Most owner-led companies don’t need a 20-page AI policy. They need one page that answers three questions: which tools we use, what never goes into them, and what a person has to approve before anything leaves the building. Here’s how I’d write that page, and a template you can copy.
Start with the line that matters most
AI is good at reading, sorting, flagging and drafting. People approve prices, quotes, customer commitments and anything that goes to a customer or supplier. If your rules only say one thing, make it that.
The five sections of a one-page AI policy
1. Approved tools
List the AI tools people are allowed to use for work, and who pays for each one. Business accounts the company owns, not personal logins. If a tool isn’t on the list, ask before using it with company information.
2. What doesn’t go into AI tools
Be specific. A typical list:
- Customer lists, pricing and margin data, unless the tool is on the approved list for that use
- Anything covered by an NDA or a customer contract
- Employee personal information and pay
- Passwords, account numbers and banking details
Before anything is connected to your systems, check which tools touch your data and what their terms allow. Read each vendor’s terms up front, then again when you add a tool, change a setting or the vendor updates its terms. It’s a short read, not a research project.
3. Where a person signs off
| Output | Who approves |
|---|---|
| Prices and quotes | The person who owns pricing today |
| Anything sent to a customer or supplier | The sender, every time |
| Changes to records in the ERP or CRM | The record owner |
| Reports that go to the owner or the board | The person who normally signs off the report |
The rule of thumb: AI can draft it, flag it or sort it. A person sends it.
4. Who owns each tool
Every AI tool in use has a named owner. That person knows what it touches, keeps a short runbook (what it does, where its data comes from, how to turn it off) and is the first call when it gets something wrong.
5. When you review it
Look at the list every quarter. Drop tools nobody uses, add the ones people asked about, and check that the approval points still match how work actually gets done.
Copy this template
| Section | Fill in |
|---|---|
| Approved tools | Tool, what it is used for, account owner, who pays |
| Never put into AI tools | Your list (start with the four above) |
| Approval points | Output, who approves |
| Tool owners | Tool, owner, runbook location |
| Review | Quarterly, owner name, next review date |
This is practical guidance, not legal advice. If you work under customer contracts with data terms, have your attorney read the final page.
Where this fits
I build every tool this way: it shows where its answer came from, runs on accounts you own, and comes with a runbook that lists what it touches. If you want help picking a first project, start with how to pick your first AI project, or see how I work.
