What should a small business AI policy include?

Most small businesses I talk to have an AI policy already. It’s just unwritten, and it says "use whatever you like and don’t tell me about it." That policy has two outcomes: the careful people don’t use AI at all, and the confident people paste things into personal accounts that you’d never approve. A written page fixes both.

Does a small business really need an AI policy?

Yes, and a short one is enough. Pew found half of U.S. workers who aren’t self-employed say their employer neither encourages nor discourages AI chatbots. Without a written line, careful people avoid the tools and confident people use personal accounts. A one-page policy gives both groups the same permission and the same limits.

You don’t need a legal department to write it. The National Institute of Standards and Technology publishes a voluntary AI Risk Management Framework built around four functions: govern, map, measure and manage. A ten-person company doesn’t need all of it. It needs the first idea, which is that somebody specific owns the decisions, and a short list of what those decisions are.

Which AI accounts should employees use for work?

Company business accounts, never personal ones. ChatGPT’s pricing page lists training on your content as opt-out on its individual plans, while OpenAI says it doesn’t train on ChatGPT Business workspace data. Claude’s Team plan states no model training on your content by default. The account type decides where your information goes.

Anthropic’s own pricing page shows the same split: its individual Pro and Max plans list model training as opt-out, and Team and Enterprise list none by default. Google says data in the business editions of Gemini Enterprise isn’t used to train Google models. The rule for the page is simple. Name the one workspace the company pays for, and say that personal accounts are off limits for anything with a client, a patient or a number in it.

What data should never go into an AI tool?

Anything you couldn’t defend putting in an email to a stranger: passwords, card and bank numbers, Social Security numbers, and client information covered by a confidentiality agreement. Health information is its own category. HHS says a cloud provider that handles electronic health information for a covered entity is a business associate and needs a signed agreement.

HHS is explicit that this applies even when the provider only holds encrypted data and has no key. So if you run a practice, the policy line is not "be careful with patient data." It’s "no patient information goes into any AI tool unless we have a signed business associate agreement with that vendor, and here is the list of the ones we do." That’s a line a front-desk employee can follow without a law degree.

Who should check AI output before it goes out?

A named person, for anything a client, patient, court or regulator will see. NIST’s generative AI profile describes confabulation: systems confidently presenting false content. In 2023 a federal judge fined two lawyers and their firm $5,000 after they filed a brief citing cases ChatGPT had invented. The tool wrote it. The people signed it.

The judge in that case, Mata v. Avianca, said plainly that using a reliable AI tool isn’t improper. The problem was that existing rules put "a gatekeeping role on attorneys to ensure the accuracy of their filings," and nobody did the gatekeeping. Your business has the same rule, whether it’s written down or not. Write it down, and say who the gatekeeper is for each kind of document.

What should customers be told about AI?

Enough that nothing you publish misleads them, and you stand behind every answer. In 2024 a Canadian tribunal held Air Canada responsible for its website chatbot’s wrong answer about bereavement fares, rejecting the idea that the chatbot was a separate entity. The FTC’s 2024 rule bans fake reviews, including AI-generated ones by people who don’t exist.

So the customer section of the page covers two things. Anything automated that talks to customers says what it is and offers a person. And nobody on the team uses AI to write reviews, testimonials or endorsements, for the business or about a competitor. The FTC rule lets the agency seek civil penalties against knowing violators, which makes this the cheapest line on the page to follow.

How often should the policy change?

Every 90 days, and whenever you add a tool. Vendors rename plans, change data terms and add features that connect to your email and files. The owner reads the page, checks the vendor terms it relies on, and asks the team one question: is anything you do today not covered here? If the answer keeps being yes, the page is too vague. Where the page says a person approves something, the same thinking applies to any agent you install later.