An AI policy for small business does not need to be a 30-page legal document. It needs to fit on one page and answer four questions: which AI tools your team may use, what information never goes into them, who checks AI output before a customer sees it, and who owns the policy when something changes. If you run a 5- to 50-person company and you have not written those answers down, your employees are making them up as they go. This guide gives you the one-page version, explains why each line is there, and shows how to roll it out in a week without slowing anyone down.
Why a small business needs an AI policy now
The honest reason is that AI use is already happening inside your business whether you planned for it or not. A Cybernews survey of more than 1,000 U.S. employees, reported by the Journal of Accountancy, found that 59% use unapproved AI tools for work, and 93% of executives and senior managers in the survey said the same. The same report found that three-quarters of those employees admitted sharing possibly sensitive information with those tools, most often employee data, customer data and internal documents.
The policy gap is just as clear. In that survey, 23% of employees said their company had no official policy on unapproved AI use and another 16% did not know whether one existed. In a small business those numbers are usually worse, because there is no IT department and no HR team to write anything down.
There is a cost side too. The same article cites an IBM report finding that the average data breach costs $670,000 more when it is caused by shadow AI rather than sanctioned AI. You do not need to be a large company for a customer list pasted into a free chatbot to become a problem.
A short policy is not about banning AI. Banning it mostly pushes use onto personal phones where you cannot see it. The point is to make the safe way the easy way.
The one-page AI policy for small business: a template
Copy this, replace the bracketed parts, and you have a working first version. Each section is short on purpose. If your team will not read it, it does not protect you.
- Purpose. [Company name] uses AI tools to save time on drafting, summarizing and routine follow-up. People stay responsible for everything we send, sign or decide.
- Approved tools. Staff may use only the tools on this list, on company accounts: [tool 1, plan name], [tool 2, plan name]. Ask [policy owner] before using anything else, including browser extensions and phone apps.
- Never put these into an AI tool. Customer payment details, Social Security or license numbers, passwords and logins, employee medical or payroll records, anything covered by a client confidentiality agreement, and anything you would not want read aloud in court.
- Allowed with care. Customer names and job details may go only into approved tools on a business plan. Remove anything not needed for the task.
- Human review. A person reads and approves AI output before it reaches a customer, a vendor, a public review reply, a contract or a price. No auto-sending from unapproved tools.
- Hiring and people decisions. AI may help draft job posts. It may not screen, rank or reject applicants or employees without [owner] approval and a documented human review.
- Disclosure. If a customer is talking to an AI system, such as a chat widget or phone agent, it says so.
- Mistakes and incidents. If you put restricted information into an AI tool by accident, tell [policy owner] the same day. Reporting quickly is never punished.
- Owner and review date. [Name] owns this policy and reviews it every [six] months or when we add a tool.
Choose approved tools before you write the rules
The single most useful decision in the whole policy is the approved tools list, and it matters which plan you buy, not just which brand. Consumer and business plans are often governed by different data terms. For example, OpenAI states that it does not train its models on an organization's data by default on its business offerings, including ChatGPT Business and the API. A free personal account an employee signed up for on their own is a different arrangement, and you do not control it.
So the practical rule is simple: if staff are going to use AI for work, pay for business seats on one or two tools, put them on company logins, and turn off what you do not need. That costs less than one bad week. It also lets you remove access the day someone leaves, which you cannot do with a personal account.
| Question to ask a vendor | Answer you want |
|---|---|
| Is our data used to train your models? | No by default, in writing, for the plan you are buying |
| Can we manage users from one admin account? | Yes, with the ability to remove a user immediately |
| Does it support single sign-on or enforced two-factor login? | Yes, or at minimum two-factor on every seat |
| How long is our data retained, and can we delete it? | A stated retention period and an admin delete option |
| Can we export our data if we leave? | Yes, in a standard format |
The data rules that actually prevent problems
Most AI policy templates online list fifteen categories of restricted data. Your team will remember three. Keep the never list short and concrete, and tie it to the work your people actually do. For a home service company that means payment card numbers from the office, customer gate codes and alarm codes, and technician payroll. For a dental or medical office it means anything from a patient chart. For a law or accounting firm it means anything covered by a client engagement.
