Your team is already using AI, whether or not you have a rule about it. Yet only about 21% of organizations report having a mature model for governing autonomous AI agents (Deloitte, State of AI in the Enterprise, 2026), which means roughly four out of five are scaling AI faster than their guardrails. If large enterprises with legal departments are behind, a small business with no written policy is exposed - and it does not have to be.
This guide gives you a plain-English AI policy template you can copy, adapt, and put in front of your team in an afternoon. No legalese, no consultant required to read it. First, the short version of what actually matters.
What an AI policy is (and what it is not)
An AI policy is a one- or two-page internal document that answers four practical questions for your staff: which tools they may use, what information they may put into those tools, who is accountable for the output, and when they must disclose that AI was involved. That is it. It is not a compliance binder, and it is not a ban.
The goal is not to slow your team down. As Andrew Clearwater, a privacy and cybersecurity partner at the law firm Dentons who holds the AI Governance Professional (AIGP) credential, put it in a 2026 IAPP piece: "Treat AI as a technology to be governed through the disciplines you already master" (IAPP). You do not need a new department. You need to apply the same common sense you already use for handling customer data and signing off on work.
Why small businesses need this now
The "we're too small to worry about it" argument no longer holds. AI adoption among U.S. businesses hovered between 17% and 20% overall through early 2026, and reached 37% for firms with 250 or more employees (U.S. Census Bureau, Business Trends and Outlook Survey, data collected December 2025 to May 2026). In professional services, adoption runs near 33% (Federal Reserve analysis of BTOS data). Your employees, your competitors, and your vendors are all using these tools.
The risk is not hypothetical. When someone on your team pastes a client contract, a patient record, or a customer list into a free chatbot, that data can leave your control. When AI drafts a quote or a diagnosis-adjacent recommendation and no human checks it, an error goes out under your name. A short written policy is the cheapest insurance you can buy against both.
The gap in the chart above is the whole point. Deloitte found that 74% of organizations expect to be using AI agents at least moderately within two years, while only 21% have a mature governance model in place today (Deloitte, 2026). Ambition is outrunning oversight across companies of every size. A policy is how you close that gap on your own terms before a customer, a regulator, or a bad outcome forces the issue.
The four rules that carry most of the weight
Before the full template, here are the four decisions that do 90% of the work. If you only ever write these down, you are ahead of most.
1. An approved-tools list. Name the specific AI tools your team is allowed to use for work, and require approval before anyone adds a new one. This single step prevents the most common problem: sensitive data scattered across a dozen random apps nobody vetted.
2. A "what never goes in" list. Spell out the information that must never be typed or pasted into a general AI tool - customer names and contact details, payment data, health information, passwords, and anything a client shared in confidence. Most tools' free tiers may use your inputs to improve their models, so treat the input box like a public forum unless your paid plan and contract say otherwise (verify the terms of the specific tool you use).
3. A human owns every output. Make it explicit that AI drafts; a named person reviews and approves before anything reaches a customer or a decision. This matters because AI's real payoff is efficiency, not autonomy - 66% of organizations report productivity gains from AI, but only 20% report actual revenue growth from it (Deloitte, 2026). AI is a fast assistant, not a replacement for judgment. Clearwater's framing is worth keeping on the wall: "The difference between reasonable and reckless in 2026 will increasingly be a matter of evidence" (IAPP). Write down who reviewed what, and why.
4. Disclose when it matters. Decide when you will tell customers that AI was involved - for example, in a chatbot that answers questions, or in AI-generated marketing content. Silent AI use erodes trust fast when it is discovered; a simple disclosure protects the relationship.
If you want to understand where AI genuinely helps versus where it is oversold, our guides on the best AI tools for small business and what AI agents actually are pair well with the policy below.
The plain-English AI policy template
Copy the text below into a document, fill in the bracketed parts, and share it with your team. Keep it to one or two pages. A policy nobody reads protects no one.
