A free 15-minute Zoom call. No cost, no pressure.Start with one page, not a binder
A policy nobody reads is worse than no policy. Aim for one page. Two at most. Write it in the same voice you use in a staff email, not the voice of a lawyer.
Cover four things and you are done:
- What AI is allowed for
- What must never go into a public AI tool
- What to check before trusting an answer
- Who to ask when someone is unsure
Date it and put a name at the top of who owns it. A policy with no owner quietly dies. Review it every few months as your tools change.
If you are in law, medical or finance, add a short section on client files. That is the part your team will ask about most.
Say plainly what AI is allowed for
People freeze when the rules are vague. Give real examples of good first uses so nobody has to guess.
Things most small businesses are happy to allow:
- Drafting and tightening emails
- Summarizing a long document that is not sensitive
- Brainstorming names, subject lines and wording
- Turning rough notes into a first draft of a proposal
- Cleaning up grammar in something already written
Say it in plain terms. "You may use AI to draft customer emails and internal notes." That one line removes a hundred small questions.
Also say where the approved account lives. If everyone is on a personal login, the policy should point them to the company account instead.
Be clear about what never goes in
This is the heart of the policy. Keep the never list short and specific so it sticks.
A normal starting list:
- Client or customer files you have not been told are safe to share
- Anything with a Social Security number, account number or card number
- Passwords and login details
- Signed contracts and legal documents, unless cleared
- Medical details, unless cleared
- Anything you would not want forwarded to a stranger
Explain why in one sentence: a public AI tool may keep what you paste. That is the whole reason for the list.
If your office handles sensitive files, note the two ways around it. Zero data retention means the AI provider does not keep your prompts or files after it answers. Private AI on a machine in your office means the files never leave the building. Both are worth a line in the policy so staff know the option exists.
Tell people to check the answer
AI is confident even when it is wrong. Your policy should say so out loud, so nobody is embarrassed when they catch a mistake.
A simple rule: AI drafts, a person decides. Anything going to a client gets read by a human before it sends. Names, numbers, dates and figures get checked by hand every time.
Add a line about made up details. AI will sometimes invent a source, a policy or a date that sounds right. If the answer matters, verify it against the real document.
This one section heads off a lot of the trouble people worry about.
Name who to ask, and keep it human
The most useful line in the whole policy is a name. "Not sure? Ask ___." Without it, people either guess or stop using AI altogether.
Pick one or two people. It can be an office manager, an owner, or whoever set up your AI. Give them the job of answering the small stuff: is this allowed, can AI do this, where do I log in.
Say what happens when someone gets stuck. A quick text or email to that person beats a stalled afternoon.
This is also where a support arrangement helps. If you have a real person to call, put their contact route in the policy so the team knows help exists.
Cover personal accounts and training
Two loose ends trip up most small businesses.
First, personal accounts. Staff often start on their own free ChatGPT or Gemini login before you have anything official. Decide whether that is fine for low risk work and when they should move to the company account. A short line covers it: "Use the company account for anything work related. Personal accounts are fine for practice only."
Second, training. A policy is not training. Set aside time to walk the team through the page, show a good example and a bad one, and let them ask questions. New staff get the same walkthrough on day one.
Keep the policy where people can find it, not buried in a folder.
A normal week with a policy in place
Here is what it actually looks like once the page exists.
Monday, someone drafts client emails in the approved account and sends them after a read. Tuesday, a staff member hits a contract and checks the never list, then asks the named person, who says it is fine for this one. Wednesday, a proposal gets a first draft from rough notes and a human tightens it. Thursday, a new hire gets the policy walkthrough. Friday, someone flags that a tool changed and the owner updates one line.
Nothing dramatic. Just fewer stalls and fewer worries.
If you want help writing the page and setting the account up to match it, start with the free AI game plan. It is a free 15-minute Zoom call, no cost and no pressure, where we look at your business and say what to cover first.