A One-Page AI Policy for Small Businesses: Nine Lines Your Team Will Read

The first AI policy I ever read was fourteen pages long. It had a purpose statement, a scope statement, a definitions section (with the word "artificial" defined) and a flowchart with eleven decision diamonds. It had been written by a committee over three months. By the time it was published, the team had been pasting customer emails into a free chatbot for half a year, and the person who finally read the whole thing was an intern, who did what any sensible intern would do: pasted it into a chatbot and asked for a summary.

This is not a story about bad people. It is a story about the wrong size of document. Small businesses are not slow to adopt AI. They are slow to write down how they use it, because every template they find was written for a company with a legal department. This guide gives you the other thing: one page, in plain words, that a team of five or fifty will read, remember and follow. I will show you what goes on it, why each line is there, how to introduce it in a week and how to keep it alive.

One caution up front. I am a project and operations manager, not a lawyer. Rules about privacy, consumer protection and regulated industries differ by state and by field, and they change. Treat this as a practical starting point, and have a professional review your policy if you handle health, financial or other regulated information.

Why a small business needs a policy at all

Not because a regulator asked. Because three ordinary things happen in every business that uses AI:

1. Information leaks by accident. Somebody pastes a customer list, a contract or a price sheet into a tool because it was the fastest way to get an answer. Nobody meant harm. The text now lives somewhere the owner did not choose.
2. Wrong answers go out with confidence. An assistant invents a clause, a date or a policy and the draft goes to a customer with the company's name on it.
3. Nobody knows who is responsible. When the message was written by a tool and sent by a person, each assumes the other checked it.

A policy does not remove these risks. It does something more modest and more useful: it makes the rules visible, so that the people doing the work do not have to guess. If you have read the earlier parts of this series, you have already seen the pieces. Part 1 offered the traffic-light map of tasks, Part 3 set the rule "AI drafts, a person checks" and what to automate first set the 4R filter. This article is the page that holds them together.

1WhyOne sentence on what AI is for

2OwnerA named person and a backup

3Approved toolsBusiness accounts, paid by the business

4Data rulesThe traffic light: green, yellow, red

5Review ruleA named person checks every output

6CustomersWhat you tell them about AI

7Red linesWhat nobody does with AI here

8When something goes wrongTell the owner the same day, no blame

9Review dateIn 90 days, then every six months

The page: nine lines

Here is the page. Each line has a short instruction and an example in plain words. Use your own words. If a line takes more than three sentences, it is too long.

1. Why. One sentence on what AI is for in your business. Example: "We use AI to save time on drafts and paperwork, and we never use it to decide anything that affects a person."
2. Owner. One named person who keeps the policy, answers questions and decides on new tools, and a backup. Not "management". A name.
3. Approved tools. A short list: the tools the business has chosen, on business accounts, with the business paying. Anything else is "not yet approved", which is different from forbidden: it means "ask the owner first".
4. Data rules. The traffic light, below. This is the line people will remember if they remember only one.
5. Review rule. A person reads every output before it leaves the building, and that person's name is on it. Numbers, names, dates and promises are checked against the source.
6. Customers. What you tell them. If a customer is talking to an automated assistant, they are told so. If a message was drafted with help, a person has read it and stands behind it.
7. Red lines. Things nobody does with AI in this business, for example: no decisions about hiring, firing, pay or discipline; no legal, medical or financial advice to customers; no firm prices, discounts or deadlines promised by a tool.
8. When something goes wrong. Tell the owner the same day, no blame. Write down what happened and what you changed. The aim is to learn, not to hunt.
9. Review date. The policy is reviewed in 90 days and then every six months. The date is on the page.

That is the whole thing. It fits on one side of a sheet with room for a signature line. The sections below explain the lines that need more than one sentence.

The data traffic light

Most of the risk in a small business comes from one question: what did I just paste? The traffic light answers it in two seconds.

