Company AI usage policy: a practical template for small and midsize businesses

An AI usage policy is the document that defines which tools the team can use, with which data, for which tasks and who reviews the output. It protects customers, the brand and sales information without slowing work down. In small and midsize businesses, two clear pages are usually enough.

The right text isn't born in the legal department. It comes from a practical question: what happens today when a sales rep pastes the customer list into a personal account to ask for an analysis? If the answer is "I don't know," the company is already using AI without rules. This mostly affects marketing and sales, the areas that handle the most customer data and speak on behalf of the brand. Here's how to write a policy the team can actually follow.

Why should marketing and sales be the starting point?

Three risks are concentrated in these areas:

• Customer and lead data. Lists, conversations and proposals contain personal data and sensitive sales information.
• Promises on the company's behalf. AI-generated text can invent a term, a product feature or a number, and that goes to the customer under your brand.
• Automation with direct contact. An agent replies on its own, without review, at scale.

There's also the opposite risk. Banning everything pushes usage into personal accounts, where the company can't see anything. A good policy authorizes the safe path and makes it easy to follow.

What does the policy need to contain?

Eight blocks cover the essentials:

How do you classify data in three colors?

This is the most useful part of the policy. Use a traffic light anyone can understand without asking someone:

A useful trick: before pasting something, remove names, phone numbers, CNPJ (Brazil's company tax ID) and specific amounts. "Customer in the construction sector, high average ticket, objection about delivery time" can be analyzed without exposing anyone.

It's worth checking each tool's terms to see whether the data you send is used to train models and who can access it. Free and corporate plans may have different rules. This becomes part of the criteria for authorizing a tool, and the check needs to be redone whenever the terms change.

What does LGPD require in this context?

The policy doesn't replace compliance with the LGPD, Brazil's General Data Protection Law, but it needs to work alongside it. Three points of the law are especially useful:

• Art. 46: processing agents must adopt technical and administrative security measures to protect personal data. Access and tool rules are part of that.
• Art. 20: the data subject can request a review of decisions made solely on the basis of automated processing that affect their interests. If AI decides something important about a person, define how that review happens.
• Art. 41: the controller must appoint a data protection officer, the channel between the company, data subjects and the national authority.

This text is not legal advice. Validate the final version with whoever advises the company. For the specific use in conversations, read LGPD and AI on WhatsApp.

Take Nexo's free assessment and see where your sales operation is using AI without rules or measurement.
Take the free assessment

Which uses should you permit and prohibit in marketing and sales?

Concrete lists work better than principles. A starting point:

Permitted, with human review:

• creating drafts of ads, emails and posts;
• summarizing meetings that have already been authorized;
• preparing questions for a sales meeting;
• suggesting responses to objections;
• analyzing aggregated campaign data;
• researching public information about a market.

Prohibited:

• pasting customer lists or conversations into personal accounts;
• sending a generated proposal without checking price and timeline;
• publishing a number, study, testimonial or case study that hasn't been verified;
• recording or transcribing a conversation without following the company's authorization rule;
• creating testimonials, reviews or images that simulate real customers;
• using someone's voice or likeness without authorization;
• using AI as the sole criterion for decisions about people, such as hiring or firing.

Who reviews what?

Not every use requires the same level of care. Define review by risk:

The sentence that should apply to everyone: whoever sends or publishes is accountable for the content, whether a person or AI wrote it. That eliminates the "the tool got it wrong" argument.

How to write the policy in five steps

1. Run a survey without a witch hunt

Ask the team which tools they use, for what and with which data, making it clear no one will be punished. You need the real answer.

2. Choose the official tools

Shorten the list and provide corporate accounts. If the team uses something because it solves a real problem, offer an approved alternative. A rule without an alternative doesn't stick.

3. Write in plain language

Use sentences like "don't paste customer lists." Include real examples from the company and keep the text to two pages.

4. Present it with practice

Run a session with everyday cases. "Can this email go into the AI?" teaches more than reading the document. The next step is in how to train your team to use AI.

5. Name an owner and a review date

Tools change fast. Schedule periodic reviews and name who can approve exceptions. Record the team's acknowledgment, following guidance from legal or HR.

A short template to adapt

1. Scope. Applies to everyone who uses AI in the company's work. 2. Tools. Only those listed in the appendix, with a corporate account. 3. Data. Follow the green, yellow and red traffic light. When in doubt, treat it as red. 4. Review. Nothing goes to a customer or the public without human review, except approved automations. 5. Accuracy. Numbers, studies, prices and promises must have a verified source. 6. Transparency. Customers are informed when they're talking to a virtual assistant. 7. Automations. Every automation has a named owner and a way to be paused. 8. Incidents. Data sent by mistake or an error with a customer? Notify [owner] the same day. Reporting quickly is not punished.

The last item matters. If people who make mistakes are afraid, the incident stays hidden and the damage grows.

How does the policy apply to an agent in production?

Automations require extra care, because no person is reviewing each answer. Before turning on an agent that talks to customers, answer five questions in writing:

1. Who owns the agent?
2. Which subjects can it handle and which are off-limits?
3. How does the customer reach a person?
4. Who reads the conversations, and how often?
5. How is the agent paused in case of error?

The last question often goes unanswered. Picture a campaign with the wrong price in the knowledge base, on a Friday night: someone needs to know where to switch it off and have permission to do it. Keep this record for every automation, in a single list. Before long, the company piles up flows nobody remembers creating, and each one talks to customers on behalf of the brand.

Common mistakes

• Copying a large company's policy that nobody reads.
• Banning everything and pretending usage has stopped.
• Not offering an official tool.
• Forgetting the automations in production.
• Writing it and never reviewing it.

Conclusion

An AI policy is a sales management tool: it lets you use more AI in marketing and sales with less risk to the brand and to customers. Short, concrete and with an owner, it becomes a habit.

Want to bring AI into your sales operation with rules and measurement? Take Nexo's free assessment.
Take the free assessment

To decide where to start, read AI in company management. To implement automation with rules in your sales process, see AI-powered sales automation.