AI Policy Template for a Canadian Small Business (One Page, Free to Copy)

Somebody on your team has already pasted something they shouldn't have into a chatbot. A customer list, to deduplicate it. A contract, to get the summary. Last month's payroll, to check the totals. Not out of malice. Nobody ever told them not to.

An AI policy template fixes that in one page, provided it's written for a company of eight and not for a bank. Below is the one we give clients: six sections, built around the four Canadian rules that apply to a small business today. Copy it, date it, and send it to the team this afternoon.

The one-page AI policy template

Everything in square brackets is yours to fill in. Keep it to one page, and delete any line you wouldn't enforce.

[BUSINESS NAME] AI USE POLICY
Version: [DATE]. Owner: [NAME]. Next review: [DATE, 6 MONTHS OUT].

1. TOOLS WE USE
Approved: [E.G. COPILOT ON EVERY SEAT, CLAUDE TEAM FOR THE OFFICE].
Anything else, including a free personal account, needs a yes
from [NAME] first.

2. WHAT WE WANT YOU TO USE AI FOR
Drafting emails and replies. Summarizing meetings and long
documents. First drafts of quotes, job posts and social posts.
Sorting and cleaning data that has no names in it.
[ADD YOUR OWN].

3. WHAT STAYS OUT OF A PROMPT
- Customer names with contact, health or payment details
- Employee records: payroll, SINs, reviews, medical notes
- Passwords, banking logins, API keys
- Contracts or pricing a client shared in confidence
- [YOUR OWN, E.G. CLIENT FINANCIAL STATEMENTS]
If the job needs that data, remove the identifiers first
or ask [NAME].

4. A PERSON CHECKS IT BEFORE IT LEAVES
Anything a customer will read. Anything with a number in it.
Anything legal, medical or financial. The person who sends it
owns it. The AI does not.

5. WE SAY SO WHEN IT MATTERS
We tell customers when they are talking to a bot.
We do not use AI to screen job applicants without saying so
in the posting. Marketing email written with AI still needs
consent and an unsubscribe link.

6. WHEN SOMETHING GOES WRONG
Tell [NAME] the same day. Telling fast is not punished.
If personal information left the building, [NAME] decides
the next steps.

Signed: ______________  Date: __________

Section 2 sits ahead of section 3 on purpose. A policy that opens with prohibitions teaches people to hide their AI use, and hidden use is the outcome you're trying to prevent.

Four Canadian rules the template is built around

Canada has no AI-specific law for private business as of September 2026. The proposed Artificial Intelligence and Data Act died when Parliament was prorogued in January 2025, and the privacy overhaul introduced in June 2026, Bill C-36, was still at first reading when we wrote this. What applies today is older law pointed at a new tool.

PIPEDA. You're accountable for personal information wherever it travels, and a prompt is somewhere. The privacy regulators' principles for generative AI, published in December 2023, tell organizations to use anonymized or de-identified information in prompts where they can. They also say that accountability for a decision stays with the organization and not with the system. Sections 3 and 4 are that guidance in house language.

Quebec's Law 25. Serve customers in Quebec and one more duty applies. When a decision about a person is made entirely by an automated system, the person has to be told, and they can ask for a human to review it. A small business rarely automates a decision end to end. Section 4 keeps it that way.

CASL. A marketing email is a commercial electronic message whether you wrote it or Claude did. Consent, your identity and a working unsubscribe link are still required. Section 5 says so, because AI makes it easy to send a lot of email quickly.

Ontario's job posting rule. Since January 1, 2026, an Ontario employer with 25 or more employees has to state in a public job posting when AI is used to screen, assess or select applicants. The province's guide to the rule says a plain statement is enough. Under 25 staff the rule doesn't bind you, and saying so anyway costs one sentence.

Fill in the blanks in ten minutes

Three of the blanks carry most of the weight.

The tool list. Write down what people use today, including the free accounts nobody approved. A tool you didn't sanction can't be governed by a page that pretends it doesn't exist. For each consumer plan on the list, turn off model training. In Claude that's Help Improve our AI models under Settings > Privacy. In ChatGPT it's Improve the model for everyone under Settings > Data controls. Business and team plans come with terms that rule training out.

The stays-out list. Start from the data you hold, not from a generic list. A bookkeeping practice adds client financial statements. A clinic adds anything about a patient's health. A trades company adds customer addresses paired with alarm or gate codes. Each entry gets its approved alternative, which is usually the same job with the names removed. Our guide to protecting customer data when you use AI covers the removing part step by step.

The name. One person owns the page and hears about incidents. In a company of six, that's you.

If you'd rather have the page written around your own business, the AI Usage Policy Writer prompt interviews you and drafts it with your examples and a reason attached to every rule. Rules with reasons get followed.

Roll it out so people follow it

Don't email it and hope. Take ten minutes at the next team meeting and walk through it with examples first: here's the customer spreadsheet you'd keep out, here's the version with the names removed that you can use. Then ask what the page forgot. Someone will name a tool or a habit you didn't know about, and that answer is worth more than the meeting.

Post it where the team looks. If you're putting Copilot or another assistant on every seat, hand out the policy the same day as the licences; our Copilot rollout guide puts the ground rules in week one for that reason. If you hire with AI help, the Hiring Assistant skill builds the scoring rubric before any application is read and requires your review before a rejection goes out, which is the practice section 5 asks for.

When a near miss happens, add it to the examples that same week, while it's still a story.

Where this breaks

A one-page policy is house rules. It isn't legal advice, and it doesn't replace the privacy policy your customers read. If you hold health records, act for clients under a professional regulator, or give financial advice, have a lawyer read the page before you rely on it. Those fields carry rules this template doesn't know.

It does nothing unenforced. A policy on file that nobody follows is evidence that you knew the risk and let it ride. Short and enforced beats thorough and ignored.

The tools move, too. Vendors have changed their training defaults before, so check the two settings above every quarter and keep the next review date at the top of the page.

Where to start

Copy the template, fill in the blanks, and date it today. If the open question is which assistants deserve a seat in the first place, the SME AI Starter Stack covers that choice. This page covers how the seats behave.