AI Policy for Small Business: Why the One-Page Rule Beats a Ban
Most small business teams are already using AI on the job, with no rule about what shouldn't go into it. This article argues that the real risk isn't the AI itself but sensitive information (client names, contract terms, pricing, financial data) getting pasted into a chat window without anyone having said it's off-limits.
Prefer to listen?
Listen to the episode: Using AI for You and Your Team: What Has to Be in Place First
AI Policy for Small Business: Why the One-Page Rule Beats a Ban
By Dr. Mike Donaldson
Your team is already using AI. Nobody asked permission first. Nobody wrote a rule. Someone found ChatGPT or Gemini or Claude on their phone, tried it once, and kept going. If you have not put together an AI policy for small business yet, that decision already happened without you. The real question is no longer whether your team should use AI. It is something they should never type into it.
The Real Problem
Most owners assume the risk is the technology itself. It is not. These platforms handle most tasks well. The risk is what gets pasted into the chat window before anyone stops to think about it. A customer complaint email goes in whole, name and account number included. A pricing sheet gets copied over just to clean it up. A signed contract gets uploaded so the software can summarize the terms, client name and payment details still attached.
None of this feels risky at the moment. It feels like getting help. That is exactly what makes it dangerous. The gap is not the software. The gap is that nobody told your team what stays out.
The Framework
Twenty years in manufacturing and aerospace operations taught me a simple rule. You do not run a new machine near the product until you know exactly what it touches and what it changes. A new machine, a supplier change, a process shift, all of it gets checked first. Nothing moves forward until the awareness is in place.
AI is a new piece of equipment on your information floor. Foundation First means the same rule applies here too. AI accelerates what already exists, good or bad. If your team already guards sensitive information carefully, AI sits safely on top of that habit. If that habit has never existed, AI exposes the gap fast, and quietly.
Here is what that looks like in practice. An owner needed one thing from AI: find every "shall" and "shall not" clause in a signed contract. Fair task, and AI handled it in seconds. The entire contract went in unedited, though. Client name, scope details, payment terms, contract value, all of it sitting in the chat window. Nobody had asked what needed to come out first.
The fix was not complicated. Strip the client name, the payment terms, and the contract value before anything goes in. Paste only the sections that matter. AI still finds every clause in seconds. The exposure never happens. The software did not need to change. The awareness did.
The Mistake Most Owners Make
Two extremes show up here, and both fail for different reasons. Silence assumes the team already knows better, or treats this as an IT problem to be handled someday. Someday rarely comes, and the habit keeps forming, unchecked, every day it goes unaddressed.
The opposite extreme is an outright ban, no AI, full stop. It sounds responsible. It is not. A ban pushes the behavior underground, onto personal phones, with the exact same risk and none of the visibility.
The middle path works because it treats this as a floor rule, not a technology decision. A short, plain list of what goes in and what stays out, explained once, posted somewhere visible, repeated for every new hire. That is what a working AI policy for small business actually looks like. It does not need to be more complicated than that.
What To Do This Week
Building an AI policy for small business does not require a legal team or a binder nobody reads. Four steps, and all four fit into one week.
1. Have the conversation out loud with your whole team. Not a memo. Not an email buried in a folder nobody opens. Fifteen minutes, face to face, is enough.
2. Name what is off limits and say why. Customer financial data. Employee personal information. Anything under a signed confidentiality agreement. Unreleased pricing. Anything proprietary you would not want outside your walls.
3. Give your team a place to ask when they are unsure. Uncertainty without an answer is where mistakes happen.
4. Write it down. This is the step almost everyone skips. One page. Three things that never get pasted into AI, and why each one matters. Post it where people will actually see it, and repeat it for every new hire who joins the team.
If you run the business alone, none of this changes. You are the team. You are the one pasting contracts, proposals, and client numbers into a chat window to save time. Ask yourself the same question you would ask an employee. What just went in there, and should it have?
Your team already decided to use AI. The only decision still in front of you is what never goes into it, and whether you write that decision down before it costs you something.