Do I need a policy if we barely use AI?

Yes. "Barely" means some people are using it and nobody has said what is okay. The policy takes an hour to write.

Should the policy cover personal devices?

One line covers it: the same rules apply on your phone as at your desk, the data rule most of all.

How often should I update it?

Twice a year, and whenever you add a tool. The date on the page tells people it is current.

I write one with the team on the day of every workshop. On its own it is an hour on a call and a page back the next day.

What is the single most important rule?

Number three, what never goes into a tool. You can recover from a mistake on any of the others.

How do I write an AI policy for a small company?

Keep it to one page with five rules: what you use AI for, what you do not, what never goes into a tool, who checks the output, and what you tell customers. If your team cannot read it in five minutes and repeat it back, it is too long.

Every workshop I run ends with one of these. Owners ask for it every time, and every lawyer-written version I have seen ran six pages and went unread.

What goes in a small-business AI policy?

Five rules, in this order:

What we use it for. Drafting, summarizing, research, sorting, first drafts of anything. Name the tools you pay for.
What we do not use it for. Final legal, financial, or medical answers. Anything a customer sees without a person reviewing it. Decisions about people: hiring, firing, pay.
What never goes into a tool. Customer personal data, passwords, contracts, anything a client told you in confidence, anything you would not paste into an email to a stranger. People break this one by accident more than any other.
Who checks. A person reads everything AI drafted before it goes out, and that person's name is on it.
What we tell customers. If they are talking to a bot, they are told so and offered a person. If someone used a tool to help write a letter, customers do not need a footnote, same as spellcheck.

Put a date and the owner's name on it, and you have a policy.

What should I leave out?

Anything that reads like a vendor's compliance kit: risk matrices, governance committees, acceptable-use appendices. If you are a company of fourteen people, the policy is a set of house rules, and house rules only work when everyone can repeat them.

Does it need a lawyer?

Have a lawyer read it, especially the data rule, and especially if you are in healthcare or finance or hold anyone's personal information. Do not have one write it, or it will turn into six pages.

How do I get the team to follow it?

Write it with them. The best AI policies I have seen came out of a room where the team listed what they were already nervous about. People keep rules they asked for. Rules handed down from the top get worked around.

Then put it where people will see it: on the wall, in a pinned message, on the first slide of the next all-hands. A PDF on the shared drive does not count.

What about the tools' own rules?

Pay for the business version of whatever you use. The free versions of most tools can train on what you type. The business versions generally do not, and say so in writing. That one switch covers a lot of the data risk for about twenty dollars a seat.

Answered by Jared Lukes, Minneapolis. Twenty-five years in brand, UX, and technology, currently holding fractional AI and technology seats at three companies. About Jared.