Why you want one
Three reasons. Risk: without rules, customer data and confidential documents end up in unvetted tools. Clarity: many employees avoid AI because nobody told them what is allowed, which wastes productivity. And increasingly, customers and regulators ask how you govern AI, from procurement questionnaires to emerging state AI laws.
The six questions a good policy answers
1. Which tools are approved? Name them, including the account type: for example ChatGPT Team, Claude for Work, Microsoft Copilot on the company tenant. Everything else needs sign-off first.
2. What data may go in? Use three buckets: green (public and non-identifiable information, always fine), orange (internal information, approved business tools only) and red (personal data, financials, credentials, anything under NDA: never without explicit approval).
3. Who owns the topic? Appoint one owner for questions, approvals and keeping the tool list current.
4. How do we check AI output? A human reviews anything that leaves the building. AI is confidently wrong at times; accountability stays with the employee.
5. When are we transparent? Decide when you tell customers AI was involved, for example customer-facing chatbots.
6. How do we keep learning? Review the policy and tool list quarterly. A static AI policy is outdated within a year.
How to roll it out
Draft it yourself in an afternoon, then discuss it in a team meeting before finalizing. People follow rules they helped shape. Pair the rollout with a short hands-on training so the policy lands as better ways of working, not as a list of bans.
FAQ
How long should an AI policy be?
One or two pages. A twenty-page document nobody reads protects nobody.
Do small businesses really need this?
Yes. The risk of an employee pasting customer data into a random tool does not scale with company size.
Who should write it?
Whoever owns operations or IT, together with the people who use AI daily. Legal review helps but should not be the starting point.