AI policy for small business: a one-page policy you can copy today

Quick answer: do small businesses need an AI policy? Yes, once more than one person uses AI tools at work. An AI policy for small business sets ten plain rules: which tools staff may use, what never to paste in, who checks the output, and who to tell if something goes wrong. Copy the one-page policy below, and read how to introduce it in a single meeting.

Most owners did not plan to have an AI policy. Someone started using a chatbot to draft replies, another person tried it for a quote, and now half the team uses AI tools with no rule about what is safe to type into them. The fix does not need to be complicated or expensive. It needs to be short enough that people actually read it.

This page gives you ten rules in plain English, laid out as a policy you can copy today, plus a short plan for introducing it without a long meeting nobody wants to sit through.

Skipping a policy is not free, either. A single email sent with a client's medical note pasted in by mistake, or a quote drafted using details lifted from the wrong file, costs more time to fix and apologise for than writing ten rules down ever would. Staff are not trying to cause a problem. They are filling a gap nobody addressed, usually because speed mattered more in the moment than a rule that did not yet exist. The point of this page is to make prevention cheap: fifteen minutes now, instead of a difficult phone call to a client later.

Who needs an AI use policy, and why now

Any business where more than one person touches a customer, a contract or a piece of personal data needs a written rule about AI, even a two-person office. InterTradeIreland's seven AI readiness questions for SMEs puts one of its seven questions directly on this point: does everyone in the business have guidance on using AI responsibly, and do they know what counts as sensitive. Most small businesses have no answer to that question yet, because nobody has written one down.

A policy also protects the business, not just the customer. If a member of staff pastes a client's financial details into a public AI tool to get a faster answer, that information can sit on a server you do not control, and you may not find out until a client asks why their details showed up somewhere they should not have.

The ten rules, and the one-page policy you can copy

These ten rules cover the decisions that come up most: which tools to use, what never to type in, who checks the result, and what to do when something goes wrong. Copy the table as it stands, or adjust the wording to match how your business actually talks.

Rule one matters more than it looks. Different AI tools keep what you type for different lengths of time, and some use it to train future versions of the tool unless an account setting turns that off. A tool that is fine for drafting a blog post is not automatically fine for drafting a reply that quotes a client's address. Pick your approved tools once, check each one's data and training settings before it goes on the list, and make adding a new tool something one named person decides, not something each employee tries on their own.

Two of these rules come directly from guidance that Spain's data protection authority, the AEPD published in its decálogo Cuidado con lo que le confías: never share personal data or sensitive details with an AI tool, and never use someone else's photo to generate new images from it, especially a child's. The AEPD also recommends describing a general or made-up case instead of a real one, which is rule four above.

How to introduce this policy in one meeting

A policy nobody explains gets ignored. Fifteen minutes is enough if you keep it concrete.

• Open with one real example from the last month: a quote an AI tool helped draft, or a question someone typed into a chatbot. People listen to a real case faster than a rule.
• Read the ten rules aloud, one at a time, and ask whether anyone has already run into a situation like rule two, four or six.
• Name the person staff should go to with a question or a mistake. Write that name into the policy before the meeting, not after.
• Hand out or email the finished policy the same day, while the examples are still fresh.
• Put a date on the calendar six months out to revisit it. New tools change what the rules need to cover.

If a question comes up during the meeting that the ten rules do not cover, write down what the group decided on the spot, and fold it into the policy as an extra rule at the next six-month review.

What this policy is not

A one-page policy is a starting point, not the finished article. Treat it as the first draft of something you will keep adjusting as your business and the tools around it change.

• Not legal advice. Have a lawyer check it against your contracts, your sector's rules and your country's data protection law before you treat it as a compliance document.
• Not a training course. The policy says what to do, not how to write a good prompt or judge whether an answer is accurate.
• Not a substitute for disclosures you already owe regulators, insurers or clients in your line of work.
• Not final. Rewrite any rule that does not match how your business actually operates, then date the new version.

If you are not sure how AI is already being used across your business, the AI readiness assessment is a five-minute starting point. For the difference between a policy like this one and a full review of what to automate, see what an AI audit is. Our own AI audit includes a check of the policy and process gaps this page cannot catch on its own. When you have questions a one-page policy cannot answer, book a free 15-minute call.

Frequently asked questions