If anyone in your business uses ChatGPT, Copilot, Gemini, or the “AI assist” button that just appeared in your email or accounting software, you already have AI in your business. The question isn’t whether to allow it. It’s whether anyone has said out loud what’s okay and what isn’t.

I audit technology risk for a living. In my experience, the problems rarely come from the tool itself. They come from a reasonable person, trying to save time, pasting something into a tool that nobody had thought about.

Why a small business needs one (even a tiny one)

• Your team is already deciding for you. Without a rule, each person makes their own call about what’s safe to paste in.
• Customers and partners are starting to ask. Security questionnaires increasingly include a question about AI use.
• When something goes wrong, you want a record that you set expectations and that people knew them.

A one-page starting point: five rules

You don’t need a 20-page document. Start with five rules everyone can remember:

1. Use approved tools only. Keep a short list of AI tools and accounts the business has approved. Business accounts, not personal ones.
2. Never paste in the “do not share” list. Passwords, payment card details, Social Security numbers, health information, private customer records, and anything a contract says to keep confidential.
3. A person checks before anything goes out. Facts, prices, promises, and anything customer-facing get reviewed by a human who is accountable for it.
4. AI doesn’t make the big decisions. Hiring, firing, pricing for a specific customer, credit, legal, medical, or financial advice stay with qualified people.
5. Speak up fast. If AI produces something wrong, strange, or that exposes information, stop and tell [owner name] the same day. No blame for reporting.

Making it real

A policy only works if people know it exists. Three small steps make the difference:

• Get a signature. Have each person read and sign it, and keep the signed copies.
• List your tools. Write down every AI tool in use, including features built into software you already pay for.
• Put a review date on the calendar. Every 90 days, check whether your tools, their terms, or your uses have changed.

What this isn’t

A starter policy isn’t legal advice, and it doesn’t make you compliant with any particular law. If you’re in a regulated field such as healthcare, finance, or legal services, or you use AI to make decisions about people, have a qualified professional review your approach.