The firms getting hurt are the ones with nothing written down
IBM tracked breach costs across 602 organizations through February 2026. Three of its findings are worth putting in front of anyone who thinks a policy can wait.
68%
of breached organizations had no AI governance policy in place. A third had none at all, a third were still drafting one.
43%
of breached organizations had a shadow AI incident, more than double the share a year earlier.
92%
of organizations that suffered an AI-related breach had no access controls on their AI models and data.
$7,500
the California penalty per intentional violation, which now reaches how you use automated decisionmaking.
First three figures from IBM’s 2026 Cost of a Data Breach Report, 602 organizations studied March 2025 to February 2026. The penalty is the CCPA maximum for an intentional violation, enforced by the California Privacy Protection Agency and the Attorney General.
What a real policy covers
Eight sections, and what each one has to settle
Most templates cover three of these and stop. The other five are where the trouble starts. Open any row for what it needs to say.
1
Which tools are approved, by name
A named list, not a category. Microsoft 365 Copilot and ChatGPT Enterprise are different products from the free consumer versions, and the policy has to say which one is allowed. It also needs a route for someone to request a tool that is not on the list, or people will just use it quietly.
2
What data never goes into a prompt
Client confidential material, personal information about employees or customers, credentials and keys, unreleased financials, and anything under an NDA that does not permit third party processing. Write the list in the words your staff actually use for those files.
3
Human review before anything reaches a client
Name who signs off on AI-assisted work that leaves the building, and what they are checking for. Accuracy, made-up citations, and anything that reads as advice.
4
When you disclose that AI was involved
Some clients require it by contract, and some candidates now have to be told. Decide the rule once and write it down, so nobody has to guess.
5
Hiring and HR use, handled separately
This is the highest-risk use in the business and now the regulated one in California. If a tool screens, ranks or scores applicants, the policy needs its own section covering testing, records and who approved it.
6
What the vendor does with your prompts
Whether the tool trains on your input, where it stores data, how long it keeps it, and who else can see it. The answer often differs between the free tier and the paid tier of the same product.
7
What happens when something goes wrong
A person pastes a client file into a consumer chatbot. Someone ships a draft with an invented citation. The policy needs the same reporting path as any other incident, and using it has to be safe. Otherwise nobody reports anything.
8
Who owns it and when it gets reviewed
One named owner and a fixed review date. The tools change every few months, so a policy written once and filed will be out of date within a year.
What California now requires
Two sets of rules, and a four year paper trail
Most AI policy advice is written for a company with a legal department. If you employ people in California, two specific rules already apply to you. Both are about records as much as behavior.
1 October 2025
FEHA automated decision systems
Where an automated system filters or grades candidates and the result turns out to be unfair, liability sits with the employer even if nobody intended it. The rules reach any computational process that makes or assists an employment decision, not just machine learning. Bias testing is not strictly mandated, but its quality, scope and recency get weighed if you are ever defending a claim, and the absence of any is itself a problem. Records go back four years.
1 January 2026
CPPA automated decisionmaking
Pre-use notices, at least two ways to opt out with a human alternative, access to the logic and outputs on request, and a risk assessment before you use the technology for a significant decision. New businesses comply on adoption. Existing businesses have until 1 January 2027 for full implementation, with reviews at least every three years and updates within 45 days of a material change.
Neither rule asks you to stop using AI. What they want is a record of what you use and who checked it, and a written policy with a named owner is where that record starts.
At renewal
What do AI exclusions mean for a design firm’s policy?
Two policies, two different conversations. Your professional liability cover and your cyber cover are usually written by different carriers, renew on different dates, and are picking up AI language separately. Treating them as one is how a firm ends up answering the wrong question on the wrong form.
On the professional liability side the market has already moved. The Ames and Gough 2026 survey of the insurers writing architect and engineer professional liability found that eight in ten of them regard design firm AI adoption as a potential disruptor of that market. Exclusions and application questions follow from a view like that, and they will arrive at your renewal before your firm has necessarily settled how it wants to use the tools.
On the cyber side the questions are narrower and more operational: which tools are approved, who is allowed to send what into them, and what happens to the output. The cyber insurance readiness page covers that renewal in full.
What both carriers accept as evidence is the same document. A written acceptable use policy, with a named owner, a review date and training records against it, is what turns a general assurance about being careful with AI into something an underwriter can price. Architects and engineers carry the extra weight of a professional standard of care, so the policy also has to say who checks AI output before it reaches a drawing set or a calculation.
If your renewal is inside ninety days, start with the readiness work and let the policy come out of it. If it is further off, write the policy first and have the evidence ready.
How the work runs
Four steps, two to three weeks
The order matters. Writing the document first is the mistake almost everyone makes.
Look before you draft
We check what your people are using before a word gets drafted, so the rules name the tools in the building instead of a generic list. The exhaustive version of that, with risk tiering and your vendor contracts read, is the readiness assessment.
Draft it against your actual work
A policy for an engineering firm reads differently from one for an accounting practice. We write it around the files your people handle and the clients they answer to, then keep it to a length someone will finish.
Train the team on it
We walk the team through what changed, why, and the two or three situations they will hit in the first month.
Set the review date and hand it over
One named owner, a fixed review date, and the records California expects you to keep. You own the document afterward, not us.
Take it with you
The template, ready for your tool names
Everything on this page as an editable document. Eight sections, each annotated with what to fill in and why, California hiring language included. Add your own tools and it is ready to circulate.
Get the template
Common questions
What should a small business AI acceptable use policy include?
A named list of approved tools, and a clear line on what may never be pasted into one. It has to say who signs off before AI-assisted work reaches a client, and it needs its own section for anything touching hiring, because California regulates that one. Then what each vendor may do with your prompts. A way to report a mistake without anyone getting fired for it, and one person's name against the document with a date to review it. Eight sections, written in the words your staff already use.
Do we actually need one, or is this a nice to have?
Your people are already using AI. Without a policy, each of them is deciding for themselves what is acceptable. California made an employer liable in October 2025 for an automated tool that screens applicants unfairly, and client contracts increasingly ask what your policy is, so the document has started showing up in due diligence.
Can we just download a template?
You can, and it is a reasonable start. A template cannot name your approved tools or know which of your files are confidential, and it will not cover the hiring rules that apply to a California employer. The guide on this page is free and so is the template. Turning it into something your firm will follow is the work.
Does an AI policy affect our insurance?
It is starting to. Carriers are adding AI exclusions and questions about AI use to professional liability and cyber applications, and a documented policy is the evidence you have of governance. The controls and the paperwork overlap with a cyber insurance renewal more than most firms expect.
What does California require of employers using AI?
Two things so far. Since October 1, 2025, the FEHA automated decision system rules make an employer liable if a tool screens people unfairly, even unintentionally, and require four years of records. The CPPA automated decisionmaking rules took effect January 1, 2026, with full implementation required of existing businesses by January 1, 2027.
How long does this take?
Two to three weeks for most firms. The inventory is the slow part, and the drafting is fast once we know what is in use.
Want it written for your firm?
A fifteen-minute call is usually enough to tell you what your policy is missing.
