 47 endorsement gives carriers the ability to exclude any claim arising from AI technology. CG 40 48 narrows coverage even further. The carriers deciding whether to offer affirmative AI coverage — instead of blanket exclusion — want to see that you have written AI governance in place. No policy, no coverage. It is that straightforward. Read our full breakdown of the CG 40 47 endorsement to understand exactly what is being excluded.

New regulations require documented AI governance

The Colorado AI Act takes effect June 30, 2026 and requires businesses deploying “high-risk” AI systems to maintain a risk management policy. The EU AI Act Article 50 hits August 2, 2026. Even if these don't apply to you directly today, the regulatory direction is unmistakable: AI governance documentation is becoming a baseline expectation. See our AI compliance checklist for small businesses for a full rundown.

Liability falls on the business, not the employee

When your marketing coordinator uses an AI image generator that produces copyrighted content, or your bookkeeper feeds client financials into a free AI tool, the lawsuit lands on your desk. A written policy creates a clear standard of care. Without one, you have no documentation that you took reasonable steps to prevent harm — which is exactly what a plaintiff's attorney will argue.

It takes 15 minutes, not 15 weeks

You do not need a legal department or a $25,000 consulting engagement. A practical AI policy for a small business can be created in a single afternoon using a template like the one below — or in under 15 minutes using our free AI policy generator.

What Your AI Policy Must Cover

A complete AI policy for a small business should address seven core areas. Miss any of these and you leave a gap that insurers, regulators, or opposing counsel can exploit.

1. Purpose and Scope

State why the policy exists and who it applies to. This should cover all employees, contractors, freelancers, and third-party vendors who interact with AI tools on behalf of your business. Be explicit: this policy applies to anyone doing work for the company, not just full-time staff.

2. Approved AI Tools and Use Cases

Maintain a registry of every AI tool your business uses. For each tool, document the vendor name, the approved use cases, the risk level (low, medium, or high), and who authorized its use. This registry is a critical document for insurance underwriters. Our guide to building an AI acceptable use policy covers this section in depth.

3. Prohibited Uses

Draw clear lines. Common prohibitions for small businesses include:

Entering customer PII, health records, or financial data into any AI tool
Using AI outputs as final deliverables without human review
Using unapproved AI tools for any business purpose
Generating content that impersonates real people or misrepresents AI involvement
Sharing trade secrets, proprietary processes, or confidential business data with external AI systems

4. Human Oversight Requirements

Define which AI outputs require human review before they leave your organization. At minimum, require review for all client-facing communications, published content, financial calculations, and anything touching legal or compliance topics. Specify who is responsible for the review — the employee who generated the output, their manager, or a designated reviewer.

5. Data Privacy and Confidentiality

Spell out what data can and cannot be shared with AI systems. This matters enormously for insurance: data breaches involving AI tools are a growing trigger for coverage exclusions. Classify your data into tiers (public, internal, confidential, restricted) and map each tier to what AI interactions are permitted.

6. Incident Reporting and Response

Define what constitutes an AI incident (errors in outputs, data exposure, compliance violations, copyright claims) and create a clear reporting chain. Include:

Who to contact (name, role, email, phone)
Reporting deadline (24 hours is standard)
Documentation requirements (what happened, what tool, what data was involved)
Immediate containment steps

7. Employee Acknowledgment and Training

Every person covered by the policy must sign an acknowledgment confirming they have read, understood, and agree to comply. This signed form is your evidence that you exercised reasonable oversight — critical for both insurance claims and legal defense. Schedule annual refresher training and re-acknowledgment.

Generate Your AI Policy in 5 Minutes — Free

Our free AI policy generator asks you 10 questions about your business and produces a customized, ready-to-sign AI use policy. No email required.

Free AI Policy Generator Full Governance Kit — $29

The free generator creates one policy. The $29 kit includes 5 documents customized for your industry.

Free AI Policy Template for Small Business

Below is a complete, copy-and-paste AI policy template. Fill in the bracketed fields, customize the sections for your business, and have every employee sign it. This template covers the core areas that insurance carriers and regulators expect to see.

