# A simple AI policy for small business teams

> How to write a one-page AI policy for a small business: approved tools, what information never goes into AI, human review, and keeping it current.

By [Jon Brockett](https://digitalrocket.co/about), Founder & Lead Developer · Published 2026-09-24 · Canonical page: https://digitalrocket.co/insights/ai-policy-small-business

One page that tells your team which AI tools to use, what never to share, and when a person has to check the work.

[Jon Brockett](https://digitalrocket.co/about) Founder & Lead Developer · 20+ years in web

Sept 24, 2026 · 6 min read

Your team is probably already using AI, whether or not anyone approved it. That’s not a reason to ban it. It’s a reason to write down a few rules so people can use it confidently, without putting customer information at risk.

A good small business AI policy fits on one page. Here’s what to put on it.

## 1. Which tools are approved

List the AI tools your team can use for work, and make sure they’re on company-controlled business accounts, not personal ones. Business plans generally give you more control over data settings and let you remove access when someone leaves.

## 2. What never goes into AI

- Customer personal information, like Social Security numbers, account numbers or health details
- Passwords, access codes and security settings
- Financial records that aren’t meant to be shared
- Anything covered by a confidentiality agreement or a client contract

When in doubt, remove names and identifying details first, or ask before pasting.

## 3. A person reviews the work

AI can be confidently wrong. Anything that reaches a customer, a client or the public gets checked by a person first: facts, numbers, names, tone and promises. The person who sends it owns it.

## 4. Be open where it matters

Decide when you’ll tell customers AI was involved, for example in chat assistants on your website. Being upfront builds trust, and some industries have their own rules about it.

## 5. Who to ask, and when to update it

Name one person who answers AI questions and keeps the list of approved tools current. AI tools change quickly, so review the policy every few months.

Copy this outline

Approved tools · Never share · Always review · When we disclose AI · Who to ask · Last reviewed (date). Fill in each line in plain language, and share it with everyone who uses a computer for work.

This is practical guidance, not legal advice. If you’re in a regulated industry like healthcare or finance, check with your attorney or compliance advisor as well.

ABOUT THE AUTHOR

Jon Brockett

Founder and lead developer of DigitalRocket in Syracuse. Jon has spent more than 20 years building websites and software, including over a decade at Syracuse advertising agencies, and now helps Central New York businesses put AI to work, connect their tools with custom software, and run fast, secure websites.

## Keep reading

[AI · 7 min read Where should a small business start with AI?](https://digitalrocket.co/insights/where-to-start-with-ai) [Security · 7 min read Zero-trust security for small business websites](https://digitalrocket.co/insights/zero-trust-website-security)