Write a one-page AI usage policy

Why one page is enough to start

The biggest AI risk in most small businesses is not exotic — it is a well-meaning employee pasting customer data or confidential numbers into a public chatbot. A short, clear policy prevents that better than a forty-page document nobody reads.

The five decisions to write down

1. Approved tools: which AI tools staff may use for work, and which accounts (business accounts with data-protection terms, not personal ones).

2. Allowed uses: drafting, summarizing internal material, brainstorming, translation — your list will differ by team.

3. Data that never goes in: personal data of customers or employees, contracts, financials, credentials, and anything under NDA — unless the tool is specifically approved for it.

4. Human checking: any AI output that affects a customer, money, health, a legal matter, or public content must be reviewed by a named responsible person before use.

5. Questions: one named person who answers 'is this okay?' — ambiguity is where mistakes happen.

Keep it alive

Review the page every six months or when you adopt a new tool. A policy that names tools you no longer use teaches people to ignore policies.

When you are ready for the next level — inventories, risk screening, vendor review — our free screening tools and guides pick up where this page ends.