Your team is probably already using AI. Maybe it’s a chatbot on someone’s phone, an AI feature in your email, or a writing assistant built into a document tool. If you haven’t said anything about it, people are making up their own rules. Some are being careful. Some aren’t. Most aren’t sure.
A short AI policy for small business fixes that. Not a long legal document nobody reads, but a single page that tells people what’s fine, what isn’t, and who to ask. Here’s how to write one.
Why one page
Long policies get skimmed once and forgotten. A one-page policy can be pinned up, reread, and actually followed. If something needs more detail, such as industry regulations, you can link to it. The everyday rules should fit on one page.
And a quick note: this is about practical working rules, not legal advice. If your business handles regulated data, check with whoever advises you on compliance.
Section 1: What we use AI for
Start positive. Say plainly that AI is allowed and encouraged for certain work. This matters because without it, careful employees may avoid AI entirely, worried they’ll get in trouble.
List the kinds of tasks where AI is welcome. For example:
- Drafting internal documents and emails.
- Summarizing long threads or meeting notes.
- Brainstorming ideas and outlines.
- First drafts of customer replies, which then get checked.
Keep it short. The point is permission, not a complete list.
Section 2: What stays out of AI tools
This is the most important section. Be specific about what information should never go into an AI tool, or should only go into tools the business has approved. Common examples:
- Customer payment or financial details.
- Passwords and login details.
- Employee personal records.
- Anything covered by a confidentiality agreement.
- Health or other sensitive personal information.
If you’ve approved certain tools with business-grade data settings, name them here. Make it clear that personal accounts on free tools aren’t the place for business data.
Section 3: What gets checked before it goes out
AI tools write confidently whether they’re right or wrong. Your policy should say what needs a human check before it leaves the building. A simple version:
- Anything sent to a customer gets read by a person first.
- Anything with a price, date, commitment, or legal wording gets checked against the source.
- Facts and figures from AI get verified before they’re used.
- Internal drafts and summaries can be used as-is, as long as people treat them as drafts.
The goal is to keep judgment with your people. The person who sends something is responsible for it, whether AI helped write it or not.
Section 4: Be open about it
Decide where you stand on disclosure. You don’t need to label every email that AI helped draft, but your team shouldn’t pretend AI work is something it isn’t. For example, don’t present an AI-generated summary as a careful personal review.
Some businesses also choose to tell customers when they’re talking with an automated system. Decide what fits your business and write it down.
Section 5: Who to ask
Name a person. When someone isn’t sure whether a task or tool is OK, they need to know who to ask. Without this line, uncertain people either guess or avoid AI entirely.
This person doesn’t need to be technical. They need to be reachable and willing to make a call, or find out.
Section 6: When things go wrong
Mistakes will happen. Someone will paste in something they shouldn’t, or send a draft with a wrong detail. Your policy should say what to do: tell the named person quickly, fix what can be fixed, and adjust the rules if needed.
Make it clear that reporting a mistake is expected and won’t be punished. A policy that encourages hiding mistakes is worse than no policy.
Keep your AI policy for small business alive
AI tools change fast, so your AI policy for small business shouldn’t be written once and forgotten. Put a review date on it, every few months is reasonable, and update it when you adopt a new tool or learn something the hard way.
Ask your team what’s unclear. The questions people ask are the best guide to what the policy is missing.
A simple template
Here’s the skeleton, ready to fill in:
- We use AI for: (list of encouraged tasks)
- Never put into AI tools: (list of off-limits data)
- Approved tools: (names)
- Always check before sending: (what needs a human read)
- Being open: (your disclosure stance)
- Questions go to: (name)
- If something goes wrong: (what to do)
- Next review date: (date)
That fits on one page and covers most of what a small team needs.
Policy is the start, not the finish
A policy tells people where the guardrails are. It doesn’t teach them to use AI well. That comes from practice on real work, with feedback. But a clear policy makes that practice safer and more confident, because people know where the lines are.
Writing the policy is often one of the first things we do with clients, usually right after the AI Readiness Audit, because good habits are much easier to build once everyone knows the rules.
Want help writing your AI policy and building habits around it? Book an AI coaching call or start with the two-hour AI Readiness Audit For a neutral outside reference on managing AI risk, see the NIST AI Risk Management Framework..
