No Florida statute requires a small business to have a written AI use policy. That’s worth saying first, because it changes why you’d write one. A Florida employer writes an AI use policy for the same reason it writes a data-security policy: because untrained staff pasting client files into a free chatbot account is a real risk regardless of what Tallahassee has passed, not because a regulator is checking. This article covers the eight clauses that matter for a 5–50 person Florida firm, what the state’s current AI law does and doesn’t reach, and where a policy like this fits alongside CareerSource-funded training.
Why write one if nothing requires it
The risk a policy manages doesn’t disappear just because a law hasn’t caught up to it. An employee who pastes a client’s Social Security number into a personal ChatGPT account to speed up a form has created a real data problem either way. A paralegal who lets a generative AI tool draft a filing without checking the citations has created a real malpractice exposure, whether or not the Florida Bar has a rule on it (it does, and that’s covered below). The absence of an AI-specific mandate gives a Florida employer more flexibility in how it writes the policy, not proof the underlying risks are absent.
This is a meaningfully different starting point than California’s, worth naming directly since the two states get compared constantly. California’s Civil Rights Council automated-decision regulations, in effect since October 1, 2025 under the Fair Employment and Housing Act, directly reach employers using automated tools in hiring, promotion, or discipline. Florida has no equivalent rule. A Florida policy is written to manage the business’s own risk and set clear staff expectations, not to satisfy an examiner — a better-run-business decision rather than a compliance checkbox, and framing it that way to your team tends to get more genuine buy-in than “the law now says.”
The eight clauses that matter
A policy that tries to cover everything gets read by no one. These eight clauses map to Florida’s actual risk picture: data handling, professional liability, and the gap between what a tool can generate and what a human should sign off on before it goes anywhere.
1. The approved-tool list
Name the specific products staff may use for work: ChatGPT, Claude, Gemini, and Microsoft Copilot cover what most Florida small businesses will ever need to name. Distinguish business-tier accounts, provisioned by the company and typically excluded from model-training data, from personal free-tier accounts, and say plainly that free-tier personal accounts aren’t approved for any work touching client, patient, or employee data. Most real risk in this policy traces back to staff defaulting to whatever free tool is already open in a browser tab, which is why this clause leads the list.
2. Customer and client data handling
This clause does the most work. State which data categories may never enter an AI tool without authorization: client and customer personal information, payment details, health information, employee records, and anything under a third-party NDA. A simple three-tier structure beats a long prohibited-data list: public information (no restriction), internal business information (approved business-tier tools only), and client or regulated data (the safeguards in clause 3, or an outright prohibition). Firms that skip this clause usually discover the gap only after a client file has already gone somewhere it shouldn’t.
3. Confidentiality for regulated professions
A law practice, medical or dental office, CPA practice, or other licensed profession needs to name its actual governing rule here, not a generic “be careful with confidential information” line. Florida Bar Ethics Opinion 24-1, approved January 19, 2024, permits Florida attorneys to use generative AI in practice but requires protecting client confidentiality — researching a tool’s data-retention and training policies before using it on a matter, and in some cases obtaining the client’s informed consent before disclosing confidential information to a third-party tool. The Florida Supreme Court followed with amendments to Chapter 4 of the Rules Regulating The Florida Bar, effective October 28, 2024, covering competence, confidentiality, and supervision of nonlawyer assistants, a category the Bar has extended to AI tools used under an attorney’s direction.
Medical and dental practices operate under federal HIPAA, not a Florida AI statute: patient health information can’t go into a public or free-tier AI tool without a signed Business Associate Agreement, and most consumer subscriptions don’t offer one. A firm without a profession-specific AI opinion to cite should still write this clause, citing its existing client-confidentiality obligations applied to a new tool rather than inventing a rule that doesn’t exist.
4. Human review before anything goes out the door
Every output reaching a client, a regulator, a court, or a job applicant needs a named human reviewer, by role, before it goes out: hiring and personnel decisions (an AI-drafted rejection letter or performance review still needs a manager’s sign-off on content and reasoning), anything filed with a court or regulator, and any client-facing message that commits the firm to a number, deadline, or legal position. This is where a Florida employer gets ahead of a risk California addresses by regulation: even without a state mandate on automated hiring tools, an unreviewed AI-drafted rejection carries the same discrimination exposure as a careless human one.
