"Do I need an AI strategy?" Owners ask it after a board member, a banker, a buyer or one of their own children has asked "what is our AI strategy" and the honest answer was a shrug. The honest answer to the owner's question is that a company of fifty to five hundred people rarely needs a strategy document. It needs five decisions written on one page, each with a name beside it. The page is a strategy when it changes what people do on Monday; a forty-page deck from a vendor is not, however good it looks. This article is for the owner or chief executive of a private company of that size, often with a private equity sponsor or a family on the board, who wants to know what to write down, what to leave out, and when one page stops being enough. Where money is handled it is not accounting or tax advice.

I was COO and then President of a public company that closed more than forty acquisitions, and I ran the integration on most of them. Every one of those companies had a strategy document somewhere, and the ones that worked were the ones short enough that the people named in them knew they were named. I am a lawyer by training. Now I write fixed-fee AI plans for CEOs of private-equity-backed and owner-led mid-market companies through 013 Labs, and the plan that gets used is almost always the one that fits on a page.

The short answer

You need an AI strategy if anyone who matters to the company is going to ask for one, and somebody always does. You do not need a document. You need the five decisions below, in writing, with a name and a date on each. If you can answer them now, you have a strategy and should write it down this week. If you cannot, the gap is not knowledge of the technology; it is decisions nobody has made. A page that makes them is worth more than any deck about the future of your industry. How to start using AI in your business covers the first three of these in the order a company usually meets them; this page adds the two the board will ask about.

The five decisions, in order

One: what we will not build. The list of things the company will not do with these tools this year, each with a reason. Not a chatbot on the website. Not a rewrite of the quoting system. Nothing that touches customer payment data until the data rule exists. This is the half of the page that earns its keep, because every vendor conversation for the next year can be answered from it in one sentence. A strategy without a never-list is a wish list with a logo.

Two: who owns it. One or two people, by name, with a sentence each on what they decide, what they check and who they tell. Usually not the owner, and usually someone who already uses these tools quietly. Who owns AI in a company covers why the person is rarely the one you expect, and Spot your AI champion is the one-page way to find them.

Three: which one process gets the first honest test, with a number and a date. One process, one measure, one date on which a named person will say whether it worked, and a stop rule written before it starts. Not three pilots. Not a platform. Picking your first AI project covers how to choose it so that a failure teaches you something and costs little.

Four: what data may leave the building, and under what terms. Which tools are approved, under which terms, what may be put into them, what never may, and who may say yes to a new one. If the company has no written answer, the answer being used today is whatever each employee decided on their own. Do I need an AI policy covers the one-page version; this decision is the sentence on the strategy page that points to it.

Five: how the board hears about it. When, in what form and from whom. A standing line in the board pack, written by the owner named in decision two, with the measure from decision three on it. Most of the questions a board asks about AI are answered by that line arriving every quarter. Questions your board will ask about AI lists them, and the AI Board Briefing template is the agenda for the first session.

The data rule

Decision four deserves its own paragraph because it is the one that protects the company whether or not the rest of the page is ever used. Before anyone, inside or outside, puts customer records, payroll files, contracts or pricing into a tool, the company needs one short rule: which tools are allowed, under written terms that say who keeps the data and what it is used for, never through a free personal account, and with a named person who may approve a new one. What happens to your data explains what to ask any provider before the first file moves. Write the rule before the first test, not after the first scare.

Five checks on whether your page is a strategy

First, look at it as the person in the warehouse would. If they cannot tell from the page what changes for them, it is not finished.

Second, count the names. A page with no name but yours has no owner. A page with eight names has no owner either.

Third, find the date. Somewhere on the page a person has committed to say, on a stated day, whether one thing worked. If there is no date, there is no test, and without a test there is no strategy, only a hope.

Fourth, find the word no. If the page only says what the company will do, it has not made the hard decision, which is what it will refuse.

Fifth, check the length. If the board cannot take it in during twenty minutes, it will be filed rather than used. Cut until it fits.

Check yourself

Seven yes or no questions. Each no is a decision still to make.

Mostly no? That is normal, and it is a week of decisions, not a year of consulting. The AI readiness scorecard asks ten questions like these across the whole company.

