Most small businesses have no AI policy. Not because nobody cares. Because every template they find online runs pages and pages of legal language nobody at a small company is ever going to read, let alone follow.
I keep a written set of rules that my own AI tools have to follow, and I keep it short for exactly that reason. A rule nobody can recall in the moment they need it is not a rule. It is a document.
Here is the two-page version. Copy it, change the name at the top, and you have something real instead of nothing.
Company Name AI Use Policy
Purpose
We use AI tools to work faster and think clearer, not to replace judgment or hide behind a machine. This exists so everyone on the team knows the guardrails without guessing.
What you can use AI for
Drafting: emails, proposals, internal notes, a first pass at anything you would otherwise write from a blank page.
Research: summarizing documents, comparing options, finding information faster than digging for it yourself.
Cleanup: reformatting, editing, checking your own work for gaps before it goes out.
Ideas: brainstorming, testing an angle before you commit real time to it.
What you cannot do
Never paste a customer's personal information, financial details, or anything under an NDA into a public AI tool. If it would embarrass the business to see it leaked, it does not go in.
Never send AI-generated content to a customer or the public without a human reading it start to finish and taking responsibility for it.
Never let AI make a decision that affects someone's job, pay, or standing with us. That decision has a name attached to it, and the name is not the AI's.
Never present AI output as your own original research or expertise. Say it was AI-assisted if anyone asks, internally or externally.
Data rules
Company and customer data goes only into tools the business has approved and paid for. Never free public tools, unless the data is already public.
Not sure if a tool is approved? Ask before you paste anything in. Asking twice costs nothing. Guessing costs everything.
Who owns this
A named person, not a team, owns this policy. Bring questions, mistakes, and new tool requests to that person, not around them.
Review date
Reviewed every six months, or sooner if a new tool changes what is possible. Current version: Month Year.
That is the whole thing. Two pages, no lawyer required to read it out loud.
One line in there is doing more work than the rest. The one about never letting AI decide anything that touches somebody's job, pay, or standing. That is not a legal line, it is a people line. When I was in the corporate world, every decision that moved someone's pay or standing had a name attached to it, and everyone involved knew whose name it was. That does not stop mattering because the tool got faster. It matters more, because now the decision can be made in a second by something that will never have to look anyone in the eye.
The point of a policy this short is that people use it. A long document gets written once, filed, and forgotten. A two-page one gets pinned above someone's desk. Adjust the specifics to fit how your team really works. The shape is the part worth keeping.
Fair warning on what happens after you write it. The moment you put this in front of your team, someone asks who is going to check any of it. Writing the policy takes an afternoon. Deciding whose job it is to enforce it is the part that stalls, and it is where most of these documents die.
Three things before you go
Forward this to one business owner still running on no AI policy at all. It costs you nothing to pass along. One forward is more useful to me than ten retweets.
Was this forwarded to you? Subscribe at signal.catalystworks.consulting.
Reply and tell me what you changed in your version. I read every one and it shapes what ships next.
Boubacar
I help companies put AI to work without the confusion.
[email protected] · signal.catalystworks.consulting