An AI policy for a small business

What goes on the page

1. Approved tools: name them, and say which account type, work or personal.
2. Never paste in: customer records, passwords, payment details, anything you promised to keep private.
3. Check before it goes out: a person reads anything sent to a customer, a supplier or the public.
4. Say so when it matters: tell the customer if AI wrote the reply, when your rules or theirs require it.
5. Ask first: who to ask about a new tool or a new use, and how fast they answer.
6. When it goes wrong: tell the owner the same day, and nobody gets in trouble for reporting.

Check the tools, not just the people

Plans differ on whether your inputs can be used to train the vendor's models and on admin controls. Read the vendor's own page for the plan you pay for, and write the result into the policy. The Claude pricing page, for example, has a model-training row by plan (checked 2026-10-17). Vendors change these settings, so recheck them every few months.

How to roll it out

• Write it with two or three people from your team, so it fits how they work.
• Go through it in a short meeting, with a real example of a good use and a bad one.
• Print it, and keep a copy where the tools are listed.
• Review it in three months, then once a year.

When you need more than one page

If you handle health, financial or legal records, or have contracts that restrict where data may go, one page is not enough, and that is a question for a qualified adviser. NIST publishes a much larger risk framework if you want to see what the long version looks like. A template is a start. If you want it fitted to your tools and your data, that is something I can do with you on a Mapping.