In plain English
- What happened
- You already have rules for the things that matter — who can speak for the business, what goes on the company page, what happens to a receipt. AI is the one nobody has written down, and it is already in use everywhere: inside email, inside the accounting software, on a personal account at the kitchen table to finish a proposal. An AI use policy is what gets everyone working from the same rules.
- Why it matters to your business
- Your team is using AI whether or not anyone approved it. That is not a discipline problem. It is what happens when a tool is useful and nobody has said anything either way. The cost turns up later: two people answering the same customer question differently, a quote built on a number nobody checked, a reply that went out sounding like somebody else. None of that is really a technology problem. It happens because nobody has agreed what good looks like, so everyone quietly decides for themselves.
- Do this
- Block out an hour. Work down the three columns in the checklist below, write one line for each decision in your own words, and put someone's name against it. A one-page policy people actually read beats a twenty-page one nobody opens.
Your people are already using it
It usually starts with one person and one task. Someone drafts a difficult email with it, the email works, and they use it for the next one. Six months on it is in the quotes, the job adverts and the customer replies, and nobody ever decided that should happen. That is not recklessness. It is what happens when something useful fills a gap that nobody has said anything about.
The gap is that nobody knows which rules anyone else is applying, because there are none to apply. One person is careful with customer details and never sends anything out unread. Another has not really thought about either. Both of them believe they are doing it right, and neither has been told otherwise. A policy is simply the written answer to the three questions they are all guessing at: which tools may I use, what may I put into them, and who checks the result before it leaves the building.
AI will not catch its own mistakes, so the last read before anything goes out belongs to a person. Deciding in advance whose read that is takes the pressure off everyone: nobody has to guess in the moment, and nobody ends up carrying something they did not know was theirs.
AI changes fast. The basics do not.
The software you already pay for keeps adding it. Your scheduling app offers to draft the customer reply. The accounting package offers to write the invoice chaser. The booking system adds a chat box that answers questions overnight. Nobody bought a new tool, nobody broke a rule, and AI is now talking to your customers in your name.
That sounds like a page you would be rewriting every month. You would not be. The tools keep changing; what you decided does not. Customer details still do not go in. A person still reads it before a customer does. Whoever used it still owns the result. Those hold whether the tool is ChatGPT or something that turned up inside your invoicing software on its own.
So when something new turns up, it is usually a line added to your list rather than a rewrite. It helps to pick one person who looks after the page — whoever already keeps an eye on how the business runs is usually the right choice — and to put a reminder in the calendar to read it through twice a year. That tends to be enough to keep it current.
What goes in it
These are the points most small businesses end up covering. They are not rules to adopt as written, because every business is different, but the three columns give you the bones of something real.
| Decide up front | Always review | Never goes in |
|---|---|---|
| Which tools are approved, and which are not | A human reads it before a customer does | Customer names tied to personal details |
| Whether accounts are business or personal | Check every fact, number, date and name | Card numbers, bank info or payment data |
| Who signs off on anything customer-facing | Swap real details for placeholders while drafting | Social security or government ID numbers |
| When you tell customers AI was involved | Keep the final say with a person, not the tool | Employee records, health info or HR matters |
| Who the policy covers, contractors included | Make sure it still sounds like your business | Passwords, keys or login credentials |
| Who to ask, and pausing until they answer | Assume it can be wrong and sound confident anyway | Anything covered by a contract or NDA |
| How new hires learn all of the above | Would this read as fair to everyone it is about? | Internal plans or pricing you do not publish |
| Whether AI may imitate a real person's voice | Use approved tools on business accounts only | Customer information they did not agree to share |
| What counts as AI in your business | Check the output itself holds no personal data | Anything you would not want to see in a screenshot |
| Who approves a new tool, or a new use of an old one | Check it does not lean on someone else's work | Material you have no licence to use |
| What happens if someone ignores the rules | — | A partner's or a client's confidential information |
| When you will look at this again | — | — |
One row there is worth a moment: what counts as AI in your business. Most people picture a chatbot and stop, then miss the meeting recorder writing the summary, the inbox offering to draft the reply, the accounting tool sorting transactions, and anything that ranks or scores applicants. Where you draw that line matters more than any list of technologies, because it is your line. A fuller policy goes further again — the licence terms of the tools, the laws your use sits inside, what the business owes in return — and those are worth adding as you grow into them.
Getting it written
- 1
List the tools you already use, including the ones you forgot are AI
The obvious ones are ChatGPT and Claude. The ones people miss are already inside email, the CRM, the accounting package and the meeting recorder. Anything that reads your data and writes something back belongs on the list.
- 2
Ask people what they are already using it for
You will probably be surprised, and that is the point. Asked as a straight question rather than a disciplinary one, people will tell you. What comes back is the real scope of your policy instead of the scope you imagined.
- 3
Write the never list before the yes list
The third column is the shortest, the least arguable and the one people remember. Starting there gives you something useful before anyone has finished debating which chatbot is better.
- 4
Name a person for sign-off, not a department
Anything going to a customer benefits from one named person who has checked the facts, the tone and the privacy of it. Naming a department instead usually means nobody does it, because everyone assumes somebody else has. Write down who that person is, and who picks it up when they are away.
- 5
Tell people it exists
Walking the team through it once, in person, does much more than emailing it round, and it is worth making part of how new people are shown the ropes. If it only ever lives in a folder, it will not change what anyone actually does.
Reality check
Two things here are worth thinking twice about. The first is buying a twenty-page template: it tends to go in a drawer unread, which leaves you with the paperwork of a policy and none of the behaviour. The second is banning AI outright, which is the more expensive mistake, because it does not stop the work happening — it moves it onto personal phones where nobody can see it. A short set of rules people actually follow does more than a strict set they quietly work around.
Work down the three columns with whoever else makes decisions. An hour of that, in your own words, and everyone comes out on the same page.
One note to close. This is educational rather than legal advice, and anything you put in place is worth running past your team, your attorney, or whoever handles that for you. Tools and their terms also change without notice, so the tool's own site is the place to check where things currently stand.
