Key takeaways
- FTC Act Section 5 (ftc.gov/legal-library/browse/statutes/federal-trade-commission-act) prohibits unfair or deceptive practices: a business that sends a client an AI-generated email containing a false claim is liable under Section 5 regardless of whether the business has an AI policy. A written policy with a mandatory human review step is the documented control that reduces that liability. The policy's Section 4 (Required Human Review) is the section that directly addresses Section 5 risk.
- NIST SP 800-53 Rev 5 AC-6 (csrc.nist.gov/pubs/sp/800/53/r5/upd1/final) requires least privilege: each person and each system receives only the access rights needed to do its job. In Dave by voolama (hellodave.ai), this maps to six default roles: Admin, Create, Curate, Use, Reporting, and Financial. Roles are editable. Only Admin and Create roles can create agents and lock prompts. Only Admin and Curate roles can build workflows. Only Admin users can create, edit, and deactivate user accounts. Sourced from the admin-users help documentation, DEV v0.11.0, confirmed 2026-08-30.
- HIPAA 45 CFR Part 164 (hhs.gov/hipaa) requires covered entities and business associates to protect individually identifiable health information. Any small business that handles health information on behalf of a covered entity is a business associate and must not submit that information to any AI tool without a signed Business Associate Agreement. The data-exclusion list in Section 3 of this template includes health information as a mandatory exclusion.
- The admin-users help documentation (DEV v0.11.0, confirmed 2026-08-30) states: 'Deactivating is preferred over deleting because it preserves audit history and allows reactivation later.' When a team member who owns an AI agent or a locked prompt leaves the business, the Admin must deactivate the account (Admin, then User Management, then Edit, then Status: inactive, then Save), reassign agent ownership to a current Create role holder, and update the policy's Section 5.
- The AI Guidelines field in Dave by voolama (hellodave.ai) is the platform enforcement point for the data-exclusion list in Section 3 of the policy. Navigate to Admin, then Settings, then General, then AI Guidelines. The security help documentation (DEV v0.11.0, confirmed 2026-08-30) states: 'Company-wide and per-workspace AI guidelines cascade into every agent call.' Paste the Section 3 data-exclusion rules into this field. They apply to every agent in the workspace regardless of which workflow invokes it.
Summary
The one-page AI use policy template: fill this in before using AI on client work
Copy the template below. Fill in every field. The Dave by voolama (hellodave.ai) role assignments in Section 5 are sourced from the admin-users help documentation (DEV v0.11.0, confirmed 2026-08-30). The AI Guidelines path in Section 3 is sourced from the security help documentation (DEV v0.11.0, confirmed 2026-08-30). Have the completed policy reviewed by a qualified attorney before finalizing.
AI USE POLICY
Business name: [LEGAL BUSINESS NAME]
Policy owner: [FULL NAME, TITLE]
Effective date: [DATE]
Version: [VERSION NUMBER, e.g., 1.0]
Review date: [DATE, no more than 12 months from effective date]
SECTION 1: PURPOSE
This policy tells every team member at [BUSINESS NAME] which AI tools are approved,
what data must never go into those tools, when a person must review AI output before
it leaves the business, and who is responsible when something goes wrong.
This policy applies to every team member, contractor, and volunteer who uses AI tools
on behalf of [BUSINESS NAME].
SECTION 2: APPROVED TOOLS
[List every AI tool the business approves. Any tool not on this list is not approved.]
Tool name | Approved use | Who may use it
----------|-------------|---------------
[TOOL NAME] | [SPECIFIC USE, e.g., drafting client emails for human review] | [ROLE]
[TOOL NAME] | [SPECIFIC USE] | [ROLE]
SECTION 3: DATA THAT NEVER GOES INTO AN AI TOOL
[Check every item that applies. Add items specific to your industry and contracts.]
The following data types must never be pasted into any AI tool, approved or not:
- [ ] Client names combined with financial figures or account balances.
- [ ] Social Security numbers or tax identification numbers.
- [ ] Health information covered by HIPAA (45 CFR Part 164, hhs.gov/hipaa).
- [ ] Financial account numbers, routing numbers, or card numbers.
- [ ] Data covered by the Gramm-Leach-Bliley Act Safeguards Rule (15 U.S.C. 6801)
[financial services businesses only].
- [ ] Attorney-client privileged communications.
- [ ] Any data the business is contractually prohibited from sharing with third parties.