Topic	Green: public or harmless	Yellow: internal, not sensitive	Red: sensitive or someone else's
Examples	Text already on your website. Published prices. Product descriptions.	Your own process notes. Draft emails without personal details. Meeting notes with the names removed.	Customer names with contact details. Health or financial information. Passwords and keys.
Also	General questions with no person or contract in them.	Anything the owner has said is fine for business accounts.	Contracts with confidentiality terms. Other companies' secrets.
Where it may go	Approved tools	Approved tools on business accounts, with the owner's settings	Never into a chatbot

• Green: public or harmless. Text already on your website, published prices, product descriptions, general questions that have nothing to do with a person or a contract. Can go into approved tools.
• Yellow: internal but not sensitive. Your own process notes, draft emails without personal details, meeting notes with the names removed. Only into approved tools on business accounts, with the settings the owner chose.
• Red: sensitive or someone else's. Customer names with contact details, health or financial information, passwords and keys, contracts with confidentiality terms, other companies' secrets, anything you promised to keep private. Never into a chatbot. If the work needs it, do that part by hand or use a tool the owner has specifically approved for it.

When in doubt, treat it as one level redder. The cost of asking is thirty seconds. The cost of not asking can be a customer's trust.

The contract review guide goes deeper on the same habit for one kind of document: read the tool's terms about storage, retention and training before you paste anything.

Choosing the approved tools

Writing "approved tools" on the page is easy. Deciding what goes on the list takes an afternoon, and it is worth doing once. For each tool you consider, write down the answers to five plain questions:

1. Where does our text go, and for how long? Look for the provider's statement on storage and retention.
2. Is it used to train the tool? Many business plans let you opt out. Many free plans do not.
3. Who can see it? On your side (which accounts, which people) and on theirs.
4. Can we delete it, and can we leave? A tool you cannot leave is a contract, not a tool.
5. Whose account is it? Business accounts, paid by the business, owned by the business. Personal accounts walk out the door with the person.

If a tool fails question 2 or 4, it can still be fine for green information. It cannot be on the list for yellow. Writing that down is the difference between a policy and a wish.

The review rule, with teeth

"A human reviews everything" sounds responsible and means nothing until it has a name and a size. Make it concrete:

• Every output that leaves the building has a named person. The sender is the owner of the content, whatever wrote the first draft.
• Check the facts, not the grammar. Numbers, names, dates, prices and promises come from the source, not from the draft. The assistant is excellent at sounding right.
• Sample once a week. The owner reads five outputs picked at random. Looking for the mistakes that sound right.
• Mark the gaps. The tool writes "[CONFIRM]" instead of guessing. A draft with open brackets is honest. A draft without them is suspicious.

This is the same discipline that good project managers apply to a status report: the machine can gather and format, a person decides what is true. The Project Management Institute's recent standard for AI in project work is built around human oversight for the same reason; I looked at it in PMI's Summit and what it says to a small team.

The stop rule: write it before you start

Here is the line that most policies forget, and it is the one with the best return. Before any AI pilot starts, write two things: the number that should move (hours per week, errors per month, minutes to first reply) and the date on which you will stop if it has not moved.

Why it matters: enthusiasm is a poor project manager. A tool that "feels useful" can run for a year without saving anyone an hour, because nobody wrote down what useful meant. The Gartner survey I wrote about recently found that only 31% of the CIOs it asked had rules for stopping unsuccessful AI pilots; I covered it in only 13 percent see significant value from AI. The lesson works at any size: a stop rule is not pessimism. It is how you keep the pilots that work and release the rest. Measuring benefits explains the baseline, target and owner that make the rule easy to apply.

An illustrative example: an 11-person plumbing company

This is a made-up business, to show the sequence. Harbor & Pine Plumbing has eleven people, two dispatchers and an owner who does the quotes at night. On Monday the owner writes the page in 40 minutes, using the nine lines above. The traffic light is the longest part: customer addresses and phone numbers are red; the price list is green; the draft quotes without names are yellow.

On Wednesday a dispatcher, who had been pasting job notes with addresses into a free chatbot to write friendlier appointment texts, hears the 30-minute walk-through and says, "Oh. I do that." That sentence is the whole value of the exercise. Nobody is blamed. The company moves the task to its approved business tool, with the addresses left out and filled in by hand, and writes down one stop rule: "If appointment no-shows have not dropped by December 31, we stop and go back to the old text."

Notice what the policy did not do. It did not ban anything the team was doing well, it did not need a lawyer to read and it did not take longer than a staff meeting. It made a quiet habit visible, while the habit was still small. The details here are illustrative.