When a page is not enough

Four signs that you need more than a page. The first is data that a regulator or a contract says how to handle: patient, financial or children's data, or anything a customer agreement restricts; the data rule then needs the detail of a real policy and someone to check it is followed. The second is a sale within two years: a buyer's diligence team will ask for the plan in writing and will test whether it was followed, so the page needs a record of what happened behind it. Not accounting or tax advice. The third is more than one business unit already buying its own tools, where one page cannot carry the decisions each unit needs. The fourth is a lender or investor asking in writing, because a written question deserves a written answer with evidence behind it. In each case the longer form is still short: the two-page AI roadmap for a mid-sized company covers what belongs on it, and the company's AI strategy work is the version with an outsider doing the listening. Even then, the one page sits on top and the longer document explains it.

How to tell after ninety days whether the page worked

Ninety days after the page is written, five things should be true. Somebody has used the never-list to say no to a vendor or a colleague. The named owner has sent the board its first standing line. The first test has run to its date and a person has written one sentence on whether it worked and what happens next. Nobody has put customer or employee data into an unapproved tool, as far as the owner knows, and the owner has asked. And the page itself has changed at least once, because a page nobody has needed to amend in ninety days is a page nobody has used.

Starting safely

Start by writing the never-list yourself, this week, from the vendor conversations you have already had; it is the easiest decision and the most useful. Then ask who already uses these tools quietly, and offer one of them decision two. Choose the first test from a process that already annoys people, so the measure is obvious. Write the data rule before the test starts. Put a standing line in the next board pack, even if it says only what the test is and when it reads. If you want an outsider to do the listening and hold the pen, what does an AI consultant do describes the work, and how to choose an AI strategy consultant covers how to tell the ones who write pages from the ones who sell platforms. A deck a vendor or a large firm produced for you is not your strategy, however well made, if no name inside the company appears in it except yours.

Picture it going wrong

A made-up example, to show the shape. A third-generation commercial printing company with about two hundred people and a bank line up for renewal. The bank's relationship manager asks, in an email, what the company's AI strategy is. The owner forwards it to a nephew who is good with computers, who returns a twelve-page document in a fortnight, mostly about the future of printing. The bank is satisfied; the document is filed. Six months later the estimating team has quietly started pasting customer artwork and pricing into a free tool to speed up quotes, the production manager has bought a scheduling product on a company card, and the owner's daughter, who built a working job-costing sheet with these tools a year earlier, has not been asked about any of it. When a buyer appears the following spring, the diligence list asks for the AI plan and the record of what was done under it. There is a document and no record. The fix was one page: a never-list that included free tools for customer files, the daughter named as owner, the job-costing sheet as the first honest test with a number and a date, the data rule the estimators had never been given, and a standing line in the board pack. The twelve pages went in the appendix.

Mistakes that repeat

Frequently asked questions

Do I need an AI strategy for a small or mid-sized business?

You need five decisions in writing, with names and dates: what you will not build, who owns it, which process gets the first test, what data may leave the building, and how the board hears about it. That is a strategy. You rarely need more than a page of it.

What is an AI strategy, in plain terms?

A short written answer to what the company will and will not do with these tools this year, who is responsible, how the first attempt will be judged, how data is protected, and how the people who oversee the company find out. If it does not change what somebody does on Monday, it is a description, not a strategy.

How do I write an AI strategy?

Start with the never-list, because it is the easiest decision and the most useful. Then name the owner, choose one test with a measure and a date, write the data rule, and add a standing line to the board pack. Keep it to a page and show it to the people named on it before anyone else.

What should an AI strategy include?

The five decisions above, a date on each, and nothing about how the technology works. Tools can be named in an appendix if they must be named at all, because they will change before the page does.

Can an AI strategy fit on one page?

For most companies of fifty to five hundred people, yes, and it should. The sign that you need more is on this page: regulated data, a sale within two years, several business units buying tools, or a lender or investor asking in writing.

Who should write the AI strategy?

The owner makes the five decisions; the named owner of the subject inside the company holds the pen afterwards. An outsider can do the listening and the first draft, and should leave when the page has owners who can run it without them.

How often should the page change?

Whenever a decision changes, and at least after every test reads. A page that has not changed in ninety days has not been used.

Not sure where you stand? Take the 3-minute AI readiness scorecard.