Then give people a substitute behavior, not just a rule. Instead of pasting the full customer email thread into a chatbot, paste the question with the name and address removed. Instead of uploading the client spreadsheet, describe the columns and ask for the formula. The output is just as useful, and nothing sensitive leaves your systems.
Human review and the New Jersey hiring angle
AI drafts are confident and sometimes wrong. A review reply that promises a refund you never offered, or a quote with the wrong number, is still your company speaking. That is why the template requires a human to approve anything customer-facing. In practice this is a two-minute read, not a committee.
Hiring deserves its own line for New Jersey employers. In January 2025 the New Jersey Attorney General and Division on Civil Rights issued guidance stating that a covered entity is not shielded from liability for algorithmic discrimination under the Law Against Discrimination because a third party built the tool. In plain terms: if an AI resume screener you bought filters out applicants unfairly, it is still your hiring decision. Keep a person in the loop and keep notes on why candidates advanced or did not. This is general information, not legal advice; talk to your employment attorney about your own hiring process.
How to roll it out in one week
- Day 1: Ask your team, without judgment, which AI tools they use for work today. You will learn more from this than from any template.
- Day 2: Pick one or two approved tools and buy business seats. Set up company logins with two-factor authentication.
- Day 3: Fill in the one-page template above with your tools, your never list and your policy owner.
- Day 4: Walk through it in a 20-minute team meeting with three real examples from your own work: one allowed, one allowed with edits, one never.
- Day 5: Have everyone sign it, store it with your handbook, and put the review date on the calendar.
If you want a framework to grow into later, the NIST AI Risk Management Framework, released January 26, 2023 and intended for voluntary use, organizes the work into four functions: govern, map, measure and manage. NIST added a Generative AI Profile on July 26, 2024. Neither is required for a small business, but both are useful reference points if a larger client ever asks how you manage AI risk.
Where a policy ends and real automation begins
A policy covers how people use general-purpose chat tools. It is the floor, not the goal. The bigger savings for a small business come from AI that is built into a specific workflow with the rules already baked in: follow-up messages that pull from your CRM and only send approved templates, a website chat agent that answers from your own service list and hands off to a person, or a weekly report that summarizes jobs without anyone copying data around.
That is the work we do at Red Ridge AI. Our CRM and follow-up automation runs inside systems you control, and the agents in our Agent Manufactory are configured to disclose they are AI and to stay inside the boundaries you set. If you are not sure what data is already exposed, a one-time website security audit is a sensible first step.
Frequently asked questions
Do small businesses legally need an AI policy? There is no general federal or New Jersey law that requires a small business to have a written AI policy. But existing laws on privacy, discrimination and customer data still apply when AI is involved, and a written policy is the simplest way to show your team knows the rules.
Should we just ban ChatGPT and similar tools? Usually not. Bans tend to move AI use onto personal phones and accounts where you have no visibility. Approving one or two business-plan tools and setting clear data rules gives you more control than a ban.
How long should an AI policy for small business be? One page for the policy itself, with a short list of approved tools attached. If it takes more than five minutes to read, people will skip it, and an unread policy protects no one.
How often should we update it? Review it every six months and any time you add a new tool or a new type of customer data. AI vendors change their plans and data terms often, so check the terms for each approved tool at each review.
Get help putting AI to work safely
Writing the policy takes an afternoon. Turning AI into systems that save real hours, without exposing customer data, is where most owners want a builder on their side. Book a call and we will look at where AI fits in your business and what to automate first. If you already know you want automation and an AI-powered website working together, see what is included in the The Never-Miss-a-Job System.