- [ ] Personnel records, salary information, or disciplinary records.
- [ ] Any data subject to a non-disclosure agreement.
- [ ] [ADD YOUR OWN EXCLUSIONS HERE]
In Dave by voolama (hellodave.ai), paste these rules into:
Admin, then Settings, then General, then AI Guidelines.
They cascade into every agent call in the workspace.
(Source: security help documentation, DEV v0.11.0, confirmed 2026-08-30.)
SECTION 4: REQUIRED HUMAN REVIEW
Every AI-generated output that will be sent to a client, posted publicly, submitted
to a government agency, or used in a legal or financial document must be reviewed
and approved by a named person before it leaves the business.
FTC Act Section 5 (ftc.gov/legal-library/browse/statutes/federal-trade-commission-act)
prohibits unfair or deceptive practices. An AI-generated output containing a false
claim is a deceptive practice regardless of whether a person or an AI produced it.
Output type | Who reviews | How the review is recorded
------------|-------------|---------------------------
Client emails and letters | [FULL NAME OR ROLE] | [e.g., Human Review task in Dave by voolama]
Public-facing content | [FULL NAME OR ROLE] | [RECORD METHOD]
Government submissions | [FULL NAME OR ROLE] | [RECORD METHOD]
Financial documents | [FULL NAME OR ROLE] | [RECORD METHOD]
[ADD YOUR OWN] | [FULL NAME OR ROLE] | [RECORD METHOD]
In Dave by voolama (hellodave.ai), the Human Review node creates a Task Inbox item.
The reviewer clicks Approve, Reject, or Request Changes. The decision is recorded
in the audit log with the reviewer's user ID and a UTC timestamp.
Only Admin and Use roles can complete Human Review tasks.
(Source: security help documentation, DEV v0.11.0, confirmed 2026-08-30.)
SECTION 5: WHO OWNS AGENTS AND PROMPTS
In Dave by voolama (hellodave.ai), only Admin and Create roles can create agents
and lock prompts. Only Admin and Curate roles can build workflows. Only Admin users
can create, edit, and deactivate user accounts.
(Source: admin-users help documentation, DEV v0.11.0, confirmed 2026-08-30.)
Role | Named owner | Responsibilities
-----|-------------|----------------
Admin | [FULL NAME] | User accounts, role assignments, workspace settings, audit log.
Create (agent owner) | [FULL NAME] | Creating and editing AI agents, locking prompts.
Curate (workflow owner) | [FULL NAME] | Building and maintaining workflow graphs.
Use (task reviewer) | [FULL NAME] | Completing Human Review tasks, approving AI output.
When a team member leaves:
1. Deactivate their account: Admin, then User Management, click Edit,
change Status to inactive, click Save.
2. Reassign agent and workflow ownership to a current team member.
3. Update this section to name the new owner.
NIST SP 800-53 Rev 5 AC-6 (csrc.nist.gov/pubs/sp/800/53/r5/upd1/final) requires
least privilege: assign the minimum roles each person needs.
SECTION 6: REPORTING PROBLEMS
If an AI tool produces an output that is factually wrong, contains prohibited data,
or causes a client complaint, report it immediately to:
Problem report contact: [FULL NAME]
Contact method: [EMAIL OR PHONE]
Response time: [e.g., within 24 hours]
Do not delete the AI output. Save the full output, the input that produced it,
and the date and time. The Admin can export the audit log from Dave by voolama
at Admin, then Settings, then Audit Log, then Export CSV.
SECTION 7: REVIEW DATE
This policy will be reviewed and updated by [FULL NAME] on or before [REVIEW DATE].
Signed: _______________________________ Date: ___________
[OWNER OR AUTHORIZED SIGNER NAME AND TITLE]
Team member acknowledgments:
Name | Signature | Date
-----|-----------|-----
[NAME] | |
[NAME] | |
Where this advice stops: this is not legal advice
This template covers the seven sections a small business AI use policy needs. Five explicit boundaries:
- This is not legal advice. The FTC Act Section 5, NIST SP 800-53 Rev 5 AC-6, HIPAA 45 CFR Part 164, and Gramm-Leach-Bliley Act citations are to publicly available federal documents the reader can verify directly at the URLs given. Whether a specific AI use policy satisfies a specific regulatory requirement, client contract, or state law requires a qualified attorney's assessment. Dean Brown is the founder of HelloDave.ai, a voolama LLC company, and is not a licensed attorney, compliance officer, or privacy specialist. The legal analysis in this template names the statutes and their consequences so a reader knows which questions to bring to a qualified attorney.
