A one-page staff AI policy for small businesses

In the last two weeks, ChatGPT added two features that change what happens to work your team does in it: Slides, for building presentations (October 16, 2026), and locked chats, which hide conversations behind a PIN (October 20, 2026). Neither is a problem on its own. Both are a good reason to write down, on one page, how your business uses AI.

Why does a small business need an AI policy now?

Because your staff are almost certainly using AI already, whether or not you have said anything. In Gallup's survey of 22,573 employed US adults (May 6–20, 2026), 52% said they use AI in their role, and 15% said they use it daily.

Clear rules also go with more use, not less. In Gallup's February 2026 study of 23,717 US employees, 68% of those who strongly agreed their organization had clear AI policies used AI frequently, against 47% of those who did not.

A policy does not need to be long. It needs to answer five questions every employee has: which tools, which account, what data, who checks the output, and who to ask.

What changed in ChatGPT in the last two weeks?

Two features shipped that touch where your company's work lives and who sees it.

The locked-chats details matter most. OpenAI's help center (October 2026) says:

• Resetting the PIN permanently deletes all locked chats and files protected only by that PIN, and OpenAI Support cannot recover them.
• A workspace administrator cannot reset an employee's PIN or unlock their chats.
• Locking a chat does not change how long OpenAI keeps it.

Which account should staff use for work?

Company work belongs in a company account. OpenAI's help center (as of October 29, 2026) says data in a ChatGPT Business workspace is excluded from model training by default. On personal Free, Plus and Pro accounts, data sharing for training is switched on by default; users must turn off "Improve the model for everyone" under Data controls.

A personal account also means the work leaves with the person. If a client proposal lives in an employee's personal chat history — locked or not — you may have no way to get it back when they leave.

The same logic applies to any AI tool, not just ChatGPT: Claude, Gemini, Copilot and the AI features inside your existing software. Name the approved tools and the approved account type for each.

What should the one-page policy cover?

Seven short sections cover what a small team needs. Start with the approved tools, named, with the account type for each, and the rule that company work happens only in company accounts. Then the two lists people actually remember: what never gets pasted into an AI tool, and what a person always checks before anything leaves the building.

The last three sections are housekeeping that saves arguments later: where AI-assisted work gets saved so the business can find it, when to tell a client that AI helped, and one named person to ask when something is unclear or goes wrong. Keep each section to two or three lines. If the page runs past one side of paper, people stop reading it.

What does the template say?

Copy this, change the names, and print it.

[Company] AI use policy — effective [date]

1. Approved tools. You may use [tool and plan, e.g. ChatGPT Business] for work. Ask [name] before trying anything else.

2. Accounts. Use your company login. Never do company work in a personal AI account.

3. Never paste: Social Security numbers, bank or card numbers, passwords, medical details, signed contracts, or anything a client marked confidential.

4. Always check before it goes out: every number, date, name and promise in anything a client, supplier or regulator will see — including AI-made slides and emails.

5. Save work where we can find it. Don't lock work chats. Save finished work to [shared drive / CRM].

6. Be straight with clients. If a client asks whether AI was used, tell them.

7. Questions or mistakes: tell [name] the same day. Reporting a mistake quickly is always the right call.

How do you roll it out without a fuss?

A 30-minute team meeting is enough for most small businesses. Walk through the page, show where the approved tools live, and ask each person which AI tools they already use — you will learn something.

Then do three things. Move any active client work out of personal accounts within a week, while people still remember where it is. Put a reminder in your calendar to review the page every quarter, because the tools themselves change month to month — the two features above arrived four days apart. And add one line to your onboarding checklist so new hires see the policy on day one.

If you work in a regulated field — tax preparation, healthcare billing, insurance — check the page against the data rules you already follow. The policy should never allow something your existing obligations forbid.

How will you know the policy is working?

Track a few simple signals each quarter rather than policing every chat:

• Account coverage — share of staff using company accounts for work (aim for all of them).
• Near misses — times sensitive data was pasted, or an unchecked AI draft reached a client.
• Time saved — ask each person which task AI now speeds up, and by how much.
• Questions asked — if nobody asks the named person anything, the page is probably being ignored.

A written policy also prepares you for the next step: handing a whole repetitive workflow to AI, with rules, logs and a person on exceptions. That is a different job from staff using chat tools — we explain the difference in what is an AI operator and managed AI vs DIY AI, and you can see how it works in practice on the Operator page.

For a fuller plan — which workflows to start with, what to measure, how to budget — download the AI handoff playbook, or book a consultation if you would like help applying it.