[COMPANY NAME] — ARTIFICIAL INTELLIGENCE USE POLICY

Effective Date: [DATE]

Version: 1.0

Policy Owner: [NAME / TITLE]

Next Review Date: [DATE + 12 MONTHS]

1. PURPOSE

This policy establishes rules and guidelines for the use of artificial intelligence tools and technologies by all personnel of [Company Name]. Its purpose is to enable productive use of AI while managing risk to the business, protecting customer data, maintaining insurance compliance, and meeting regulatory obligations.

2. SCOPE

This policy applies to all employees, contractors, freelancers, interns, and third-party agents who use AI tools in connection with [Company Name] business, regardless of whether the tools are provided by the company or accessed through personal accounts.

3. DEFINITIONS

• AI Tool: Any software or service that uses artificial intelligence, machine learning, large language models, or generative AI to produce outputs. Examples include ChatGPT, Microsoft Copilot, Google Gemini, Midjourney, and AI features embedded in business software.

• AI Output: Any text, image, code, data analysis, recommendation, or other content generated in whole or in part by an AI tool.

4. APPROVED AI TOOLS

The following tools are approved for business use:

• [Tool Name] — Approved for: [specific use cases] — Risk Level: [Low/Medium/High]

Use of any AI tool not listed above requires written approval from [Policy Owner / Manager Title] before use.

5. PROHIBITED USES

The following uses of AI tools are strictly prohibited:

• Entering customer personally identifiable information (PII), protected health information (PHI), or financial account data

• Sharing proprietary business information, trade secrets, or confidential data

• Using AI outputs as final work product without human review and approval

• Generating content that impersonates real individuals

• Making automated decisions that materially affect customers without human oversight

• Using unapproved AI tools for any business purpose

6. HUMAN REVIEW REQUIREMENTS

All AI-generated outputs must be reviewed by a qualified human before use in the following contexts:

• Client-facing communications or deliverables

• Published content (website, social media, marketing)

• Financial calculations, projections, or reports

• Legal, compliance, or regulatory content

• Any content that could affect business decisions

The reviewer is responsible for verifying accuracy, checking for bias, and confirming the output is appropriate for its intended purpose.

7. DATA PRIVACY

• Restricted Data (customer PII, PHI, financial records, passwords): NEVER enter into any AI tool

• Confidential Data (internal strategies, unreleased products, pricing): Do not enter unless the AI tool has an enterprise agreement with data protection guarantees

• Internal Data (general processes, non-sensitive operations): May be used with approved tools only

• Public Data (published information, marketing copy): May be used freely with approved tools

8. INCIDENT REPORTING

Any AI-related incident — including errors in outputs shared externally, suspected data exposure, compliance violations, or copyright/IP concerns — must be reported to [Policy Owner Name, Email, Phone] within 24 hours. Document the tool used, the data involved, the nature of the incident, and any immediate actions taken.

9. TRAINING

All personnel must complete AI use policy training within 30 days of this policy's effective date and annually thereafter. New hires must complete training within their first week.

10. ACKNOWLEDGMENT

I have read and understand this AI Use Policy. I agree to comply with all provisions and understand that violations may result in disciplinary action.

Employee Name: _________________________________

Signature: _________________________________

Date: _________________________________

Disclaimer: This template is provided for informational purposes only and does not constitute legal advice. It is designed as a starting point for small business AI governance. Consult with a qualified attorney to ensure your policy meets your specific legal and regulatory requirements.

How to Customize This Template for Your Business

A generic template gets you started, but it will not satisfy an insurance underwriter asking pointed questions at renewal. Here is how to make it yours:

Step 1: Audit Your Current AI Usage

Before you can write a policy, you need to know what AI tools your team actually uses. Send a simple survey or hold a 15-minute team meeting. Ask: “What AI tools do you use for work, how often, and what do you use them for?” You will almost certainly discover tools you did not know about. That is exactly why you need the policy.

Step 2: Classify Your Data

Map out what types of data your business handles. If you work with customer health records, financial data, or personal information, your AI policy needs stricter controls than a business working primarily with public information. The data classification in Section 7 of the template above should reflect your actual data landscape.

Step 3: Align With Your Insurance Requirements

Call your insurance broker and ask two specific questions: “Does my current GL policy have an AI exclusion endorsement?” and “What AI governance documentation would help us secure affirmative AI coverage?” The answers will tell you exactly what your policy needs to emphasize. If you want to understand the endorsement landscape first, read our guide on how Verisk CG 40 47 reshapes business insurance.

