A One-Page AI Policy for Small Businesses (Free Template)

The short answer

A small business AI policy fits on one page and covers six things: which AI tools are approved, what data may and may not go into them, which outputs need a person’s review, when you tell customers AI was involved, who owns the work, and who to ask when unsure. Write it before staff start using AI on customer work, and review it every six months.

The moment someone on your team pastes a customer email into an AI tool, your business has an AI policy, whether you wrote it or not. Writing it down takes an hour and prevents the expensive mistakes: confidential data in the wrong place, an unchecked number on an invoice, a customer who feels misled.

Why a small business needs one

Large companies have legal teams for this. Small businesses have the same risks and fewer people to catch problems. A one-page policy gives staff clear permission to use AI where it helps and clear lines where it does not, which is usually what they want.

AI POLICY, ONE PAGE

1. Approved tools

• Use only the AI tools on the approved list.
• Use work accounts, never personal ones, for work.

2. Data

• Green: public info, our own marketing copy.
• Amber: internal docs, only in approved business tools.
• Red: passwords, payment data, health or ID data. Never.

3. Review

• A person reads anything that leaves the business.
• Numbers sent to clients are checked by hand.

4. Customers

• Say so when a customer is talking to an AI.
• A person is always available on request.

5. Ownership

• The person who sends it is responsible for it.

6. Questions

• Ask the policy owner before, not after.

Owner: name. Reviewed every six months. Last review: date.

What each section is for

Approved tools

List the tools people may use and require work accounts. Work accounts mean the business, not an individual, controls the data and can close access when someone leaves. Business plans also tend to come with clearer data terms; read them before approving a tool.

Data rules: green, amber, red

A traffic-light rule is easy to remember. Green data is already public or harmless. Amber data is internal and may go only into approved tools whose data terms you have checked. Red data never goes into AI tools: passwords, payment card numbers, government ID numbers, health information and anything under a confidentiality agreement that does not allow it. Privacy laws such as Canada’s PIPEDA, Europe’s GDPR and US state laws still apply when data goes into an AI tool.

Review

Anything that leaves the business gets read by a person first. Numbers in quotes, invoices and financial reports get checked against the source. This one rule prevents most AI mistakes from reaching customers.

Telling customers

If a customer is chatting with an AI rather than a person, tell them, and make a person easy to reach. Customers forgive automation; they do not forgive feeling tricked.

Ownership and accountability

The person who sends the work owns it, regardless of who or what drafted it. This keeps responsibility where it has always been.

Questions

Name one person who owns the policy and answers questions. If staff are unsure whether something is amber or red, they ask first.

How to roll it out

• Share it in a short team meeting and walk through two real examples from your work.
• Put it where people will see it: the team chat, the shared drive, the onboarding checklist.
• Review it every six months, or when you add a new tool or a new kind of customer data.

With the policy in place, use our 90-day AI plan to pick the first tasks.

Bottom line

One page is enough: approved tools, traffic-light data rules, human review, honesty with customers, clear ownership and one person to ask. Write it before AI touches customer work, and keep it short enough that people actually read it.

Common questions

Does a small business need an AI policy?

Yes, as soon as staff use AI on work involving customers or internal data. A one-page policy is enough for most small businesses.

What should an AI policy include?

Approved tools, rules for what data may go into them, which outputs need human review, when to tell customers AI is involved, who is accountable for the work, and who to ask with questions.

Should we tell customers we use AI?

Tell customers when they are interacting directly with an AI, such as a chat assistant, and make a person easy to reach. For internal drafting that a person reviews and sends, disclosure is usually a business choice rather than a requirement, but check the rules that apply where you operate.