What should a small business AI policy include?

A lot of AI policies are way too long. Somebody downloads a template, it’s full of language about “responsible stewardship,” everyone signs it, and it goes in a folder. Then on Tuesday, Phil in accounting wants to paste a client spreadsheet into ChatGPT, and the policy is no help at all.

Our view is pretty simple. If an employee can’t answer “can I use this tool for this?” in about a minute, the policy needs work.

1. Which tools are approved?

Name them, and name the type of account too. “ChatGPT” isn’t specific enough, because a personal account and a company business account can have very different terms around your data. Say something like “Microsoft Copilot with your work login” and “ChatGPT on our company plan.”

And be clear about the personal stuff. Can people use their own account for work if they stay away from sensitive information? We’d say no, because it’s the simplest rule to follow. Just make sure you’re giving them a good approved option, or you’re going to end up with Shadow AI.

2. What data can go in?

This is the part people actually need, so make it easy. Use a few plain categories with real examples from your business:

• Public stuff, like anything already on your website, is fine in any approved tool.
• Internal stuff, like everyday documents and procedures, is fine in approved tools.
• Confidential stuff, like contracts, pricing, and client information, goes in approved business accounts only.
• Restricted stuff, like Social Security numbers, health records, payroll, and passwords, stays out unless someone has specifically signed off on that tool and that use.

Don’t just say “don’t enter sensitive data.” Everybody’s idea of sensitive is different, right? Examples are what make this work.

3. Who checks the output?

AI makes mistakes, and you often can’t tell from how the answer reads. So the rule we like is that the person using the tool owns the result, same as if they’d written it themselves.

Then call out the decisions that need more care. Anything affecting someone’s job, money, health, or legal rights should have a real person making the call, and AI shouldn’t be deciding on its own. If AI touches hiring or other employment decisions, ask your attorney what your state requires.

4. How do people ask for a new tool?

New tools are going to keep showing up, so give people a way to ask. A short form covering what the tool is, why they want it, and what data it would touch is plenty. We have a free AI Tool Approval Request you can use.

The other half of this is answering quickly. If it takes six weeks to get a yes or no, people stop asking and just sign up anyway.

Make sure this covers connections and add-ons as well, not just new products. A plugin that connects to your email can be a bigger deal than the tool it plugs into.

5. What happens when something goes wrong?

Somebody’s going to paste the wrong thing into the wrong tool at some point. Tell people exactly who to contact, and tell them fast reporting won’t get them in trouble. You want to hear about it that afternoon, not find out six months later.

6. Who owns this thing?

Put a name or a job title on it. Someone has to update the approved list, answer questions, and review the policy. We’d look at it at least once a year, and any time you add a major tool.

What can you leave out?

You can skip the long definitions of machine learning and the big statements about ethical principles. You also don’t need every approved tool’s details in the policy itself. Keep that in a separate list, so you can update it without reissuing the whole document.

Is a policy enough?

Honestly, no. A policy is a great first step, but it won’t tell you what people are really using, and it won’t stop a mistake on its own. Walk people through it, use real examples, and check in on how it’s going.

One more thing. We’re not lawyers, and this isn’t legal advice. If you’re in a regulated field, or you handle health or financial records, have your attorney look it over.

You can start with our free AI Policy Builder. Answer 12 plain questions, including your name and work email at the end, and you’ll get a starter policy you can edit. And if you’d like help putting it in place and keeping it current, that’s part of our AI governance service.