If you use ChatGPT, image tools, or AI assistants in your business, you need a simple policy before a mistake becomes a client problem. A one-page AI policy keeps your team clear on what’s allowed, what needs review, and where the risks are.
Small businesses are adopting AI faster than most of them are documenting it. I see this all the time: a founder uses ChatGPT for emails, a staff member uses an image generator for social posts, and someone else pastes customer notes into an AI tool without thinking twice.
That doesn’t mean your business is doing something wrong. It means you need a basic rulebook.
I’m not talking about a 20-page legal document nobody reads. I mean a one-page AI policy: plain English, practical, and specific to how your business actually works. For most small businesses, that’s enough to reduce risk, set expectations, and avoid the weird gray areas that show up once AI becomes part of daily work.
Why a small business needs this now
AI tools feel casual because they’re easy to use. That’s exactly why they create risk.
The main problems I see are simple:
- staff entering confidential client or employee information into public AI tools
- AI-written content being published without review
- made-up facts, pricing, or legal claims slipping into customer-facing material
- copyright and ownership confusion around images, copy, and brand assets
- nobody knowing who is responsible when something goes wrong
A policy solves that by answering one question: how do we use AI safely and responsibly in this business?
If you have even one employee, contractor, or virtual assistant using AI, you should write this down.
What your one-page AI policy should cover
Keep it short. If it takes more than five minutes to read, most people won’t read it.
Here’s the structure I recommend.
1. State the purpose
Start with one or two lines explaining why the policy exists.
Example:
“This policy explains how we use AI tools in our business. Our goal is to save time while protecting customer data, maintaining quality, and keeping human oversight on all important work.”
That sets the tone immediately. AI is allowed, but not unmanaged.
2. List approved uses
Be specific about where AI can help.
Typical approved uses might include:
- drafting blog outlines or email first drafts
- summarizing meeting notes
- brainstorming ad ideas or headlines
- improving grammar and readability
- creating internal templates
- generating non-sensitive image concepts
This matters because people tend to assume “AI is fine for everything” unless told otherwise.
3. List prohibited uses
This is the most important section.
In plain terms, say what your team must not do.
Examples:
- do not paste customer personal data, medical details, financial records, contracts, or employee HR information into AI tools unless specifically approved
- do not use AI to give legal, tax, medical, or regulated advice to customers
- do not publish AI-generated content without human review
- do not create fake testimonials, fake case studies, or misleading before-and-after results
- do not use AI-generated images or copy in a way that infringes on someone else’s rights
If your business handles sensitive information, this section should be even stricter.
4. Require human review
This should be non-negotiable.
Anything customer-facing should be checked by a real person before it goes live. That includes website copy, proposals, ads, blog posts, chatbot responses, and email campaigns.
AI is fast, but it is not accountable. You are.
I’d write it like this: “AI may assist with drafting, but a human must review and approve all final external content.”
That one sentence prevents a lot of bad decisions.
5. Define data rules
Most AI risk in small businesses comes down to data handling.
Your policy should explain what can and cannot be entered into AI systems. A simple rule is: if you wouldn’t post it publicly, don’t paste it into a general AI tool unless you’ve checked the tool’s privacy settings and business terms.
For example, an independent consultant might use AI to clean up a proposal draft, which is fine. But they should remove client names, budgets, and confidential project details first.
If you run analytics on your website, this is also a good time to think about your wider privacy setup. I often recommend Fathom Analytics for small business sites that want useful traffic reporting without invasive tracking.
6. Name who is responsible
Someone should own AI use, even in a tiny company. In a five-person business, that might just be the founder.
The policy should say who approves new AI tools, who answers questions, and who handles incidents.
Without that, people guess. Guessing is how small issues become expensive ones.
A realistic example
Let’s say a family-run plumbing company has an office manager, two field techs, and the owner. The office manager starts using AI to draft appointment reminder emails and basic blog posts about common plumbing problems. That’s a sensible use.
But then a tech uploads photos from a customer’s home into an AI tool to “enhance” them for social media, without checking whether the house number, family pictures, or documents are visible in the background. That’s where trouble starts.
A one-page AI policy would make this simple:
- AI can be used for draft marketing copy
- customer details and property-specific information must not be uploaded without approval
- all public content must be reviewed by the owner or office manager before posting
That’s not bureaucracy. That’s basic operational hygiene.
Keep it practical, not performative
Your AI policy does not need to sound impressive. It needs to be usable.
Write it in normal language. Put it in your shared drive. Review it every few months. Update it when you add new tools.
If your business creates content regularly, you may also want a simple workflow for how drafts move from AI to human review to publication. Even tools like Canva Pro for quick graphics or ConvertKit for email campaigns become safer when your process is clear and documented.
My honest advice
Don’t wait until a client asks, “Are you using AI for this?” or until a team member accidentally shares something sensitive.
A one-page policy is cheap to create and useful immediately. It helps you move faster because people know the boundaries. It also shows clients, staff, and partners that you’re treating AI like a business tool, not a toy.
If you want, start with a simple draft today. One page. Purpose, approved uses, banned uses, review process, data rules, and responsibility. That’s enough for most small businesses.
And if AI is becoming part of your marketing or website workflow, it’s worth checking whether the rest of your site setup is keeping up too. You can get an instant website estimate at juliusmason.com/#instant-quote or request a free audit at juliusmason.com/free-website-audit.
