Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsA workable shadow AI policy gives employees a clear list of approved tools and tasks, draws specific boundaries around business data, and provides a quick way to request approval for something new. A blanket ban can leave staff without a practical approved route; unrestricted use can expose information and work product to risks associated with third-party generative AI. The term “shadow AI” here means employee use of AI services or features the business has not reviewed, approved, or placed under workplace rules. It is a practical label, not a formal definition in NIST’s guidance.
What should a small-business shadow AI policy cover?
Set rules for the business use of AI tools and features, including standalone services, browser extensions, plugins, APIs, and AI embedded in software the company already uses. Define which workers and contractors are covered, whether company or personal devices are in scope, and who owns the policy. Tailor the scope to the business rather than assuming every AI feature or personal use presents the same risk.
As an Amazon Associate I earn from qualifying purchases.
NIST’s Generative AI Profile recommends governance practices that include acceptable-use policies, data protection, data retention, education, monitoring, and incident response. It also describes risks associated with third-party generative AI. These points can inform a policy, but NIST does not mandate this particular template or prescribe one universal set of rules. The profile, NIST AI 600-1, was published July 26, 2024. Read NIST’s Generative AI Profile.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What should employees be allowed to do?
Approve tools for named tasks, not as an open-ended endorsement of everything a service can do. For example, a reviewed service might be allowed to help draft internal, low-sensitivity text, while customer-facing use or access to business systems requires separate approval. The right boundaries depend on the information involved, the provider’s practices, company obligations, and the consequences of an error.
#1 Best Overall
- List each approved tool or service type, allowed tasks, permitted users, data restrictions, accountable business owner, approval date, and next review date.
- Require employees to check generated content before relying on it, sending it to a customer, publishing it, or using it in a consequential business decision. Set a more rigorous review for higher-impact uses.
- Use company-managed accounts where available, minimize the information entered, and disclose AI assistance when required by company policy, a client, a contract, or applicable law.
- Require approval before connecting an AI service to company email, storage, customer-management systems, code repositories, or other business systems.
Do not present generated output as verified fact without checking it. Keep a human employee accountable for decisions; an AI tool’s output does not transfer responsibility from the business or the person using it.
What data should employees keep out of unreviewed AI tools?
Tell employees not to enter sensitive or protected business information into an unreviewed service. Make the examples specific to the company’s data and obligations. Possible categories include customer records, personal information, credentials, confidential plans, source code, and third-party material the business is not authorized to share. NIST identifies privacy, information-security, and intellectual-property risks, but it does not provide a universal prohibited-data list for every company.
Where a tool is approved for limited use, specify exactly what data it may receive and any conditions that apply. Data minimization is a practical default: give the tool only the information needed for the approved task, and remove identifying or confidential details when feasible. Check provider collection and retention practices before employees use a service with business information.
Free tools Windows power users keep installed
One-click scans. No signup required.
What should a business ban, allow, and monitor?
| Policy area | Allow or require | Restrict or prohibit | Monitor or review |
|---|---|---|---|
| Tools | Tools reviewed and approved for specified work tasks | Unreviewed tools for protected business information | Approved-tool list, accountable owner, terms, and material feature changes |
| Data | Low-sensitivity inputs only where the tool and task are approved; minimize what is shared | Credentials, sensitive customer or employee data, confidential plans, or protected third-party content in unreviewed services | Exceptions, reported disclosures, and changes to provider data practices |
| Output | Drafting, brainstorming, summarizing, or other approved assistance with employee review | Relying on generated material as authoritative without checking; unlawful or harmful use | Quality checks appropriate to the task, incidents, and recurring failure patterns |
| Integrations | Reviewed extensions, plugins, APIs, and embedded AI features | Connecting business systems or granting data access without approval | Access scope, changes, and whether the access remains necessary |
| Staff conduct | Training, a clear approval path, and incident reporting | Sharing accounts or bypassing company controls | Training completion and policy exceptions, with appropriate notice and access limits |
This is a practical framework based on NIST’s risk categories, not a ready-made compliance checklist. NIST notes that third-party GAI integrations can raise intellectual-property, privacy, and information-security concerns. NIST AI 600-1 discusses these risks and related governance practices.
How should employees request approval for a new AI tool or use?
Give employees one contact or form and name an owner who can make and record decisions. A request should describe the intended task, users, data involved, and any connection to company systems. The reviewer can then assess the provider and set conditions, rather than leaving the employee to guess whether a tool is acceptable.
- Describe the use. Identify the service, the work task, intended users, and expected benefit.
- Map the information flow. State what data will be entered, what business systems the service will access, and what information it may return or store.
- Review the provider and integration. Consider data collection and retention, access and security controls, service terms, intellectual-property and privacy implications, and the scope of any extension, plugin, or API connection.
- Record the decision. Approve, reject, or request changes; document permitted users, tasks, data limits, safeguards, the accountable owner, and a review date.
