What should a small business AI policy say? One page is enough

Most companies that write an AI policy write the wrong one. It is long, it is written for lawyers, and it is ignored by Friday. Meanwhile staff keep using whatever tools they found, on personal accounts, with whatever data was to hand.

The point of a policy is to change behaviour. That means it has to be short enough to remember.

This is practical guidance, not legal advice. If you handle sensitive personal or regulated data, have your privacy lead or counsel review your policy.

Your staff are already using AI

In a 2026 survey commissioned by PagerDuty, 66% of office workers at large companies said they had used AI tools they believed were against policy, and 88% had shared work information with public AI tools. The sample was large companies, but small businesses are no different: the tools are free, fast and useful.

So the question is not whether AI is used at work. It is whether it is used in a way you can see and stand behind. Bans mostly move it out of sight.

The six things a one-page policy needs

1. Approved tools. Name them. Prefer business accounts, where you can usually turn off training on your data and control retention. Say how someone asks for a new tool to be added.

2. Data that never goes in. Be concrete. A typical list: customer personal information unless the tool is approved for it, passwords and keys, financial account details, anything under a confidentiality agreement, and unannounced company plans. If in doubt, leave it out or ask.

3. Checking before use. AI output is a draft. Someone reads it before it goes to a customer, into a decision, or into the books. For numbers and facts, check the source.

4. Being open with customers. Decide when you will tell people AI was involved, for example in customer support or anything that affects a decision about them. Some jurisdictions now require it in specific situations, such as Ontario's job-posting disclosure rule for AI used in hiring.

5. Who to ask. One named person for questions, new tool requests and "I think I made a mistake." Make it safe to own up quickly.

6. When it gets reviewed. Tools change every few months. Review the policy quarterly, and keep the date at the top.

A template you can adapt

AI at [Company]: how we use it Last reviewed: [date] · Questions: [name]

Use these tools: [Tool A, business account], [Tool B]. Ask [name] to add others.

Never enter: customer personal information (unless the tool is approved for it), passwords or keys, bank or card details, anything under NDA, unannounced plans.

Always check: AI output is a draft. Read it before it goes to a customer, into a decision or into our records. Check numbers against the source.

Tell customers when AI drafts a reply they receive or helps make a decision about them.

Made a mistake? Tell [name] straight away. Fast is better than perfect.

That is the whole policy. Everything else belongs in training.

Make it stick

A policy works when people understand the reasoning, so walk through it with the team rather than emailing it. Pair it with training on real work, so the approved tools are also the most useful ones. And ask, without blame, what people are already using: you will learn where the policy needs to bend.

For BC companies, there is more on how the province's privacy law applies to staff using AI tools in does BC PIPA apply when your staff use ChatGPT?

We write the policy with you as part of our training and transformation work, and our AI readiness assessment starts by finding out what tools are already in use.