Do I need an AI policy for my small business? Yes, but one page, not eleven

"Do I need an AI policy for my small business?" Yes. But it is one page, not eleven. A long policy is written once, filed, and never followed. A short one gets read by the people it is meant for, which is the only test that counts. This article is for the owner of a company with ten to two hundred people who suspects that staff are already using AI tools and has nothing written down, and who wants to know what the page says, who will ask to see it, and how to have it in place within a week. If the tools are already in use and nobody approved them, start with what is shadow AI.

I was COO and then President of a public company that closed more than forty acquisitions, and I ran the integration on most of them, so I have seen what a company's paperwork looks like when someone outside starts asking questions. I am a lawyer by training. Now I write fixed-fee AI plans for CEOs of private-equity-backed and owner-led mid-market companies through 013 Labs. This is not legal advice. Where the law could apply to your company, talk to your own counsel.

Why your staff are already using AI

You may not have approved any AI tool. That does not mean none is in use. Free tools sit one browser tab away, they need no purchase order, and they are useful at the exact jobs a busy person dislikes: a first draft of an email, a summary of a long document, a tidy-up of a spreadsheet. People use them because they work, and most of them mean no harm.

So the real choice is not between AI and no AI. It is between use you have named and use you have not. If you say nothing, each person decides for themselves what is fine to paste in, which tool to trust, and whether anyone needs to check the result. Some will be careful. Some will not know there was anything to be careful about.

The first step is cheap: ask. Not as an inquiry, just a question put to the team, with an assurance that nobody is in trouble for answering. You will learn more in a week of honest answers than from any amount of guessing. AI for a small business with no IT department covers how to do this when nobody on the staff is technical.

What goes on the one page

Six items. Each one is a few lines, and together they fit on one side of paper.

Who owns AI. One named person, with a job title, who answers questions and keeps the page current. In a company of this size it is often the owner, the operations lead or the finance lead. It should not be "everyone" and it should not be "IT" if you have none. If nobody owns it, nobody will update it. Who owns AI in a company sets out how to choose that person and what the owner keeps.

The one-sentence data rule. The page needs one sentence that says what may and may not go into an AI tool. Something in this spirit: "Nothing about a customer, an employee or a supplier, and nothing we have promised to keep private, goes into any tool that is not on the approved list." Your sentence will differ. What matters is that a new hire can understand it without a meeting and apply it without asking. If the rule needs a flowchart, it is too long.

Approved tools, and who approves new ones. A short list of the tools the company has agreed to, which account type each is on (company-paid, not personal), and the name of the person who says yes or no to anything new. Make the route to a yes easy. If asking is a chore, people will go back to using whatever they like and not telling you. Is ChatGPT safe for business use explains what a business plan does and does not change about your data, which helps when deciding what "approved" means.

What a tool never does alone. Name the things that a person must always do or sign off, whatever the tool produced. For example: nothing goes to a customer without a named person checking it; no payment, price change or contract term is set by a tool; nothing is sent to a regulator, a lender or an auditor without a human owner. Choose the lines that fit your business. The point is that fluent text can be wrong, and the page says who catches it.

How mistakes are reported. One sentence, one person, no blame. "If a tool produces something wrong, or you put something in that should not have gone in, tell the owner of this page the same day. You will not be penalised for reporting it." Quick, honest reports are the only way a small error stays small. Ask your own counsel whether any particular kind of mistake carries a duty to tell a customer or an authority.

A review date. A date on the page, a few months out, and the name of the person who will check it. Tools change quickly and so do your uses of them. A page with a review date reads as alive, and a page without one reads as abandoned.

That is the whole policy. Anything more, such as long lists of banned activities or paragraphs of legal language, tends to make the page harder to follow without making your company safer.

Who asks to see it

Few owners write this page because they love paperwork. Usually somebody asks. The people who tend to are:

Insurers. An insurer or broker may ask how the company manages technology and data risk at renewal or when a policy is being set up. Whether AI use affects your cover, or what a policy does or does not include, is a question for your broker and your own counsel. A one-page answer is a better start than a blank look.