- Regulated industries have additional requirements beyond this template. Healthcare businesses are subject to HIPAA 45 CFR Part 164 (hhs.gov/hipaa) and may need a Business Associate Agreement before submitting any health information to an AI tool. Financial services businesses are subject to the Gramm-Leach-Bliley Act Safeguards Rule (15 U.S.C. 6801). Law offices are subject to ABA Model Rule 1.6 on client confidentiality. This template provides a general structure. Industry-specific requirements must be layered on top by a qualified professional in that industry.
- State privacy laws vary. California (CCPA, oag.ca.gov/privacy/ccpa), Colorado (CPA, coag.gov/office-services/consumer-protection/colorado-privacy-act), Virginia (VCDPA), and other states have privacy laws that may affect how the business uses AI on personal data. This template does not address state-specific requirements.
- This template does not cover AI tools used by contractors or vendors. If a contractor or vendor uses AI tools on the business's behalf, the business's client contracts and data processing agreements may require additional controls. Have those agreements reviewed by a qualified attorney.
- This template does not substitute for an employee handbook or a data security policy. An AI use policy works alongside, not instead of, a data security policy, an acceptable use policy, and an employee handbook. The SOP template at hellodave.ai/resource/sop-template-small-teams covers the process documentation that supports each AI use case.
Frequently asked questions
Does a small business legally need an AI use policy?
No federal statute as of 2026-11-07 requires a small business to have a written AI use policy. However, FTC Act Section 5 (ftc.gov/legal-library/browse/statutes/federal-trade-commission-act) prohibits unfair or deceptive practices: a business that sends a client an AI-generated document containing a false claim is liable under Section 5 regardless of whether the business has a policy. A written policy with a mandatory human review step is the documented control that reduces that liability. Have the completed policy reviewed by a qualified attorney in your state and industry before relying on it.
Who should sign the AI use policy?
The owner or the person with authority to bind the business should sign the policy. Every team member who uses AI tools should sign an acknowledgment that they have read and understood the policy. Keep signed acknowledgments on file. In Dave by voolama (hellodave.ai), the Admin user who manages the workspace is the natural policy owner: only the Admin role can create users, assign roles, and deactivate accounts (admin-users help documentation, DEV v0.11.0, confirmed 2026-08-30). The policy's Section 5 should name that person by full name and title.
What data types must never go into an AI tool?
At minimum: Social Security numbers, health information covered by HIPAA 45 CFR Part 164 (hhs.gov/hipaa), financial account numbers, attorney-client privileged communications, and any data the business is contractually prohibited from sharing with third parties. Financial services businesses must also exclude data covered by the Gramm-Leach-Bliley Act Safeguards Rule (15 U.S.C. 6801, ftc.gov/legal-library/browse/statutes/gramm-leach-bliley-act). The data-exclusion list in Section 3 of this template is a starting point: have a qualified attorney review it against the business's specific client contracts and regulatory obligations before finalizing.
How does Dave by voolama enforce the AI use policy's human review requirement?
In Dave by voolama (hellodave.ai), the Human Review node pauses a workflow and creates a task in the Task Inbox. The reviewer reads the AI-generated draft in the Payload section and clicks Approve, Reject, or Request Changes. The decision is recorded in the audit log with the reviewer's user ID and a UTC timestamp. Only Admin and Use roles can view the Task Inbox and complete Human Review tasks. The audit log entry is the evidence that the human review requirement in the policy was followed for each specific output. Sourced from the security help documentation, DEV v0.11.0, confirmed 2026-08-30.
What happens to an AI agent when the team member who built it leaves?
In Dave by voolama (hellodave.ai), deactivate the departing user's account rather than deleting it: navigate to Admin, then User Management, click Edit on the user's row, change Status to inactive, and click Save. The admin-users help documentation (DEV v0.11.0, confirmed 2026-08-30) states this preserves audit history. Then reassign agent ownership: only Admin and Create roles can edit agents. Update the AI use policy's Section 5 to name the new owner by full name and title. If the departing user had locked prompts, an Admin or Create role holder must unlock and review them before the agent continues to run.
Sources
Last reviewed