Step 4: Get Sign-Off and Distribute

Have your leadership team review the policy, then distribute it to every employee with a signed acknowledgment form. Store the signed forms — these are the documents you will need if a claim is ever disputed. Set a calendar reminder to review and update the policy every 12 months, or whenever you adopt a new AI tool.

Why a Free Template May Not Be Enough

The template above is a genuine, usable starting point. But insurance carriers and regulators increasingly expect more than a single document. A complete AI governance framework typically includes:

AI Acceptable Use Policy — the core document (the template above)
AI Tool Registry — a structured inventory of every AI tool, its risk level, data access, and approval status
AI Risk Assessment — a scored evaluation of your business's specific AI risk exposure
Employee Acknowledgment Forms — signed documentation that each employee has read and accepted the policy
Incident Response Plan — step-by-step procedures for handling AI-related incidents

Building all five from scratch takes most small businesses 20 to 40 hours, or $15,000 to $35,000 if outsourced to a consultant. That is why we built the CoverMyAI Governance Kit — it generates all five documents, customized for your industry and your tools, in under 15 minutes for $29.

Skip the Template. Get the Full Kit.

CoverMyAI generates a complete, customized AI governance framework — 5 documents pre-filled for your industry, your tools, and your insurance renewal timeline.

Free AI Policy Generator Get Full Governance Kit — $29

Consultants charge $15,000–$35,000. This takes 15 minutes.

The Insurance Angle: What CG 40 47 Means for Your Policy

If you are reading this because you are worried about insurance, you are right to be. Here is the short version of what happened:

In late 2025, Verisk — the organization that drafts the standard policy language used by most commercial insurers — released three new endorsements specifically addressing AI:

CG 40 47 — Total AI Technology Exclusion: excludes all claims arising from AI technology
CG 40 48 — AI Technology Limited Coverage: provides narrow, conditional AI coverage
CG 35 08 — AI Technology Amendatory: modifies how AI is treated in existing policy language

These endorsements became available for carriers to attach to policies starting January 2026. The practical effect: your general liability policy may no longer cover mistakes, damages, or lawsuits that involve AI — unless your carrier explicitly provides affirmative coverage.

What does this have to do with your AI policy template? Carriers offering affirmative AI coverage are looking at your governance posture. A documented AI policy, tool registry, and risk assessment signal that you are a manageable risk. No documentation signals that you are an unquantifiable risk — and carriers price or exclude accordingly.

5 Mistakes Small Businesses Make With AI Policies

Writing it and filing it away

A policy that sits in a drawer does not protect you. It needs to be distributed, signed, and actively referenced. Train your team on it.

Banning AI entirely instead of governing it

Outright bans do not work. Employees use AI anyway, and now they do it without guardrails and without telling you. Governance beats prohibition every time.

Forgetting to list specific tools

Vague language like “employees should use AI responsibly” is not a policy. Name the tools, name the use cases, name the prohibitions.

Skipping the acknowledgment form

Without signed acknowledgments, you cannot prove employees knew the rules. This is the single most important document if a claim goes to litigation.

Not reviewing the policy annually

AI is evolving fast. A policy written in January may be outdated by June. Set an annual review date — or update whenever you adopt a new AI tool.

Quick-Start Checklist: Your AI Policy in One Afternoon

&square;Survey your team to identify all AI tools currently in use
&square;Classify your business data into tiers (restricted, confidential, internal, public)
&square;Copy the template above and fill in all bracketed fields
&square;Customize prohibited uses for your industry and data types
&square;Have leadership review and approve the final policy
&square;Distribute to all employees and collect signed acknowledgments
&square;Send the policy to your insurance broker before your next renewal
&square;Set a 12-month calendar reminder to review and update

Or skip the manual work entirely: our free AI policy generator handles steps 3 and 4 automatically based on your answers to 10 simple questions.

Check your AI insurance risk for free

Take the 60-second AI Gap Check to see if your business is exposed to the new AI exclusions — and find out exactly what documentation you need.

Start Free Gap Check

AI Policy Template for Small Business: Free Download and Complete Guide (2026)