What belongs in an AI policy for a small business?

People need concrete limits. Without a rule, each person decides for themselves what is confidential, which account is good enough, and when a result must be checked.

That creates two problems at once. Some do not use AI at all, even where it would help. Others copy documents into private accounts and accept answers without enough control.

An AI policy creates a shared starting point. It replaces neither training nor professional review, but it states what is allowed today and who decides when something is unclear.

The first step: give the first draft an afternoon, not a week.

Do not just write “AI tools” in the policy. Name the approved services and account types.

State whether private accounts are allowed for business tasks, and who reviews and approves new tools. A tool is not trustworthy because it is well known. What matters is the contract, settings, data processing, access rights, and intended use.

The next step: list every tool your team already uses, including the unofficial ones. Only then can you see what stays and what does not.

A traffic light alone stays abstract. It only works once it is tied to real documents.

A painting business with seven employees did exactly that as a team. Half an hour, three people, one sheet of paper. Quotes and photos of finished jobs became green. Internal costings and supplier prices became yellow. Customer addresses, contracts, and staff health information became red.

Try it yourself: sit down with two or three people from your business and sort your five most common documents into the traffic light.

Start with tasks whose result a person can easily check: outlines, drafts, summaries of public content, or ideas with invented sample data.

Mark what must not run on its own. That includes binding prices, payments, bookings, legal advice, HR decisions, and sensitive customer cases.

Make it concrete: write two columns on a sheet, “AI may prepare” and “a person always decides”, and fill both with your own tasks.

“Please check” is too vague. Define who reviews which output. A marketing lead checks different points than accounting or management.

The review covers at least facts, figures, sources, tone, completeness, and confidential information. High-impact content also needs a professional sign-off.

Put it in writing: for every task from Rule 3, name the person who reviews it before it leaves the building.

AI can produce a draft. It cannot take responsibility. Every published statement, customer reply, and business decision needs a named person.

Public-sector guidance draws the same line. The UK government reminds its civil servants that they remain responsible for their own actions when they use generative AI tools.

Write it down like this: “For [task], [name] is responsible”, for the three highest-risk tasks in your business.

People must know what happens after a wrong entry. A mistake kept quiet is harder to contain than one reported early.

Name a simple path: stop using the tool, inform the responsible person, record the data and account involved, and have a specialist review the next steps. The rule should make reporting easier, not punish it.

Make the path visible: put the four steps where your team sees them daily, for example in the internal chat.

Tools, settings, and legal conditions change. Update the policy outside the fixed date too, whenever a new service, use case, or data type appears.

AI rules are still taking shape, with the EU AI Act coming into force in stages, while existing data protection law already applies. A date and an owner therefore belong on every policy document.

Set a fixed date: easiest is to pair it with the annual team meeting.