How to Write a One-Page AI Policy for Your Small Business
If your company doesn’t have an AI policy, that doesn’t mean your company isn’t using AI. It means AI is running inside your business with no rules. Right now, someone on your team is probably pasting a salary into a chatbot. Or a Social Security number. Or a client’s credit card information. They’re not trying to be reckless. Nobody ever gave them a line to stay behind. So let’s give them one. This is how to write a real AI policy from scratch - one page, five sections, no legalese. I’m an HR pro, not an attorney, so treat this as a starting point, not legal counsel. But something beats nothing, and most businesses right now have nothing.
A policy is not permission. It’s protection.
Most owners think an AI policy is a yes-or-no decision: can people use it or not? Your employees have already answered that for you. Around 40% of employees use AI at work whether their company has a policy or not - more than double what it was in 2023 - and about 8% use it every single day (Gallup). Meanwhile only about 3 in 10 companies have any guidelines at all. Read that again: you’re not behind. You’re early. But the door is wide open, and an open door with no rules is how compensation spreadsheets and client data end up living inside someone’s personal AI account. If you don’t provide approved tools and clear parameters, here’s what happens: people use their personal AI to make their work easier, and your company’s information gets stored somewhere you don’t control and can’t see. Pay for the business versions, set the rules, and get out of the way.
HR metrics are finance metrics - and a policy gap has a dollar sign on it
I say this on repeat: HR metrics are finance metrics. HR owns the largest line item in most companies. Every policy gap has an associated cost, and I’ve watched these land on my desk for 20 years. No rule on what data goes in, and a comp spreadsheet or client file ends up in a public tool? That’s a breach. No human-in-the-loop rule, and a manager leans on AI to run a termination? That’s a wrongful termination exposure. No disclosure rule, and you can’t prove how a hiring decision was made? That’s a discrimination claim waiting to happen. It’s easy to miss on the legal side - 57% of HR pros aren’t even aware of their own state’s workplace AI laws (SHRM). A policy gap is a finance risk sitting on your balance sheet whether you’ve priced it or not. Depositions are time-consuming and expensive, and even a settlement is a mess. Draft the policy.
The five sections of a one-page AI policy
You don’t need a PhD to read it. If it doesn’t sound like your culture, it won’t get followed. Five plain-English sections your whole team can read in about two minutes:
Approved tools. Name the tools people are allowed to use - and use the paid, business versions where your data isn’t used for training. Business-tier ChatGPT, Claude, and the Microsoft/Outlook suite let you set security in a much richer way than the free versions. If a tool isn’t on the list, an employee has to ask their manager or IT and show a use case for why the company should pay for the secure version.
The never list. What never goes into AI: Social Security numbers, dates of birth, medical information, disciplinary records, compensation data, customer-confidential data. The simple test - if you wouldn’t email it to a stranger, don’t paste it into a chatbot. And even in approved tools, scrub sensitive data on the way in and match it back up on the back end.
A human owns every decision. AI can draft, summarize, and suggest - those are brilliant uses. But a human is the only one who makes and owns any decision that affects someone’s job, status, pay, or a client relationship. No AI-only calls on people.
Disclosure. Say where you use AI - screening, evaluations, discipline - and keep a record of it. That record is what lets you explain how a decision was made later, if it’s ever questioned.
An owner and a review date. One named person owns this policy, by job title - not “a department.” And you review it on a schedule. For most of your handbook, annually is fine. For AI, review it quarterly, because it’s changing that fast.
Don’t over-restrict
Here’s the mistake I already see companies making: banning AI, or writing a policy so locked-down no one can actually work inside it. Of the companies that do have an AI policy, only about a quarter call it clear and future-proofed, and 54% are too restrictive (SHRM, State of AI in HR, 2026). A policy nobody can follow is a policy nobody follows. Be just as clear about what stays human. Hand AI the first draft of a job description, the first pass at a resume sort, the rough start of a policy - then keep the hiring call, the disciplinary decision, and the actual coaching conversation in human hands. People are already numb to AI slop; when a leader’s “personal” message is obviously machine-written, employees stop reading it. Protect the human parts of your business on purpose.
The prompt I actually use
When I draft a policy with AI, I feed it everything: the client’s state, industry, revenue, headcount, W-2 vs. contractor mix, growth goals, known pain points, and their mission, vision, and values. Then I add one line that changes everything: before you draft, ask me 5-10 questions that would help you write the best possible policy - and stay compliant to my state’s laws and any federal law. Then I answer, and it drafts. And stop typing so much. Hit the mic button and talk to it - your prompts get better when you ramble out loud, and it captures your actual language and voice far better than clean typed sentences. Writing policies is not the sexiest work anyone’s ever done. But this one is worth it, because the tool reshaping your business shouldn’t quietly become your biggest liability.
Not sure whether your people systems could survive an AI mistake right now? Take the free HR Audit to see exactly where your gaps are in 5 minutes. saltandlightadvisors.com/hraudit
Resources to keep building:
🎯 Take the free HR Audit - Score your HR systems in 5 minutes and see exactly where your gaps are.
saltandlightadvisors.com/hraudit
📖 Get The HR Easy Button - Kerri’s book on building HR systems that actually work for small businesses. https://amzn.to/4cPyrFh
✉️ Subscribe to the newsletter - Weekly HR insights for founders, in your inbox every Monday.
saltandlight.myflodesk.com/saltandlightadvisors
Need fractional HR support or want to talk through a specific challenge? saltandlightadvisors.com/contact
Ready to build foundational HR systems on your own? saltandlightadvisors.com/hrfoundations
