AI usage policy for staff: a copyable template for SMEs

Your staff are probably already using AI at work. Someone drafts customer emails in ChatGPT on their phone, someone asks Meta AI inside WhatsApp to rewrite a message in Hindi, and someone pastes a supplier contract into a free chatbot to get a summary. Most of this is helpful. Some of it quietly sends customer data, prices or confidential documents into tools the business does not control.

A one-page AI usage policy fixes most of this without slowing anyone down. This guide explains what the policy needs to cover, how to choose approved tools, and gives a template you can copy and adapt. It is general information for small businesses, not legal advice.

Why a small business needs an AI policy now

Three practical risks show up again and again:

Data leaving the business. Customer lists, Aadhaar and PAN copies, salary sheets, patient notes and client files end up in personal AI accounts, where the business has no control over retention or training settings.
Wrong answers reaching customers. AI tools write confident text that can include wrong prices, invented clauses, outdated tax rules or incorrect product specifications. If it goes out under your name, it is your mistake.
Undisclosed automation. Customers who think they are chatting with a person, or who see AI-generated “real” product photos, lose trust when they find out.

The legal background is also changing. Under the Digital Personal Data Protection Act 2023 and the DPDP Rules 2025, a business that decides how personal data is used is responsible for it, including what its vendors and tools do with it. Most obligations, such as notice, consent, security safeguards and breach intimation, apply from around May 2027. A written AI policy is a simple, visible step towards the security and accountability the law expects.

What the policy should cover

Keep it short enough that people actually read it. Five parts do most of the work:

Approved tools. Which AI tools staff may use for work, with which account, and how to request a new one.
Data rules. What may, may not and must never be put into an AI tool. A green, amber and red list is easier to follow than legal definitions.
Human review. AI output is a draft. Name the kinds of work that always need a second pair of eyes.
Disclosure. When customers must be told that AI is involved, and what must never be faked.
Incidents. What to do, and whom to tell, when something goes wrong.

Add an owner (one named person who approves tools and answers questions), a review date, and a line for staff to sign.

Choosing approved tools

The biggest single improvement is moving work from personal consumer accounts to business accounts the company controls. Business tiers typically offer an admin console, the ability to remove access when someone leaves, and contractual commitments about data use.

What the major vendors state for their business products:

Google Workspace with Gemini (₹540–₹2,050/user/month Per user/mo excl. tax, annual plan vs flexible: Starter ₹540/₹650, Standard ₹1,080/₹1,300, Plus ₹1,700/₹2,050. Max 300 users. 14-day trial.; indicative, checked Sept 2026): Google’s privacy hub says Workspace does not use customer data for training models without the customer’s prior permission or instruction, and that interactions with Gemini stay within the organisation. This applies to qualifying Workspace editions, not personal Google accounts.
Microsoft Copilot (₹1,745–₹2,094/user/month (free tier available) Copilot Business add-on ₹1,745/user/mo paid yearly (promo ₹1,495.73 till 31 Dec 2026) or ₹2,094 monthly; GST extra. Needs M365: Basic ₹170, Standard ₹860 (yearly).; indicative, checked Sept 2026): Microsoft’s documentation says prompts and responses under enterprise data protection are not used to train foundation models, and Copilot respects the organisation’s permissions and retention settings. Copilot Chat is included with eligible Microsoft 365 business plans when staff sign in with their work account.
Claude Team (₹1,632–₹2,400/user/month (free tier available) USD at ₹96/USD, excl. tax: Pro $17/mo billed yearly or $20 monthly; Team standard seat $20 yearly or $25 monthly per user (2-150 users). Max from $100/mo.; indicative, checked Sept 2026): Anthropic states that, by default, it does not use inputs or outputs from its commercial products to train models.
ChatGPT Business (₹1,800–₹2,250/user/month Standard seat ₹1,800/user/mo billed annually or ₹2,250 billed monthly, excl. 18% GST; min 2 users. Premium seat (5x usage) costs more. UPI not offered for Business.; indicative, checked Sept 2026): OpenAI’s business workspace adds admin controls and does not use business data for model training by default.

Consumer plans such as the free and individual tiers of ChatGPT (₹399–₹1,999/month (free tier available) Go ₹399/mo, Plus ₹1,999/mo, incl. GST (India pricing). Pro tiers cost more. India 12-month free Go promo ended 21 Jan 2026. Go plan may include ads.; indicative, checked Sept 2026), and Meta AI inside WhatsApp (Free Everyday use is free. Paid Meta One bundles (from US$7.99/mo globally; India price not verified) add more AI usage. Hindi support documented by Meta.; indicative, checked Sept 2026), are built for individuals. Depending on the tool and its settings, conversations may be kept, reviewed or used to improve models, and the business cannot manage the account. They are fine for general questions with no business data, which is exactly what the policy should say.

If you already pay for Google Workspace or Microsoft 365, start there: the AI features may already be included in your plan or cost less than a separate subscription. For document question-answering, Gemini Notebook (₹399–₹1,950/month (free tier available) Free with a Google account: up to 50 sources per notebook, compute-based usage limits from 2 Sep 2026. Higher limits via Google AI Plus ₹399 or AI Pro ₹1,950/mo, or Workspace.; indicative, checked Sept 2026) on a Workspace account keeps sources within the organisation’s commitments.

Whatever you choose, read the current data-processing terms, note where data is stored, and record each approved tool in a simple register: tool, plan, owner, what data it may hold, and who has access.

The template

Copy the text below into a document and replace everything in square brackets. Keep it to one or two pages.

