How to write your first AI policy in an afternoon
You don't need a lawyer to write a useful AI policy. You need a clear head, a 60-minute conversation with your team, and a willingness to publish version 1 instead of perfecting version 7.
A useful first policy is one page, plain English, and reviewed quarterly.
Seven sections cover what every small business needs.
Skip the legal disclaimers — they make the document longer and less likely to be read.
Step 1: Take inventory (15 minutes)
Send a one-question email to every team: 'What AI tools have you used for work in the last 30 days?' Promise no judgment. Wait 48 hours. The list you get is the actual scope of your policy.
Step 2: Draft the seven sections (60 minutes)
Open a blank document. Aim for one page total. Use these section headings.
- Why we have this policy. (One paragraph; be honest about why.)
- Approved tools. (List by name; everything else needs approval.)
- What data is off-limits. (Specific to your business.)
- What requires human review. (Anything customer-facing, by default.)
- Personal AI tools. (Yes, no, or limited — be specific.)
- When in doubt, ask. (Name the person; promise no penalty.)
- Review cadence. (Quarterly for year one.)
Step 3: Run it past three people (30 minutes)
Show your draft to a department head, a frontline employee, and someone outside the company you trust (bookkeeper, fractional CFO, peer business owner). Three quick reads catch every embarrassing misstatement. Do not send it to a lawyer yet — you're checking for clarity, not compliance.
Step 4: Roll it out (30 minutes)
Hold a 30-minute team meeting. Walk through every section. Answer questions. Send the document by email afterward, with a recurring quarterly meeting on the calendar. Done.
If you're in a regulated industry or you want professional review before signing, this is when to hand it to counsel — but a one-pager rarely needs more than a 30-minute review.
Plain-English answers
What if my industry needs more than this?
Can you write the policy for us?
Want a hand getting this right?
A 30-minute conversation often saves weeks of guessing. We'll talk through your team, your data, and what to do first — no slide deck required.