Lenders. A bank considering a facility, or reviewing one, may ask about the risks the company faces and how it manages them. The page shows that the owner has thought about it.

Customers, through supplier questionnaires. Larger customers often send suppliers a questionnaire about security, data handling and, more and more, AI. If you can attach a page and point to the named owner, the form gets filled in faster and you look like a supplier who has it under control. The questions vary by customer, so read each one with care and have counsel look at any that ask you to promise something.

Buyers. If you ever sell, or bring in an investor, diligence teams ask what tools are used, what data goes into them and who checks the output. Does AI make my business worth more when I sell sets out those questions. A page that has been in force for a year answers many of them at once.

Your own board or partners. If you report to one, the page is the plain answer to "what are we doing about AI?" The AI board briefing template shows how to put that answer in front of them.

Two of those conversations have their own pages: will my business insurance ask about AI? and what to tell your bank about AI.

How to roll it out in a week

You can do this in five working days without a project team.

Day one: ask. Put one question to the whole company: which AI tools, if any, do you use for work, and for what? Say plainly that nobody is in trouble. Collect the answers in a list.

Day two: decide. Pick the owner of the page. Look at the list and sort the tools into three groups: fine, fine on a company account, and stop. Write the one-sentence data rule.

Day three: draft. Write the six items on one page, in plain words. Ask somebody who is not senior to tell you which sentence they would have to read twice. Fix that sentence.

Day four: check. Have your own counsel look at it if your work involves customer data, regulated information or promises in contracts. Check that every named person agrees to the job they have been given.

Day five: share. Send it to everyone, in the body of an email and not as an attachment, and put it where new hires will find it. Say what the review date is. Take ten minutes in the next team meeting to talk it through and answer questions. If the page is going into your employee handbook, can AI write my employee handbook covers what a tool may draft there and what stays with your counsel.

After that, put the review date in a calendar and keep a short note of what changed and when. How much does AI cost for a small business is worth a look at the same time, because the approved list is also the best place to spot paid tools that nobody uses. When you are ready to choose where AI should actually help, picking your first AI project is the next step.

Picture it going wrong

Picture a regional services company of sixty people. A larger customer sends its annual supplier questionnaire, and one question asks how the company governs the use of AI. The owner has nothing to attach. Asking around, she finds that several people have pasted customer correspondence into free personal accounts, that a coordinator has been drafting proposals with a tool and sending them with no second pair of eyes, and that nobody knows who would hear about a mistake. None of it was done with bad intent. The questionnaire is late, the answer is vague, and the customer asks for a call. The repair is small: a question to the team, a one-sentence data rule, a short approved list, a named checker for proposals, and a review date. This is a hypothesis, a composite and not a client.

Mistakes that repeat

Writing eleven pages. Copying a large company's policy that nobody at yours will follow. Banning everything and hoping. No named owner. A data rule that needs interpretation. No easy way to ask for a new tool. Blame when someone reports a mistake, so the next one is hidden. No review date. Promising a customer something the page does not say you do. Skipping your own counsel where the law could apply.

Frequently asked questions

Do I need an AI policy for my small business?

Yes, in the sense that you need written rules that people can follow. One page is enough for most companies of ten to two hundred people: who owns AI, the data rule, approved tools, what a tool never does alone, how mistakes are reported, and a review date.

Is there a law that requires one?

I cannot give legal advice, and the answer depends on where you are and what you do. Talk to your own counsel about any rule that could apply to your company.

What if my staff already use AI tools?

Ask them, without blame, and write down what you hear. Then set the data rule, name the approved tools, and move the work onto company accounts.

Who should own the policy?

One named person who has the time and authority to keep it current. In many small companies that is the owner, the operations lead or the finance lead.

How often should I update it?

At the review date you set, which is usually every few months, and whenever you add a tool or something goes wrong.

Will an insurer or a customer want to see it?

They may. Insurers, lenders, customers' supplier questionnaires and buyers are the usual requesters. What each one asks for differs, so go through the request carefully and, where it asks for a promise, have your counsel look at it.

Not sure where you stand? Take the 3-minute AI readiness scorecard.