A one-week rollout

Day 1DraftThe owner writes the nine lines in 40 minutes.

Day 2ToolsList the approved tools with five questions.

Day 3The conversation30 minutes with everyone: what do you already use AI for?

Day 4Sign and publishEveryone signs. Put it in onboarding and on the wall.

Day 5Set the reviewThe 90-day review goes in the calendar.

Treat the policy like a small project, with an owner, a date and a finish line. It is the habit from Project Focus on one page applied to a piece of paper.

• Day 1: draft. The owner writes the nine lines in 40 minutes, fast and rough.
• Day 2: tools. Make the list of approved tools, using the five questions above. Cancel or move the personal accounts.
• Day 3: the conversation. Thirty minutes, with everyone, using one printed page. Ask one question: "What do you already use AI for?" Listen. Do not judge.
• Day 4: sign and publish. Everyone signs the page, which says nothing more than "I have read it and I know who to ask." Put it in the onboarding folder and on the wall.
• Day 5: set the review. Put the 90-day review in the calendar, with a short agenda: what changed, what went wrong, what to add.

A RACI chart of who owns what, a short project charter for the rollout and a line in the risk register for "sensitive data in an unapproved tool" are all easy additions if your team likes structure. The lightweight governance guide explains why the page should stay small even as the business grows.

The hall of fame of AI policy mistakes

• The fourteen-page policy. Complete, correct and unread. The intern's chatbot will summarize it for you.
• The borrowed policy. Copied from a big company, with the legal department's vocabulary and none of your tools.
• The total ban. People use AI on their phones anyway, and now they hide it. A rule that cannot be followed trains people to stop telling you.
• No owner. "Everyone is responsible" means nobody answers the question on Thursday afternoon.
• No review date. Tools change every quarter. A policy that never changes is already out of date.
• A policy without a conversation. A page that nobody has discussed is a poster.
• Punishing the honest mistake. The first person who reports a leak and is blamed will be the last.
• Forgetting the manual way. If the tool is down or banned tomorrow, how does the work get done? Write it down.

Check where you stand

The tool below checks whether your policy is ready. Tick what is already true.

Interactive tool

Is your AI policy ready?

Loading the tool…

What to do this week

1. Open a blank page and write the nine lines in 40 minutes. Rough is fine.
2. Name the owner and a backup, on the page.
3. List the AI tools your team uses today, including the ones on personal phones. Ask, do not accuse.
4. Sort your information into green, yellow and red, with three examples of each from your own business.
5. Write one stop rule for the AI task that costs you the most time.
6. Book a 30-minute conversation with the team and the 90-day review, both in the calendar.

If you would like help turning this into a one-page policy for your business, with the traffic light and the stop rule tailored to your work, see my services or take the diagnostic. This article is general information, not legal advice: for regulated information, ask a qualified professional.

Frequently asked questions

What should a small business AI policy include?

Nine short lines on one page: why you use AI, a named owner, the approved tools, the data rules (what may and may not be pasted), the review rule (a named person checks every output), what you tell customers, the things nobody does with AI, what to do when something goes wrong, and the review date. Short enough to be read and remembered.

Can employees use ChatGPT or other free AI tools for work?

That is a decision for each business. A sensible default is to allow approved tools on business accounts for green and yellow information, and to keep customer data, passwords, contracts under confidentiality and anything regulated out of unapproved tools. Free personal accounts often have different terms about storage and training, so read them before you allow anything.

Do I need a lawyer to write an AI policy?

Not to write the first page, but a professional should review it if you handle health, financial or other regulated information, or if you sell to consumers in a regulated field. Rules differ by state and industry and they change, so check the current official pages and ask a qualified adviser.

How often should I update an AI policy?

Review it after 90 days, then every six months, and whenever you add a tool or something goes wrong. Tools and terms change quickly, so a policy with no review date is out of date by the next quarter.

Join the conversation

Did this help? A quick reaction tells me what to write next.

Useful Made me smile Go deeper on this

Be the first to react.

Comments

Loading comments…

Leave a comment

Name (optional) What is the first thing your team already uses AI for that you did not know about? Post comment

No email and no sign-up. Every comment is reviewed before it appears. Please keep it respectful and leave links out.