5. Employee acknowledgment
A policy no one has agreed to isn’t a policy, it’s a memo. Have every employee sign an acknowledgment at rollout and again at each material update, and fold it into onboarding for new hires. Keep it short enough that people actually read it: approved tools, data that can’t go into them, who to ask about edge cases, and where to report a mistake. A one-page signed acknowledgment beats a fifteen-page policy nobody re-reads.
6. Incident reporting
Tell staff exactly what to do the moment they realize they’ve entered something they shouldn’t have: report it immediately, to a named person, with no penalty for reporting in good faith. The alternative — staff staying quiet out of fear — is strictly worse than finding out fast. Set a specific window, same business day is reasonable, rather than “as soon as practical,” which tends to mean never.
7. Vendor disclosure
Nobody connects a new AI tool, plugin, or browser extension to company systems or data without telling someone first. The practical risk in a 5–50 person firm usually isn’t the sanctioned tools list, it’s the AI-powered inbox extension an employee installed that quietly has access to everything in it. Require a quick check before any new AI tool touches company data: what it does with that data, whether it trains on it, and whether someone with authority knows it’s in use.
8. Review cadence
Set a fixed review point, at least annually, plus a trigger: review immediately after a material change to the tools in use, a new regulated-data use case, or a relevant change in Florida or federal law. A policy written once and never revisited ages badly in a fast-moving space; a stated cadence signals the business treats this as an ongoing responsibility, not a document filed away after one training session.
What Florida AI law actually requires of an employer today
No state statute mandates a written AI policy, disclosure of AI use to employees or customers, or an algorithmic impact assessment for a private Florida employer as of this writing. Two laws come up in searches, and both are worth naming precisely rather than gesturing at vaguely.
SB 482, the “Artificial Intelligence Bill of Rights,” passed the Senate 35-2 on March 4, 2026, backed by Governor Ron DeSantis, then died in House Messages on March 13, 2026, after Speaker Daniel Perez declined a floor vote, arguing AI regulation belongs at the federal level. The bill addressed disclosure for companion chatbots and protections for minors; even in the Senate-passed version, it never contained an employer or workplace-AI-use mandate. A re-filed version is plausible given the margin, but none exists today.
The Florida Digital Bill of Rights is the other law that surfaces here, and for nearly every reader it doesn’t apply. The FDBR reaches only entities clearing $1 billion in global annual revenue that also meet one of three tests: 50%-plus of revenue from online advertising, operating a smart speaker with voice-command services, or operating an app store. Fewer than 6,000 Florida businesses clear the revenue floor alone; a 5–50 person firm using ChatGPT or Claude for internal drafting is nowhere close.
None of that argues against having a policy — it’s the reason your policy manages your own risk on your own terms, not a state examiner’s checklist that doesn’t exist yet.
Where this fits with CareerSource-funded training
Florida businesses training staff on AI tools can get part of that cost reimbursed through CareerSource Florida’s Incumbent Worker Training grant, administered through the state’s 21 regional workforce boards, covering 50% of direct training costs for most eligible employers and up to 75% for firms with 25 or fewer employees. A written policy isn’t a documented requirement of that grant, but the two naturally arrive together: a firm that has just funded a training rollout is well positioned to formalize what staff learned into the eight clauses above while the reasons are still fresh. Confirm current program terms with your regional CareerSource board before applying, since the cap and match rate reset annually.
What it costs to get this right
A written policy for a firm this size is typically a short internal project: drafting the eight clauses, checking them against applicable professional-conduct rules, and rolling out the signed acknowledgment. The real budget question is training: getting a staff of 5 to 50 comfortable enough with these tools that the policy has something real to govern. Market pricing for a hands-on workshop runs $2,000 to $15,000 depending on group size and session count, before any CareerSource reimbursement. Firms that later want ongoing automation, rather than one-off drafting help, typically look at $25,000 to $150,000 for that separate, larger engagement.
