Every workshop I run ends with one of these, because every owner asks for it and every lawyer-written version I have seen is six pages nobody read.
What goes in a small-business AI policy?
Five things, in this order:
- What we use it for. Drafting, summarising, research, sorting, first-pass anything. Name the tools you actually pay for.
- What we do not use it for. Final legal, financial, or medical answers. Anything a customer sees with no human review. Making decisions about people: hiring, firing, pay.
- What never goes into a tool. Customer personal data, passwords, contracts, anything a client told you in confidence, anything you would not paste into an email to a stranger. This is the rule that matters most and the one people break by accident.
- Who checks. A person reads every AI-drafted thing before it goes out, and their name is on it. The tool does not have a name. The person does.
- What we tell customers. If they are talking to a bot, they are told it is a bot and offered a person. If a person used a tool to write something, that is nobody's business, same as spellcheck.
That is the policy. One page, with a date on it and the owner's name.
What should I leave out?
Everything that sounds like it came from a vendor's compliance kit. Risk matrices, governance committees, acceptable-use appendices. You are a company with fourteen people. The policy is a set of house rules, and house rules work when everyone can repeat them.
Does it need a lawyer?
Have one read it, especially the data rule, especially if you are in healthcare, finance, or handle anyone's personal information. Do not have one write it, or it will become something nobody reads.
How do I get the team to actually follow it?
Write it with them. The best AI policies I have seen came out of a room where the team listed the things they were already nervous about. When the rules are the ones they asked for, they keep them. When the rules come down from the top, they get worked around.
Then put it where people can see it. Not a PDF on a shared drive. A page on the wall, a pinned message, the first slide of the next all-hands.
What about the tools' own rules?
Pick the paid version of whatever you use. The free versions of most tools can train on what you type. The business versions generally do not, and say so in writing. That one switch covers a lot of the data risk, and it costs about twenty dollars a seat.
Answered by Jared Lukes, Minneapolis. Twenty-five years in brand, UX, and technology, currently holding fractional AI and technology seats at three companies. About Jared.