[Your Company Name] - AI Use Policy Last updated: [date] · Policy owner: [name/role] · Next review: [date, ideally every 6-12 months]
1. Purpose. This policy explains how our team may use AI tools (like chatbots and AI writing or analysis tools) so we get the benefits without putting our customers, our data, or our reputation at risk. AI is encouraged for approved uses. When in doubt, ask [policy owner] before you use it.
2. Approved tools. You may use these AI tools for work: [list specific tools and the account/plan]. Do not use any other AI tool for company work until [policy owner] has approved it. Use your company account, not a personal one, and keep your login secure.
3. What you must never enter into an AI tool. Do not type, paste, or upload any of the following into a general AI tool: customer or patient names and contact details; payment or bank information; health information; passwords or access keys; trade secrets; or anything a client gave us in confidence. If you are unsure whether something is sensitive, treat it as sensitive and ask first.
4. A human is always responsible. AI can draft, summarize, and suggest - but a named person must review and approve any AI-assisted work before it goes to a customer or informs a real decision. You are accountable for what you send, the same as if you had written it yourself. Check facts, figures, names, and quotes; AI tools can state wrong information confidently.
5. Disclosure. We tell customers when AI is a meaningful part of an interaction, including: [e.g., our website chatbot, AI-generated content, automated call handling]. We do not present AI output as the personal work of a specific staff member when it was not.
6. Security and accounts. Use strong, unique passwords and enable two-factor authentication on AI accounts. Do not connect AI tools to our email, files, or customer systems without approval from [policy owner].
7. Reporting problems. If an AI tool produces something harmful, biased, or wrong that reached a customer - or if sensitive data was entered by mistake - tell [policy owner] right away. You will not be punished for reporting an honest mistake promptly.
8. Review. [Policy owner] reviews this policy every [6-12 months] and whenever we adopt a major new tool.
That is a complete, workable policy. Notice what it does not do: it does not try to predict every future scenario or reference specific regulations that may not apply to you. It sets a floor of good behavior and a clear person to ask. You can strengthen any section as you grow.
Adapt it to your industry
The template is a starting point, not a finished product for every sector. A few common adjustments:
| If you are in… | Tighten this |
|---|---|
| Healthcare or wellness | Section 3 - health information rules; align with your HIPAA obligations |
| Legal or financial services | Sections 3 and 4 - confidentiality and mandatory human review of any advice-adjacent output |
| Home services or trades | Section 5 - disclosure on AI phone answering and quoting |
| E-commerce or retail | Section 3 - customer and payment data; Section 6 - tool integrations |
Where recognized frameworks fit
You do not need to build your policy from a formal standard, but it helps to know they exist - and that borrowing from them makes your policy more credible to clients and auditors. Clearwater's advice for firms that buy and configure AI rather than build it is to "harmonize their existing program with recognized frameworks like ISO 42001 and the NIST AI Risk Management Framework, so regulators, customers and auditors see continuity, not chaos" (IAPP). The NIST AI Risk Management Framework, published by a U.S. government agency, is free and organized around four plain ideas: govern, map, measure, and manage. Your one-page policy is a lightweight version of "govern." You can grow into the rest as your AI use grows.
What This Means for Your Business
Most small businesses do not have an AI problem - they have an AI policy problem. The tools are already in the building. The exposure comes from having no shared rule about which tools are okay, what data stays out of them, and who signs off on the results. Given that only about one in five organizations of any size has mature AI governance (Deloitte, 2026), a clear one-page policy is a genuine competitive advantage, not a bureaucratic burden.
Do three things this week. Pick your approved tools. Write down what never goes into them. Name a person who owns AI decisions. Then paste the template above into a document and share it. You will have cleared a bar most companies larger than you have not.
If you would like help tailoring this to your industry, choosing tools your team can safely use, or building AI into your operations the right way, that is exactly the work we do. Explore our AI and machine learning services or get in touch for a plain-English conversation about where AI fits - and where it does not - in your business.
This article is general information, not legal advice. For obligations specific to your industry or location, consult a qualified attorney.