Short on time? A responsible AI policy for a smaller business can fit on two pages. State which AI tools staff may use, what data they may and may not put in, who checks AI output before it reaches customers, how you handle mistakes and who owns the policy. Review it every quarter, since tools change quickly.
Staff are already using AI at work, with or without a policy. They paste emails into chat assistants, ask tools to draft proposals and summarise contracts, and test image generators for marketing. Most of it is harmless and useful. Some of it leaks customer data, publishes unchecked claims or breaks licence terms.
A policy gives people clear boundaries and gives the business a way to gain the benefits with fewer surprises. Smaller companies do not need a legal tome or a compliance department. They need a short, practical document that people read. This guide shows what to include and how to roll it out.
Key takeaways
- Keep it short, concrete and written in everyday language.
- Cover approved tools, data rules, human review, transparency, fairness, security and incident reporting.
- Name an owner, and review the policy regularly.
- Train staff with real examples.
- Align with recognised frameworks as you grow, such as the NIST AI Risk Management Framework and ISO/IEC 42001.
Principles to build on
Public frameworks give a useful backbone. The OECD AI Principles, adopted by many governments, highlight five themes: inclusive growth, sustainable development and well-being, human rights and democratic values including fairness and privacy, transparency and explainability, robustness, security and safety, and accountability. You can translate each into a plain rule for your own business.
For a deeper structure, the NIST AI Risk Management Framework organises AI risk work into governing, mapping, measuring and managing, and ISO/IEC 42001 is a management system standard that bodies can audit. Companies that sell into Europe should also review the EU AI Act with legal advice, since duties depend on the risk level of the use. Rules differ in other countries and sectors, so check what applies to you.
What the policy should cover
1. Purpose and scope
Say why the policy exists and who it applies to: employees, contractors and anyone using AI on the company’s behalf. Define AI in simple terms, for example tools that generate text, images, code or decisions from data, including assistants built into software you already use.
2. Approved tools and accounts
- List the tools staff may use for work, and who approved them.
- Require business accounts with proper terms, and not personal accounts, for any work involving company or customer information.
- Set a quick route to request a new tool, so people do not go around the rules.
- Check each tool’s terms: how data is stored, whether it is used to train models, where it is processed and how to delete it.
3. Data rules
This is the part that prevents most harm. State clearly:
- Never enter: customer personal data, health or financial details, passwords and keys, confidential contracts, unreleased financial results, trade secrets and anything under a non-disclosure agreement, unless a tool is specifically approved for that data.
- Allowed: public information, generic questions and your own non-sensitive drafts.
- Anonymise data where you can before using it.
- Follow privacy laws that apply to your customers, which vary by country.
4. Human review
AI makes mistakes, sometimes confidently. Require a person to check output before it is used in ways that matter:
- Customer-facing text, advertising and legal or financial statements.
- Anything that includes facts, figures or quotes.
- Code that goes into production, with normal review and testing.
- Decisions about people, such as hiring, performance or credit, where AI may support but must not decide alone, and where law may restrict its use.
Make clear that the person who sends or publishes the content remains responsible for it.
5. Honesty and transparency
- Do not present AI output as human-made where people would reasonably expect to know, and follow rules that require disclosure.
- Tell customers when they are talking to an automated assistant.
- Keep records of significant AI use, such as which tool produced which customer-facing material.
6. Fairness and respect
- Watch for bias in AI outputs, especially in tools that affect people.
- Do not use AI to create deceptive, discriminatory or harmful content.
- Respect copyright and licences. Check that images, text and code you publish are safe to use, and do not claim another company’s work or technology as your own.
7. Security
- Protect accounts with multi-factor authentication.
- Treat text from outside sources as untrusted when it is given to AI tools that can act, since it may contain hidden instructions.
- Review the permissions of any AI tool connected to email, files or business systems, and give only the access it needs. Our article on AI agent governance covers controls for tools that take actions.
- Report suspicious behaviour from AI tools.
8. Incidents and questions
Explain how to report problems, such as pasting confidential data, a wrong answer sent to a customer or a security concern. Promise a blame-free route for early reporting. Name who to ask when unsure.
9. Ownership and review
Name the person responsible, often the owner, operations lead or technology lead. Review the policy every quarter at first, and after any incident or major tool change.
A one-page template outline
- Purpose
- Who it applies to
- Approved tools
- Data we never put into AI tools
- Checks before using AI output
- Disclosure to customers
- Reporting problems
- Policy owner and review date
Roll it out
- Draft with input from people who use AI daily.
- Take legal or privacy advice on data and contract points, especially in regulated sectors.
- Choose approved tools and set up business accounts.
- Train in short sessions with real examples of good and bad use.
- Make it easy: place it where people work and give a contact for questions.
- Monitor usage and incidents, and update.
Training examples that work
- Pasting a customer complaint with name and address into a free chatbot (not allowed) versus removing identifying details first (allowed).
- Using AI to draft a proposal outline (allowed) and sending it unchecked with invented statistics (not allowed).
- Asking an assistant to summarise a public report (allowed) and a confidential contract (needs an approved tool).
Common mistakes
- Banning AI entirely, which pushes use out of sight.
- Writing a policy nobody reads.
- No approved tools, so people use whatever they find.
- Treating the policy as a one-off.
- Forgetting contractors and suppliers.
Growing the policy
As AI use grows, add an inventory of AI systems, risk assessments for higher-risk uses, supplier checks, testing and monitoring, and links to your privacy and security programmes. Our guide to measuring AI cost and our article on evaluating LLM output support later stages.
How SoftSapien helps
SoftSapien helps businesses of every size set up practical AI policies, choose and configure approved tools and train their teams, building towards formal governance as needed. See our AI development and cybersecurity consulting services.
To shape a policy for your business, visit the contact page to chat with us, send a message or schedule a free consultation call.
Frequently asked questions
Does a small business need an AI policy?
Yes. Staff are likely using AI tools already, and a short policy reduces data leaks, unchecked claims and licence problems while allowing the benefits.
What should an AI policy cover?
Purpose and scope, approved tools and accounts, data rules, human review, transparency, fairness and respect, security, incident reporting and ownership with a review date.
What data should never go into AI tools?
Customer personal data, health or financial details, passwords and keys, confidential contracts and trade secrets, unless a tool is specifically approved for that data.
Which frameworks can guide a growing policy?
The NIST AI Risk Management Framework, ISO/IEC 42001, the OECD AI Principles and, for Europe, the EU AI Act, with legal advice on what applies.
Can SoftSapien help draft an AI policy?
Yes, including training and tool setup. Contact SoftSapien through the contact page to chat with our team, send a message or schedule a free consultation call.
