Most small businesses I meet have an AI policy the same way they have a fire evacuation plan: they assume they will improvise one when needed. Meanwhile Microsoft's Work Trend Index found 78% of AI users bring their own AI tools to work. The policy question is not whether your team uses AI. It is whether they use it under rules you wrote or rules they guessed.
The good news: for a small business, this is genuinely a one-afternoon project. Not because the topic is trivial, but because the document only works if it is short. A twelve-page policy is a document nobody reads. One page, six sections, plain language.
The Six Sections
| Section | The question it answers |
|---|---|
| 1. Approved tools | Which AI tools and which account types are sanctioned (name them: "our Team workspace," not "ChatGPT") |
| 2. Data rules | What may and may never be pasted into an AI tool |
| 3. Review rules | Which outputs need human sign-off before they leave the building |
| 4. Disclosure | When you tell customers they are interacting with AI |
| 5. Accountability | Who owns AI decisions and where mistakes get reported |
| 6. Review date | When you revisit this document (quarterly, on the calendar) |
One page total. If a section runs past a paragraph, you are writing a manual, not a policy.
Section 1, approved tools, does the most work. Pick one primary tool, buy the business tier, and name the account. The point is not favoritism; it is that business tiers carry the no-training defaults and admin controls that personal accounts do not, as I covered in the data privacy post. Add a sentence for everything else: "Other tools need a quick OK from [owner] first."
Section 2, data rules, is the green/yellow/red list. Green (public info, marketing drafts): go ahead. Yellow (internal docs): approved tools only. Red (customer personal data, financials, credentials, anything under NDA): never in a chat window, period. Write the red list with real examples from your own business; abstract categories get abstract compliance.
Section 3, review rules, draws one bright line: nothing AI-generated reaches a customer, a court, a regulator, or the public without a named human reading it first. Internal drafts and brainstorms need no ceremony. External artifacts always do.
Section 4, disclosure, is both ethics and, increasingly, law. The EU AI Act's transparency rules, which I walked through in the August deadline post, expect users to know when they are talking to a machine (see the full text at artificialintelligenceact.eu). The simple version: chatbots and voice agents identify themselves; AI-assisted human work does not need a label.
Section 5, accountability, names a person, not a committee. Someone owns tool approvals, someone is the address for "the AI said something weird." In most small businesses both names are the owner's, and writing that down still matters, because it tells the team mistakes are reportable rather than hideable. This mirrors the spirit of the NIST AI Risk Management Framework: govern, map, measure, manage, scaled to a company where all four are one person with a spreadsheet.
Section 6, the review date, keeps the document alive. AI capability and rules change quarterly; your policy should get fifteen minutes on the same cadence.
The Afternoon, Scheduled
Hour one: draft the six sections solo. Hour two: walk the team through it and ask what they are already doing that the draft would forbid; their answers will fix your blind spots and reveal a shadow workflow or two worth keeping. Hour three: revise, put it where the handbook lives, and book the quarterly review. Done. The marginal cost of the whole exercise is one afternoon; the alternative is explaining to a client, after the fact, why their contract went through a personal chatbot account.
Sources
- Microsoft, "AI at Work Is Here. Now Comes the Hard Part," Work Trend Index (78% of AI users bring their own tools to work). microsoft.com
- EU Artificial Intelligence Act, full text and implementation timeline. artificialintelligenceact.eu
- NIST, AI Risk Management Framework (govern/map/measure/manage structure). nist.gov
Want a second pair of eyes on your draft policy?
We review AI policies as part of our readiness assessment, and we will flag the gap between what the document says and what your team actually does.