AI policy for small business: simple rules your team can follow

An AI policy for small business is a short document that tells your team which AI tools they may use, what information must never go into them and what a person has to check before anything reaches a customer. It does not need to be long: one clear page that anyone can read in a few minutes is enough for most small teams. The aim is not to ban AI, but to let people use it with confidence.

Why does a small business need an AI policy?

Because your team is already using AI, with or without permission. Someone in customer service polishes replies in a chatbot, a salesperson pastes meeting notes to get a tidy proposal, and a new hire uploads a customer spreadsheet to “clean it up”. Each of them is trying to do a better job. None of them checked where the data goes.

Without rules, three things happen. Customer data ends up in personal accounts on tools nobody chose. AI mistakes, like a wrong figure or a promise you never made, reach customers. And your business sounds different in every message. A simple policy fixes all three, and it shows customers and partners that you take their information seriously.

What should an AI policy for small business include?

Six topics cover almost every small business. Each one can be two or three lines.

Approved tools

A short list of the tools people may use for work, and with which account. A business account that the company controls is better than personal ones, ideally with settings that stop your data being used to train the model, where the tool offers that option. An employee’s free personal account is not the place for company information.

Data that never goes in

This is the heart of the policy. A traffic light system is easy to remember:

• Green, fine in any approved tool: marketing copy, ideas, rewriting public content, general questions.
• Amber, approved tools only and nothing that identifies a person: an anonymised customer case, summarised sales figures, draft proposals.
• Red, never: ID numbers, payment details, passwords, health information, full customer lists, contracts and anything covered by a confidentiality agreement.

What a human checks

Anything sent to a customer in the company’s name is read by a person first. Every number, price, date, commitment or legal statement is checked against the source. AI drafts. A person signs off.

Transparency with customers

When do you tell customers they are talking to a bot or looking at a generated image? The minimum: a bot introduces itself as a bot, and a human is always reachable. Our article on trust and transparency when your marketing uses AI covers this in depth.

Your brand voice

A few lines on how you sound: formal or casual, first names or not, words you never use. That way AI assisted text still sounds like you. See our guide to ChatGPT for business marketing without losing your own voice.

Who to ask

One named person who owns the policy and answers questions about new tools or mistakes.

How do you write an AI policy in an afternoon?

You do not need a consultant or a week of meetings. Here is a simple process:

1. Ask the team what they already use. No blame. The goal is to see what is really happening.
2. Choose approved tools. One or two for writing and, if needed, one for images or transcription.
3. Sort your data by traffic light. List the types of information your business holds and give each one a colour.
4. Decide what gets checked, and by whom.
5. Write one page. Short sentences, examples from your own work, no legal jargon.
6. Walk the team through it. Use two or three real examples of what is fine, what is not, and why.
7. Set a review date. Tools change quickly. A regular check, for example every quarter, keeps the page relevant.

A one page AI policy template

Copy this and adapt it to your business:

• We use AI to work faster, not to replace judgement.
• Use only the tools on the approved list, and only with your company account.
• Never enter payment details, ID numbers, passwords, health information or customer lists into an AI tool.
• Customer details go in only without names or anything that identifies the person.
• A person reads every customer facing text before it is sent. Numbers, prices and dates are checked against the source.
• Our chatbot introduces itself as a bot, and customers can always ask for a person.
• Realistic AI images and videos are labelled when people might mistake them for real.
• Made a mistake? Tell the policy owner straight away. Reporting is never punished. Hiding is the problem.

How does the policy change by type of business?

The principles stay the same. The red lines move.

A dental practice

Patient health information is red in any general purpose tool. AI can help write general messages, such as aftercare instructions or appointment reminders, but not analyse a specific patient’s details outside an approved system.

A letting agency

AI written property descriptions save time, but every factual detail, such as size, floor, parking or a balcony, is checked against the listing data before it goes live. Landlord and tenant details stay out of general tools.

An online shop

AI drafts product descriptions and customer service replies. Returns and delivery policies are always sent in the approved wording, never in a version the AI has paraphrased.

A B2B consultancy

Client documents, proposals and internal figures stay in approved tools only, especially under a confidentiality agreement. Some clients will ask how you use AI on their work, so it helps to have a clear answer ready.

What happens when someone makes a mistake?

Stop, report and fix, without hunting for someone to blame. If sensitive data went into a tool, delete the conversation where possible, work out exactly what was exposed and decide whether a customer needs to be told. Then ask what in the policy was unclear and improve it. A team that is afraid to report will hide problems, and that is always worse than the original mistake.

How do you get the team to actually follow it?

Make the right way the easy way. If the approved tool is available, quick and knows your business, nobody goes looking for a side tool. That is why many businesses start with one tool connected to their own knowledge, such as an AI knowledge assistant for the team that answers from your procedures, with permissions by role.

When AI is built into the systems you already use, such as your CRM or your WhatsApp Business account, it becomes much easier to control what it sees, who uses it and what is stored.

The bottom line

An AI policy for small business is not a heavy legal document. It is one page your team actually reads: approved tools, a data traffic light, human review and transparency. It protects your customers and your reputation, and gives people the confidence to use AI without guessing. At Kaede Digital, when we build AI for business into WhatsApp, CRM and internal systems, we start with exactly these questions: what the AI can see, who is allowed to use it and what a person reviews.

FAQ

Is an AI policy a legal document?

Not necessarily. In a small business it is mainly an internal working document that tells the team what is allowed. It should be consistent with obligations you already have, such as data protection laws like the GDPR and confidentiality agreements with clients, and businesses in regulated sectors should check it against their specific requirements.

Should we ban staff from using ChatGPT?

A blanket ban rarely works, because people keep using the tools quietly. It is better to provide an approved tool on a business account with clear rules about what information can go in. That way you know what is happening, and the team still gets the benefits.

What is the difference between a personal and a business AI account?

With a business account, the company controls users, permissions and privacy settings, and can remove access when someone leaves. Many tools also offer business plans with settings that keep your data out of model training. With a personal account, the information stays with the employee, even after they have left.

How often should we update the policy?

Set a regular review, for example every quarter, and update it whenever a new tool arrives or something goes wrong. AI tools change quickly, and a policy that has not been touched for a long time stops being useful. A review usually takes minutes, not days.