Frequently asked questions
Is a Florida employer legally required to have an AI use policy?
No. No Florida statute requires a private employer to maintain a written AI use policy, disclose AI use to staff or customers, or run an algorithmic impact assessment. It’s a risk-management decision, unlike California, where FEHA’s automated-decision regulations directly reach employer use of automated hiring and personnel tools.
Did Florida pass an AI law that applies to employers?
The closest bill, SB 482, passed the Senate 35-2 on March 4, 2026, but died in the House on March 13, 2026, without a floor vote. It addressed companion-chatbot disclosure and protections for minors, not employer use of AI tools.
Does the Florida Digital Bill of Rights apply to my small business?
Almost certainly not. It applies only to entities with more than $1 billion in global annual revenue that also meet one of three additional business-model tests, a threshold a 5–50 person Florida business is far below.
What’s the single most important clause?
Customer and client data handling. Nearly every real incident traces back to data entered into a tool that wasn’t supposed to receive it, usually a free personal account rather than an approved business-tier one. Get that clause specific, and the rest is comparatively low-stakes.
Do law firms and medical practices need a different policy?
The core eight clauses apply to any Florida employer, but the confidentiality clause should name the specific rule your profession operates under: Florida Bar Ethics Opinion 24-1 and the October 2024 amendments to the Rules Regulating The Florida Bar for attorneys, federal HIPAA and a Business Associate Agreement for medical and dental practices.
Who should sign the employee acknowledgment?
Every employee with access to AI tools on company systems, or who could reasonably use a personal account for work, which in practice means nearly everyone at a 5–50 person firm. Sign it at rollout, and again at onboarding for every new hire.
What counts as an AI incident that needs reporting?
Confidential, client, patient, or employee data entered into an unapproved tool; an AI-drafted output that went out without the required human review; or an unapproved AI tool connected to company systems. Report it the same business day, with no penalty for good-faith self-reporting.
How often should the policy be reviewed?
At least annually, plus immediately after a material change: a new approved tool, a new use case involving regulated data, or a relevant change in Florida or federal law.
Can I write this myself, or do I need a lawyer?
The eight clauses above are a solid structure an owner can draft directly. Firms in a regulated profession, or handling especially sensitive data, should have counsel review the confidentiality and human-review clauses, since those most often intersect with an existing professional-conduct rule.
Does training my team help with writing this policy?
Yes. A policy drafted before anyone has used the tools tends to guess at what needs governing. One drafted after a hands-on workshop, where staff have worked through their own documents, reflects real use cases a generic template misses.
Key takeaways
- No Florida statute requires a private employer to have a written AI use policy today; SB 482 died in the House on March 13, 2026, and the Florida Digital Bill of Rights exempts nearly every small business under its $1 billion revenue threshold.
- Writing one anyway is a risk-management decision: data leakage from free-tier personal accounts and unreviewed AI outputs create real liability whether or not a statute addresses them.
- Customer and client data handling carries the most real-world risk and deserves the most specificity, including a plain rule against regulated data in personal free-tier accounts.
- Regulated professions should name their actual governing rule: Florida Bar Ethics Opinion 24-1 and the October 28, 2024 rule amendments for attorneys, federal HIPAA and Business Associate Agreements for medical and dental practices.
- Human review, incident reporting, and a fixed annual review cadence are the clauses most often written vaguely, and most often the ones that matter when something goes wrong.
- The policy pairs naturally with CareerSource-funded training: the Incumbent Worker Training grant can offset workshop costs, and a freshly trained team is best positioned to help finalize a policy reflecting how it actually uses the tools.
A written policy is one part of getting a Florida team ready to use these tools well; the harder part is building the habits the policy is meant to govern. For a broader look at what a structured rollout covers, see the Florida training playbook or the Miami buyer’s guide for what this looks like in South Florida specifically, or book a free AI-readiness call to talk through what your firm’s policy and training rollout should cover.
Dirk Jan van Veen, PhD