AI usage policy: [Company name]

Version [1.0] · Effective from [date] · Owner [name, role] · Next review [date]

1. Purpose and scope. This policy explains how everyone who works for [Company name], including employees, interns, freelancers and contractors, may use AI tools for work. AI tools include chatbots, writing and translation assistants, transcription tools, image and video generators, and AI features inside other software. It applies on company devices and on personal phones or laptops used for work.

2. Approved tools. Use only these tools for work, signed in with your company account:

[Tool and plan], for [drafting, summarising, translation]
[Tool and plan], for [meeting notes, spreadsheets]
[WhatsApp provider or chatbot], for [customer replies, as configured by the owner]

Personal AI accounts may be used only for general questions that contain no company, customer or employee information. Any other AI tool, app or browser extension needs written approval from [owner] before it is used with company information.

3. Data rules.

Green: allowed in approved tools. Public information, published marketing material, general questions, and text with names and numbers removed.
Amber: approved business tools only, minimum necessary. Internal documents, draft proposals and quotations, price lists, supplier terms, and customer or employee names without contact or identity details.
Red: never, in any AI tool, unless [owner] has approved a specific tool and process in writing. Aadhaar, PAN, passport and bank or card details; passwords and OTPs; health information; children’s and students’ data; customer or employee lists with phone numbers or addresses; salary and HR records; client files covered by confidentiality or an NDA; login credentials and source code.

Before pasting any document, remove or mask names, phone numbers, account numbers and addresses. If in doubt, treat it as red and ask [owner].

4. Human review. AI output is a draft, and the person who sends it is responsible for it. Check every fact, figure, price, date, name, and legal or tax statement against the original source. Never send AI-written text directly to a customer, bank, government office or court without reading it fully. Decisions about people, such as hiring, credit, discipline or admissions, are made by a person. These always need a second reviewer: [contracts, tax filings, export or shipping documents, medical or safety instructions, public statements and advertisements].

5. Disclosure. Customers must be told when they are chatting with a bot or AI agent, and must always be able to reach a person. Automated calls must say they are automated. Do not present AI-generated images, voices or reviews as real products, real people or real results. Do not use AI to imitate a real person’s face or voice without their written consent. Follow any client contract that requires disclosure of AI use.

6. Accounts and access. Use company accounts with strong passwords and two-step verification. Do not share logins. When someone leaves, [owner] removes their access to AI tools on their last day, and shared chat histories are reviewed.

7. Incidents. Tell [name and phone number] immediately, and on the same day at the latest, if you put red data into any AI tool, if AI-generated content with a serious error reaches a customer, or if you suspect an AI account has been accessed by someone else. Do not delete the chat or evidence. [Owner] decides whether affected people, the Data Protection Board or CERT-In must be informed, since some reporting deadlines are very short.

8. Acknowledgement. I have read this policy and will follow it. Name, signature, date.

Rolling it out in a small business

Explain it in person. A twenty-minute meeting with real examples from your business works better than an email. Show one green, one amber and one red example.
Translate it. If staff are more comfortable in Hindi, Gujarati, Tamil or another language, give them a translated version. AI can draft the translation; a fluent colleague should check it.
Pay for the approved tool. If you ban personal accounts but provide nothing better, staff will keep using personal accounts.
Make asking easy. Name one person who answers “can I paste this?” questions quickly, on WhatsApp if that is how your team works.
Review twice a year. Tools change their features, plans and data terms often. Update the approved list and the register, and ask staff to re-sign.

If you want a written plan for which AI tools to adopt first and what they will cost, AI Marga generates an AI roadmap for your business from a short questionnaire for ₹1,999. It is produced by software, not by people, and it is not legal advice.

Frequently asked questions

Is this template legally sufficient for DPDP compliance?

No. It is general information, not legal advice. A staff AI policy is one useful control, but DPDP compliance also needs notices, consent, security measures, vendor contracts, breach procedures and a way to handle data requests. Ask a lawyer or company secretary to review your full setup before the main obligations apply from around May 2027.

Should we simply ban ChatGPT and similar tools?

Bans rarely work in small businesses, because staff already have these apps on their phones. It is usually safer to approve one or two business-grade tools, pay for accounts where needed, and be clear about which data must never go into any AI tool. That moves use from hidden personal accounts to accounts you control.

Are free AI chatbots unsafe for work?

Not always, but consumer plans are designed for individuals. Depending on the tool and settings, conversations may be kept for longer, used to improve models, or reviewed, and you have no admin control over them. Business plans from Google, Microsoft, OpenAI and Anthropic state that customer data is not used for model training by default. Check the current terms of any tool you approve.

Do we have to tell customers that a reply was written with AI?

There is no general Indian rule requiring a label on every AI-assisted email. It is good practice, and sometimes required by a contract or sector rule, to tell people when they are talking to a bot or an automated caller, and never to present AI-generated images or reviews as real. The template treats disclosure as a company rule for exactly those cases.

How often should the policy be updated?

Review it every six months, and whenever you add a new AI tool, a tool changes its data terms, or something goes wrong. Keep version numbers and dates, and ask staff to re-confirm they have read the new version.

Sources

knowledge.workspace.google.com: https://knowledge.workspace.google.com/admin/gemini/generative-ai-in-google-workspace-privacy-hub
learn.microsoft.com: https://learn.microsoft.com/en-us/copilot/microsoft-365/enterprise-data-protection
privacy.claude.com: https://privacy.claude.com/en/articles/7996868-is-my-data-used-for-model-training
prsindia.org: https://prsindia.org/billtrack/digital-personal-data-protection-bill-2023

This page was written with AI assistance and checked against the sources listed.