- Reassess material changes. Review approval if the provider changes its terms or features, the proposed use expands, an incident occurs, or applicable obligations change.
NIST recommends addressing intellectual-property, privacy, security, and ongoing monitoring in due diligence for third-party AI. The business can use its existing purchasing and security processes where they fit, rather than building a separate bureaucracy for every request. NIST’s profile provides the relevant guidance.
How can a small business monitor AI use responsibly?
Explain in the policy what business systems or records may be reviewed, why monitoring is done, who may access resulting records, and how access is limited. Monitoring should be proportionate to the business’s risks and actual capabilities; it need not mean inspecting every employee interaction. Before implementation, check applicable employment, privacy, and other laws, which vary by jurisdiction and business context.
Pair monitoring with a simple reporting route. Employees should know whom to contact if they accidentally submit protected information, encounter unsafe or materially incorrect output, or discover an unapproved AI integration. Define who receives the report and how the business will contain the exposure, assess impact, and decide on follow-up. NIST includes monitoring and incident response among its governance practices; the exact process is for the business to tailor.
How can a small business put the policy into practice?
Start with a manageable first version: take stock of known AI use, publish a short approved list and data rule, assign one accountable owner, and make it easy to ask before adopting a new service. Train staff with examples drawn from their work, invite questions, and keep the list current. Use existing security, purchasing, and incident-reporting routines when practical.
NIST’s CSF 2.0 Quick-Start Guides include resources for small businesses, including those with modest or no cybersecurity plans. The page was updated August 25, 2026. NIST’s AI Risk Management Framework is voluntary guidance, not a law or certification. Its overview says version 1.0 is being revised, so consult the official pages for the latest status rather than treating a version as permanently current. NIST CSF 2.0 Quick-Start Guides and NIST AI Risk Management Framework.
For organizations that need more technical implementation detail, NIST’s Control Overlays for Securing AI Systems project describes guidance for different AI types and components, including generative AI assistants and agent systems. It is not presented as a small-business policy template. NIST Control Overlays for Securing AI Systems.
Copy-and-adapt policy template
Replace each example with the company’s actual tools, tasks, data rules, owners, and reporting route. Have the policy reviewed for the business’s industry, contracts, workforce, data, and jurisdiction; this template is not legal advice.
Best Value
- Easy To Track Your Finances: HAUTOCO horizontal accounting ledger book keeps you on top of your expenses and income! Help you keep your money organized, spend well, and set and achieve financial goals
- Practical Design: The accounting book is PU leather hardcover, with double-wire spiral binding that allows it to lay flat 360°; 100gsm thick paper, comes with an elastic band, pen loop, bookmarks, and 2 large pockets for storing loose notes
- Plenty of Space: The expense tracking notebook measures 10.78 x 8'' and has 120 pages with 3000 lines of entries giving you enough space to record each of your transactions
- Manage Your Finances Effectively: Undated accounting books with number, date, description, account, payment or deposit amount, and total balance. You will be able to easily analyze your financial activities and quickly prepare accurate financial statements
- Ideal For Small Business or Personal Use: An accounting log journal can track your business or personal financial status. With a clear record of transactions, you can find unnecessary expenses or fraudulent charges
Purpose and scope
This policy covers business use of AI services and AI-enabled features by [covered employees and contractors] on [covered devices and accounts]. It applies to [standalone services, embedded features, extensions, plugins, APIs, and other relevant integrations]. Personal use is [in scope / out of scope] when it involves company systems or information.
Approved tools and uses
Use only tools listed in [location of approved-tool list] for the tasks and users stated there. Each listing identifies permitted data, an accountable owner, approval date, and next review date. Contact [approval owner or route] before using a different tool, expanding a use, or connecting a service to company systems.
Data and prohibited uses
Do not submit [company-specific sensitive data categories] or protected third-party information to an unreviewed service. Do not share credentials, bypass company controls, or connect an AI service to business systems without approval. Do not present unchecked AI output as verified fact or use it for [company-specific prohibited or restricted purposes].
Safeguards and accountability
Use company-managed accounts where available and provide only the data needed for the approved task. Check material output before relying on it, sending it externally, publishing it, or using it in a consequential decision. Disclose AI assistance when [company, client, contract, or legal requirement] calls for it. The employee responsible for the work remains accountable for the result.
Approval, monitoring, and reporting
Send tool or use requests to [contact or form]. The reviewer considers data flows, provider collection and retention, security and access controls, terms, integration scope, and a suitable fallback. The business may review [systems or records] for [stated purposes]; access is limited to [authorized roles] under [applicable safeguards and notice]. Report accidental disclosure, unsafe output, or an unapproved integration to [reporting contact or route] promptly.
Training and review
[Policy owner] provides training using job-relevant examples and reviews this policy and approved-tool list when provider terms or features change, new uses are proposed, incidents occur, or relevant obligations change. The next scheduled review is [date].
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
