Short answer, as of October 2026: yes, every small business needs an AI policy, and it should fit on one page. The page is below. Copy it, change three lines, and you're done for now.
Most small businesses already have an AI policy. Nobody wrote it down, and every employee has a different version.
Here's what I keep seeing. One person on the team uses ChatGPT for everything, client emails included. Another won't touch it. A third pasted the payroll spreadsheet into a free account last month to “clean up the formatting” and didn't think twice. Same company, three policies.
So when an owner asks me “do I need an AI policy for my staff?”, my answer is yes, and it should fit on one page. The page is below. Copy it, change three lines, and you're done for now.
Quick Answer
Do I need an AI policy for my staff?
Yes. If anyone on your team can open a browser, they're already using AI, or they will be by Friday. The question isn't whether to allow it. It's whether everyone's working from the same rules or making up their own. A one-page policy covers six things, and three of its lines are yours to fill in: the company name, the approved tool, and the person who checks the work.
- →What you may use AI for
- →What never goes into a public AI tool
- →Which tools and accounts are approved
- →Who checks the output
- →How you say when AI helped
- →Who to ask when you're not sure
Do I need an AI policy for my staff?
If anyone on your team can open a browser, they're already using AI, or they will be by Friday. The question isn't whether to allow it. It's whether everyone's working from the same rules or making up their own.
A policy isn't there to slow people down. It's there so a new hire knows on day one what's fine, what's off limits, and who to ask. Without that, the careful people stay careful, the fast people stay fast, and you find out which is which when something goes wrong.
One caution before we go further. I'm not a lawyer, and this isn't legal advice. What's below is a starting point, built from what works in practice. Before you call it final, ask your lawyer or accountant to read it, especially if you handle health, financial or HR information.
Why does one page beat twenty?
Because nobody reads twenty.
A long policy gets written once, signed once, and filed. A one-pager gets pinned above the desk, quoted in a team meeting, and actually followed. That's the difference between a document and a habit.
And that's the real point. An AI policy is about habits, not software. The tools will change names and features every few months. The habits don't: check it before it goes out, keep private things private, use the company account, say when AI helped. Write the policy around those and you won't have to rewrite it every time a vendor ships an update.
The tool is not the system. The policy is part of the system.
What goes in a company AI policy?
Six things. What you may use AI for. What never goes into a public tool. Which tools and accounts are approved. Who checks the output. How you say when AI helped. Who to ask when you're not sure.
That's it. If your draft has grown past a page, something on it is either a legal clause (send it to your lawyer) or a how-to (that's training, not policy).
Here's the page. Three things in square brackets are yours to fill in: the company name, the approved tool, and the person who checks the work and answers questions.
The one-page AI policy
[Company name] AI use policy. Version 1.
1. What you may use AI for.
Drafts, summaries, first versions, outlines, rewrites, and research you then check yourself. AI gives you a starting point. You're still the author, and you're still responsible for what goes out.
2. What never goes into a public AI tool.
Client names, client files, and anything that identifies a client. Payroll, HR, performance and medical information. Anything a client, supplier or colleague gave us in confidence. Passwords, keys, account numbers and login details. If you'd be uncomfortable seeing it on a stranger's screen, it stays out.
3. Which tools and accounts are approved.
Use the company account on [approved tool] only. Not a personal account. Not a free account you signed up for yourself. Not a tool a friend recommended last week. New tools get added to this line after [name] has looked at them.
4. Who checks the output.
Nothing AI helped write goes to a client, into the books, or into a contract until a person has read every line of it. That person is [name], or someone [name] has handed the job to. If you wrote it and you're the only one checking it, read it twice.
5. How we say when AI helped.
We don't hide it, and we don't advertise it. If a client asks, we tell them. If AI did a real share of the work on something, add one line: “Drafted with AI help and reviewed by [name].”
6. Who to ask when you're not sure.
Ask [name] before you paste, not after. “I wasn't sure” is a fine reason to ask. It's not a fine reason to guess.
Download the one-page policy as a PDF (letter size, no sign-up).
What goes wrong without one?
Here's something I see a lot, and it's never dramatic on the day it happens.
Someone is behind on a proposal. They paste last year's proposal for a similar client into a free AI tool, names and pricing included, and ask it to rewrite the whole thing for the new client. The draft comes back fast. It reads well. It goes out with one of the old client's numbers still in it, because nobody read the whole thing before hitting send.
Three problems in one email. Confidential information went into a tool nobody approved. Output went to a client without a check. And the person who did it wasn't careless. They were busy, and nobody had told them the rules.
A one-page policy doesn't make people careful. It makes the careful choice the obvious one when they're in a hurry.
That's about all a policy can do, and it's enough.
What to do this week
- Copy the template above into a document. Fill in the three brackets.
- Pick the approved account. One company login beats five personal ones, and it means the useful prompts don't walk out the door when a person does.
- Read it out loud at your next team meeting. Ten minutes. Ask everyone for one question.
- Send it to your lawyer or accountant with one line: “Anything here I'm missing for our industry?”
- Put a date on it and plan to reread it in six months. The tools will have changed. The habits probably won't.
Takeaway
Your team is using AI either way. The only choice is whether they're all following the same page or each writing their own. One page, six sections, three edits.
If you'd rather set the standard with your team in a room, using your real work on the screen, that's what our training sessions are built for. And if you want the other ways AI goes sideways in a small business, I wrote up the seven I see most.
Not sure where to start? Book a free 30-minute AI Discovery Call; there's no pitch in it.
