Your team is probably already using AI, whether or not anyone approved it. That’s not a reason to ban it. It’s a reason to write down a few rules so people can use it confidently, without putting customer information at risk.
A good small business AI policy fits on one page. Here’s what to put on it.
1. Which tools are approved
List the AI tools your team can use for work, and make sure they’re on company-controlled business accounts, not personal ones. Business plans generally give you more control over data settings and let you remove access when someone leaves.
2. What never goes into AI
- Customer personal information, like Social Security numbers, account numbers or health details
- Passwords, access codes and security settings
- Financial records that aren’t meant to be shared
- Anything covered by a confidentiality agreement or a client contract
When in doubt, remove names and identifying details first, or ask before pasting.
3. A person reviews the work
AI can be confidently wrong. Anything that reaches a customer, a client or the public gets checked by a person first: facts, numbers, names, tone and promises. The person who sends it owns it.
4. Be open where it matters
Decide when you’ll tell customers AI was involved, for example in chat assistants on your website. Being upfront builds trust, and some industries have their own rules about it.
5. Who to ask, and when to update it
Name one person who answers AI questions and keeps the list of approved tools current. AI tools change quickly, so review the policy every few months.
This is practical guidance, not legal advice. If you’re in a regulated industry like healthcare or finance, check with your attorney or compliance advisor as well.
Founder and lead developer of DigitalRocket in Syracuse. Jon has spent more than 20 years building websites and software, including over a decade at Syracuse advertising agencies, and now helps Central New York businesses put AI to work, connect their tools with custom software, and run fast, secure websites.